Client workspace · Last updated: 17 September 2026
This notice covers accounts, onboarding and use of app.crewingautomations.com, including testing workspaces. An inbox is not live until we confirm activation. Do not send vacancies or candidates before that confirmation.
Who is responsible
Crewing Automations is operated by its founder, Gregory Boch in Barcelona, Spain. Contact gregory@crewingautomations.com about privacy, access or deletion.
We are the controller for account administration, service communications and our own security and usage records. When we process an agency’s candidate, vacancy or CRM data to provide its service, the agency determines the purpose and we process that data on its instructions. Candidates should normally contact the agency handling their application; we can help route a request.
Information we process
- Accounts and onboarding: email address, company name, first and last name, role, fleet size and monthly vacancy volume (self-serve applications), selected CRM, setup notes, progress and workspace settings.
- Sign-in and security: short-lived email-code challenges, attempt and expiry records, session identifiers and delivery status. Sign-in codes expire after ten minutes; code verification records are hashed rather than stored as readable codes.
- Integration access: CRM usernames, passwords, client IDs and client secrets you choose to submit. Complete credential sets are encrypted before database storage. Pages show a limited identifying hint, not the stored credential values.
- Service content: where an agency activates the relevant service, vacancy emails, attachments, candidate and CRM records, communications, generated results and operator decisions needed for that workflow. The public tour uses fictional sample data.
- Usage and support: visited paths, visit times, browser user-agent information, referring URLs where supplied, account association when signed in, and operational records used to diagnose problems.
Purposes and legal bases
We use account and onboarding information to provide the requested service, arrange access and support the agency relationship. The basis is performance of a contract or steps requested before entering one where you are the contracting individual, and our legitimate interest in administering business accounts where you act for an agency. Security, troubleshooting and basic service analytics support our legitimate interest in operating a reliable service. We may retain information where a legal obligation requires it.
The agency is responsible for the legal basis and notices for candidate or other personal data it asks us to process. Providing credentials does not activate an integration. We do not sell personal data or use workspace content for advertising.
Cookies and browser storage
The app uses a session cookie to keep you signed in (up to 30 days), a short-lived sign-in challenge cookie, and a theme-preference cookie when you select a theme (up to one year). Invited signup may also use an access cookie. Demo presentation controls can use session storage. These support authentication and requested functionality; they are not advertising trackers. Credential form entries are not saved to browser local or session storage. Signing out removes the current sign-in cookie.
Service providers and access
Prisma provides application hosting and database services. Resend delivers sign-in and service emails and supports email intake where enabled. OpenAI processes content for AI features used by the agency; entering onboarding credentials does not send them to an AI model. Connected CRM, messaging and publishing providers receive information needed for the workflows the agency activates. Telegram is used for internal operational notifications and configured messaging workflows. Authorized service operators may access information needed to support or provision the service.
Providers may process information outside the European Economic Area. Contact us for the processing locations and transfer arrangements applicable to your service, or for details of the providers involved in a particular workflow.
Retention
Account details and onboarding records are retained while the account is maintained, subject to deletion requests and applicable legal needs. Submitted integration credentials remain stored until removed as part of integration or account administration; replacing access revokes the previous credential record and does not mean its encrypted row is immediately erased.
Demo run events, snapshots and account-run links older than 90 days are eligible for an automated cleanup that runs on app activity. This is not a promise that every copy, operational record, provider record or live agency record is deleted after 90 days. Live-service retention and deletion are handled under the agency’s service arrangements. Ask us about the records and retention applicable to your workspace.
Your rights and choices
Subject to applicable law, you can request access, correction, erasure, restriction or portability of your personal data, and object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. Email gregory@crewingautomations.com; we may need to verify your identity or coordinate with your agency.
You may complain directly to your local supervisory authority, including Spain’s AEPD. You do not need to contact us first. The European Commission explains these data-protection rights.
We update the date above when this notice changes. For the public marketing website, see the website privacy policy.