Privacy Policy

Last Updated: May 26, 2026

Effective Date: May 26, 2026

1. Introduction

Ole Skool Kreativz ("we", "us", "our", or the "Company") operates the CrewCafé mobile application and the website at https://crewcafe.app (collectively, the "Service"). CrewCafé is a call-sheet and production-management application designed for film and television production crews, providing tools to organise projects, call sheets, crew rosters, shoot days, and scene breakdowns.

This Privacy Policy explains what information we collect, how we use it, who we share it with, how long we keep it, and the rights you have over it. It applies to all users of the Service, including users in the European Economic Area ("EEA"), the United Kingdom, the United States (including California), Australia, South Africa, and elsewhere. By creating an account or using the Service, you acknowledge that you have read and understood this Privacy Policy.

We comply with the EU General Data Protection Regulation ("GDPR"), the UK GDPR and Data Protection Act 2018, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), and the South African Protection of Personal Information Act, 2013 ("POPIA"). Where required, the Company acts as the "data controller" or "responsible party" for personal information you provide.

2. Information We Collect

We collect only the information we need to provide the Service. We do not sell your personal information, and we do not use it for advertising. The categories of information we collect are described below.

2.1 Account Data

When you create an account, our authentication provider Clerk collects and stores:

• Your email address;
• Your full name;
• A securely hashed password, or a third-party sign-in identifier if you sign in with Apple or Google;
• Basic authentication metadata such as last sign-in time, sign-in method, and session tokens.

We do not see or store your raw password. Account data is linked to a unique user identifier that is referenced by the rest of our systems.

2.2 App Usage Data (User Content)

When you use CrewCafé, you create production records that are stored in our Supabase database and file storage. This may include:

• Projects, productions, and production settings;
• Call sheets, shoot days, locations, and schedules;
• Crew rosters, contact details you choose to enter for crew members, roles, and departments;
• Scene breakdowns, scripts, and related notes;
• Attachments and files you upload (such as PDFs, images, or location maps);
• Comments, statuses, and other content you choose to add to your projects.

You are the controller of the content you create. If you upload information about third parties (for example, crew member contact details), you confirm that you have an appropriate legal basis to do so under applicable privacy law.

2.3 Device and Technical Data

To deliver the Service reliably, we collect limited technical data about your device and connection:

• Device push-notification tokens issued by Expo, Apple Push Notification Service, and Firebase Cloud Messaging, used solely to deliver notifications you have enabled;
• Device platform, operating-system version, and app version, used for compatibility and error handling;
• IP address and approximate region (city/country level), processed transiently for security, abuse prevention, and to comply with applicable law;
• Server logs (such as request timestamps and error codes) that are necessary to operate and secure the Service.

We do not collect precise location data, health data, contacts, photos, calendar entries, microphone audio, or sensor data unless you explicitly upload such content as part of your production records.

2.4 Subscription Data

If you purchase a subscription, we receive a subscription status and an anonymised subscriber identifier from RevenueCat. Apple and Google process your payment information; we never see your full payment card details, billing address, or financial account information. We may store the subscription tier, purchase platform, renewal status, and expiration date associated with your account.

2.5 Waitlist and Marketing Data

If you sign up to our waitlist or marketing list on https://crewcafe.app, we collect your email address and (optionally) your name and role, so that we can send you product updates and launch information. You can unsubscribe at any time using the link in any email we send, or by emailing support@crewcafe.app.

2.6 Analytics

At the time of this Policy's effective date, the CrewCafé mobile app does not collect any product analytics. We plan to introduce privacy-respecting analytics through PostHog after launch. If and when we enable analytics, we will update this Privacy Policy, in-app disclosures, and the App Store and Google Play data-safety declarations, and we will request consent where required by applicable law (for example, in the EU/EEA and the UK).

