Data Policy
This Data Policy explains in detail how CrewPlanet collects, uses, stores, and protects your information when you use the CrewPlanet mobile app and the crewplanet.app website (together, the "Service"). It supplements our Privacy Policy with specific technical detail about our data practices.
Who we are
CrewPlanet is a trade name of Knowhayo, a sole proprietorship (eenmanszaak) established in the Netherlands, with its registered address at Trompstraat 14, 1271 TA Huizen, the Netherlands (KvK 72418893). Knowhayo, trading as CrewPlanet, is the data controller for personal data processed through the Service. For any data-related question or to exercise your rights, contact us at info@crewplanet.app.
1. Data we collect
1.1 Information you provide directly
- Account information — email, name, username, and profile photo, used for account creation and management.
- Content — tips, events, messages, and photos, used to share within the community.
- Location data — GPS coordinates, city, and country, used for location-based features and recommendations (precise location only with your permission).
- Preferences — language, notification settings, and interests, used for personalisation.
1.2 Information collected automatically
- Device information — device model, OS version, and app version, used for app optimisation and compatibility.
- Usage data — features used, time spent, and interaction patterns, used to improve the user experience.
- Network data — IP address and connection type, used for security and performance.
- Crash reports — error logs and device state at the time of a crash, used for bug fixing and stability.
2. How we process your data
2.1 Legal basis (GDPR)
We process your data on the following bases:
- Consent — for optional features such as precise location sharing and analytics. You can withdraw consent at any time.
- Performance of a contract — to provide the Service you have signed up for and manage your account.
- Legitimate interests — for security, fraud prevention, and improving the Service.
- Legal obligation — when we are required by law to process certain data.
2.2 Data processing activities
- Real-time processing — messages, notifications, and content moderation.
- Batch processing — analytics, recommendations, and trending content.
- Machine learning — content categorisation and spam detection.
- Manual review — reported content, appeals, and verification.
3. Data storage and security
3.1 Where we store data
- Primary storage — Google Cloud Platform (Firebase).
- Regions — data is stored in secure data centres.
- Backups — automated daily backups with a short retention window.
- CDN — static content is cached for performance.
3.2 Security measures
We apply layered technical and organisational safeguards:
- Network — TLS/SSL encryption, DDoS protection, and firewall rules.
- Application — authentication tokens, session management, and input validation.
- Data — encryption at rest, encrypted backups, and access controls.
- Monitoring — security logs, anomaly detection, and incident response.
No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
4. Data sharing and third parties
4.1 Processors and partners we use
- Other users — your profile, tips, deals, events, and similar content are visible to other users of the Service.
- Google Firebase — backend infrastructure (authentication, database, storage, hosting); handles app data. See the Firebase privacy policy.
- Google Maps — location services; receives location queries.
- Google Sign-In — authentication; receives email and basic profile information.
- Google Analytics 4 — website usage analytics; receives anonymised usage data. See the Google privacy policy.
- Apple — Sign in with Apple, where you choose it, under Apple's privacy policy.
4.2 Data sharing principles
- We never sell your personal data.
- Third parties must adhere to our privacy standards.
- We use data processing agreements with our providers.
- We minimise the data shared to what is necessary.
5. Data retention
We keep your data only as long as needed for the purposes described here. Typical retention periods:
- Active account data — for the duration of your account, then deleted or anonymised shortly after closure (subject to legal retention requirements).
- Deleted content — briefly retained as a soft delete, then permanently removed.
- Messages — kept until deleted by you.
- Analytics data — retained according to our configured Google Analytics period (by default up to 14 months), then purged automatically.
- Security and server logs — kept for a short period for security and diagnostics, then rotated automatically.
6. Your data rights and controls
6.1 Access and portability
- View your data — access your data from your account settings.
- Download your data — request an export of your personal data.
- Portability — receive your data in a structured, commonly used format.
6.2 Control and deletion
- Edit — modify any content you have created.
- Delete — remove individual items, or delete your entire account at any time from the app's profile settings or via the delete account page.
- Restrict — limit processing for specific purposes.
- Object — opt out of certain data uses, and withdraw consent where processing is based on it.
To exercise any of these rights, email info@crewplanet.app. You also have the right to lodge a complaint with your local data protection authority — in the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
7. Data protection for minors
- CrewPlanet is intended for aviation professionals and is not directed at children under 16.
- We do not knowingly collect personal data from children under 16.
- If you believe a child has provided us with personal data, please contact us and we will delete it.
8. International data transfers
Your data may be transferred and processed outside the European Economic Area. Where it is, we ensure protection through:
- EU Standard Contractual Clauses with our providers.
- Adequacy decisions where applicable.
- Technical safeguards regardless of location.
- Compliance with applicable data protection laws.
9. Cookies and tracking
The crewplanet.app website has no sign-up or login. We do not set analytics cookies until you accept them via the cookie banner. The cookies we may use:
- Essential — authentication and security; last for the session.
- Functional — preferences and settings; last up to around a year.
- Analytics — anonymous usage patterns via Google Analytics 4; subject to our configured retention period.
For details of each cookie and how to change your choice, see our Cookie Policy.
10. Data breach response
In the event of a data breach affecting your personal data, we will:
- Notify affected users without undue delay, and the supervisory authority within 72 hours where required.
- Provide information about the data involved.
- Explain the steps taken to address the breach.
- Offer recommendations for protective action you can take.
- Make any further regulatory notifications as required.
11. Contact
For any data-related inquiry, contact us at info@crewplanet.app, or Knowhayo (CrewPlanet), Trompstraat 14, 1271 TA Huizen, the Netherlands.
12. Updates to this policy
We may update this policy from time to time. The "last updated" date above reflects the latest version. We will communicate significant changes through the Service, for example through in-app notifications or a prominent notice.