Privacy notice
TrvlCrew is operated by Viktor Nobiuz ("we", "us"). We act as the data controller for personal data collected through the service. This notice explains what we collect, why, who we share it with, and the rights you have.
What we collect
- Account details — name, email, account type (operator or traveller), optional avatar and phone.
- Trip content — itineraries, documents, announcements, boarding passes, and photos operators upload.
- Traveller activity — tour membership, chat messages, checklists, and private field notes.
- Usage and device data — IP address, browser and device identifiers, basic analytics about how the app is used.
- Payment metadata — the amount, status, and identifiers of payment requests you make or receive. Card details are collected and stored by Paddle, not by us.
Why we use it
- Creating and running your account and tours (contract performance).
- Delivering the features you use — chat, documents, notifications (contract).
- Security, fraud prevention, and abuse handling (legitimate interests).
- Product improvement and customer support (legitimate interests).
- Meeting legal, tax, and accounting obligations (legal obligation).
Who we share it with
- Service providers — hosting, database, email delivery, and analytics providers who process data on our behalf under written agreements.
- Paddle — our Merchant of Record for payments. Paddle processes card data, manages billing, calculates and remits tax, and handles refund requests. See Paddle's privacy policy.
- Professional advisers — legal, accounting, or tax advisers where needed.
- Authorities — where required by law or to protect rights, safety, or property.
Who can see what inside the app
Trips are only accessible to the operator who created them and the travellers they invite. Chat is visible to everyone on that tour. Personal field notes are private to the traveller who wrote them. Payment requests are visible to the operator and to the traveller who owes them.
Retention
We keep account and tour data while your account is active. When you delete your account or a tour we remove associated content, except records we're required to keep for legal, tax, or fraud-prevention reasons (typically up to 7 years for payment-related records).
Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict, or port your personal data, to object to processing, and to withdraw consent. You can also complain to your local data protection authority. To exercise a right, contact us via the contact page and we'll respond within one month.
International transfers
Some of our service providers, including Paddle, operate outside the UK / EEA. Where that happens we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.
Security
We use appropriate technical and organisational measures — including encryption in transit, access controls, and audited hosting — to protect personal data. No system is perfectly secure; if we ever detect a breach that affects you, we'll notify you as required by law.
Cookies
We use essential cookies for login and session management, and lightweight product analytics. We don't use advertising cookies.
This is a plain-language notice maintained by Viktor Nobiuz. For questions, please get in touch.