3. How We Use Your Information

We process the categories of data described above for the following purposes and on the following legal bases (where the GDPR, UK GDPR, or POPIA apply):

• To provide the Service — including creating your account, authenticating you, syncing your production data, and delivering content you request. Legal basis: performance of a contract with you.
• To send transactional emails — such as verification, password resets, and important account or service notices, delivered via Resend. Legal basis: performance of a contract and our legitimate interests in operating the Service securely.
• To send push notifications you have enabled — such as call sheet reminders or production updates. Legal basis: your consent (you can withdraw it at any time by changing your device notification settings).
• To process subscriptions — including verifying entitlement and providing access to paid features through RevenueCat. Legal basis: performance of a contract.
• To secure the Service — including detecting and preventing fraud, abuse, and unauthorised access, and complying with our legal obligations. Legal basis: our legitimate interests and legal obligations.
• To communicate with you — including responding to support requests, sending product updates if you have opted in, and notifying you of material changes to the Service or to this Policy. Legal basis: your consent (for marketing) and our legitimate interests (for service messages).
• To improve the Service — including diagnosing crashes, fixing bugs, and developing new features. Legal basis: our legitimate interests.

We do not use your personal information for automated decision-making that has a legal or similarly significant effect on you. We do not sell or share your personal information for cross-context behavioural advertising as those terms are defined under the CCPA/CPRA.

4. Data Sharing and Third-Party Services

We share personal information only with service providers ("processors" / "operators") that help us deliver the Service. Each of these providers is bound by a written contract that restricts their use of your data to providing services to us. The current list of sub-processors is:

4.1 Supabase (Database and File Storage)

Website: supabase.com. Supabase hosts our PostgreSQL database and object storage. All user-content data (projects, call sheets, crew rosters, shoot days, scene breakdowns, uploaded files) is stored on Supabase infrastructure. Purpose: storage, retrieval, and backup of your production data.

4.2 Clerk (Authentication)

Website: clerk.com. Clerk manages user accounts, sign-in, password reset, and session tokens. Purpose: authenticating you to the Service and providing identity infrastructure. Data shared: email address, name, hashed credentials, and authentication metadata.

4.3 Resend (Transactional Email)

Website: resend.com. Resend delivers transactional emails on our behalf. Purpose: sending verification, password-reset, and service emails. Data shared: your email address and the contents of the message being sent.

4.4 Expo (Push Notifications and Mobile Infrastructure)

Website: expo.dev. Expo provides our mobile application framework and push notification routing through Apple Push Notification Service and Firebase Cloud Messaging. Purpose: building, updating, and notifying the mobile app. Data shared: device push tokens, app version, and limited delivery metadata.

4.5 RevenueCat (Subscription Management)

Website: revenuecat.com. RevenueCat manages subscription entitlements. Purpose: verifying that a user is entitled to paid features. Data shared: an anonymised app user identifier and subscription status from the relevant app store. RevenueCat does not receive your name, email, or content.

4.6 Apple App Store and Google Play (Payment Processing)

Subscriptions are processed by Apple Inc. (App Store) and Google LLC (Google Play). When you purchase a subscription, your financial information is handled entirely by Apple or Google under their respective privacy policies. We never receive your payment-card number, billing address, or financial account details.

4.7 Other Disclosures

We may also disclose personal information: (a) to comply with applicable law, legal process, or a binding government request; (b) to enforce our Terms of Service or protect the rights, property, or safety of CrewCafé, our users, or the public; or (c) in connection with a merger, acquisition, financing, or sale of assets, in which case we will require the recipient to honour this Privacy Policy or notify you of any material changes.

4.8 International Transfers

The service providers listed above may process your data in the United States or other countries. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK Addendum, and POPIA section 72 transfer mechanisms to provide adequate protection for your personal information when it leaves your country.

5. Data Retention

We retain personal information for as long as you keep your account active and for a limited period afterwards. Specifically:

• Account data and user content are retained for the lifetime of your account. When you delete your account, we delete or anonymise this data within 30 days, except where we are required to retain certain records for legal, tax, accounting, or fraud-prevention purposes.
• Subscription records are retained for at least seven (7) years to comply with South African tax and financial-record laws and similar obligations in other jurisdictions.
• Server logs and security records are retained for up to 90 days, then deleted or aggregated.
• Waitlist and marketing emails are retained until you unsubscribe or request deletion.

Backups containing your data are overwritten on a rolling basis, typically within 35 days of deletion.

6. Data Security

We take the security of your personal information seriously and implement appropriate technical and organisational measures to protect it. These include: encryption in transit using TLS 1.2 or higher; encryption at rest for stored data and backups; the use of industry-standard authentication infrastructure through Clerk; row-level security policies in our database that isolate each user's data; limited and audited employee access; and regular review of our service providers' security practices.

Despite these measures, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security, but we will notify you and the relevant supervisory authority of a personal data breach without undue delay where required by applicable law.

7. Your Rights

Depending on where you live, you have certain rights over your personal information. You can exercise any of the rights below by emailing support@crewcafe.app. We will respond within the time limits required by the applicable law (generally 30 days under the GDPR/UK GDPR, 45 days under the CCPA/CPRA, and a reasonable period under POPIA). We will not discriminate against you for exercising any of these rights.

7.1 GDPR Rights (EU/EEA and UK Users)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete personal data;
• Erase your personal data ("right to be forgotten");
• Restrict or object to our processing of your personal data;
• Data portability — receive your personal data in a structured, commonly used, machine-readable format;
• Withdraw consent at any time where processing is based on consent;
• Lodge a complaint with your local data protection authority (for example, the Irish Data Protection Commission, the UK Information Commissioner's Office, or your national supervisory authority).

7.2 CCPA/CPRA Rights (California Users)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, disclose, and (if applicable) sell or share about you;
• Delete personal information we have collected from you, subject to certain exceptions;
• Correct inaccurate personal information;
• Opt out of "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined under the CCPA/CPRA, so there is nothing to opt out of at this time;
• Limit the use of sensitive personal information. We do not use sensitive personal information for purposes that would trigger the right to limit;
• Non-discrimination for exercising your privacy rights.

You may also designate an authorised agent to make a request on your behalf; we may require verification of your identity and the agent's authority before honouring the request.

7.3 POPIA Rights (South African Users)

If you are a data subject in South Africa, the Protection of Personal Information Act, 2013, gives you the right to:

• Be notified that your personal information is being collected and processed;
• Request access to your personal information held by us;
• Request correction or deletion of inaccurate, irrelevant, excessive, out-of-date, misleading, or unlawfully obtained personal information;
• Object, on reasonable grounds, to the processing of your personal information;
• Withdraw consent at any time, subject to legal and contractual restrictions;
• Submit a complaint to the Information Regulator (South Africa) at inforeg@justice.gov.za or via https://inforegulator.org.za.

8. Children's Privacy

CrewCafé is intended for film and television production professionals. The Service is not directed to children under the age of 13, and we do not knowingly collect personal information from anyone under 13. In the European Economic Area, the minimum age is 16 unless your member state provides a lower age in accordance with Article 8 of the GDPR. If you become aware that a child has provided us with personal information, please contact us at support@crewcafe.app and we will delete it.

9. Push Notifications

If you enable push notifications, your device will provide us with a push notification token via Apple Push Notification Service or Firebase Cloud Messaging, routed through Expo's notification service. We use this token only to deliver notifications you have enabled (for example, reminders about your shoot day or updates to a call sheet). You can disable push notifications at any time from your device settings, and we will stop sending them.

10. In-App Purchases and Subscriptions

CrewCafé offers paid subscriptions sold and managed through the Apple App Store and the Google Play Store. When you subscribe, the relevant app store processes your payment and provides us, through RevenueCat, with limited information about your subscription status. We do not see or store your payment-card details. Subscriptions auto-renew at the price and interval disclosed at the point of purchase unless you cancel at least 24 hours before the end of the current period in your App Store or Google Play account settings. Please consult Apple's and Google's terms for further details on refunds and billing.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to the Service, to applicable law, or to our practices. When we make material changes, we will update the "Last Updated" date at the top of this Policy and, where required, give you notice by email or through the Service. We encourage you to review this Policy periodically.

12. Contact Us

If you have any questions or requests about this Privacy Policy or our handling of your personal information, please contact us at:

Ole Skool Kreativz
Email: support@crewcafe.app
Website: https://crewcafe.app

For requests relating to your rights under the GDPR, UK GDPR, CCPA/CPRA, or POPIA, please use the same email address and indicate which right you wish to exercise. We may need to verify your identity before responding.