CrewMag

CrewMag — Privacy Policy

Version: 1.3 Effective date: 10 November 2026 Document status: Beta release

What changed in version 1.3

  • We now count visits to the home page and new registrations by source, as anonymous daily totals on our own servers — no cookies, nothing stored on your device, not linked to your account (sections 7 and 10).

What changed in version 1.2

  • CV import now also works for Project Crew CVs and can copy your WINDA ID from your file (sections 2 and 6).

What changed in version 1.1

  • New feature: importing an existing CV from a Word or PDF file with the help of AI (section 6).
  • A complete list of the information a CV can contain, including date of birth, which was missing from version 1.0 (section 2).
  • Three service providers added: for AI processing in CV import, for email delivery and for error monitoring (section 7).
  • Certificate expiry reminder emails (section 4) and how long technical records are kept (section 8).

1. Who is responsible for your data

The controller of personal data processed through CrewMag is:

Arturs Stols, a natural person residing in Latvia, operating the Service as an individual (not as a registered company).

Contact for all data protection matters: support@crewmag.net

No Data Protection Officer has been appointed, as the Service does not meet the criteria requiring one under Article 37 GDPR.

2. What data we process

Account data

  • Email address (used for login and account-related communication)
  • Password, stored by our authentication provider in hashed form only

CV and profile data you enter or import. All CV fields are optional unless the editor marks them as required. Depending on the CV type, a CV can contain:

  • first name, last name, rank / position, date of birth, nationality, location;
  • contact details shown on the CV: email, phone number, WhatsApp number (used to generate a QR code), LinkedIn profile link;
  • visa information, languages, availability date;
  • professional summary and key highlights;
  • profile photograph;
  • sea service records (vessel name and type, company, rank, vessel particulars such as DWT, GRT or engine power, dates);
  • work history, education;
  • certificates and documents (see below);
  • for Project Crew CVs: project and contract experience, scope of work, equipment, technical competencies, WINDA ID, and driving licence details if you entered them while that field was available.

Certificates and documents. For each certificate or document record we store its name, issue date, expiry date (or that it does not expire) and place of issue. This includes records such as a passport or Seaman's Book. We do not ask for identity document numbers (such as passport or Seaman's Book numbers) or certificate numbers, and we do not store scanned copies of documents. The only exception is the WINDA ID in Project Crew CVs, which you can enter yourself or import from your file (section 6).

Special categories of data. Some certificates common in the maritime industry — such as a medical fitness certificate (for example ENG1 or OGUK) — may indirectly indicate that you have been assessed as fit for service. Where such a record constitutes data concerning health under Article 9 GDPR, we process it on the basis of your explicit consent (Article 9(2)(a)), given either by entering that certificate into your CV yourself, or by ticking the consent box before importing a CV file (section 6).

Entering or keeping a medical certificate is optional. You can withdraw this consent at any time by deleting the certificate record from your CV; the record is then removed. If you publish a CV containing such a certificate, that information becomes publicly visible along with the rest of the CV (see section 5).

We do not collect diagnoses, medical findings, treatment information, vaccination records or drug and alcohol test results, and no field in the Service asks for them. If a file you import lists vaccinations or drug and alcohol tests as certificates, they are not added to your CV (section 6). Other text from the file, such as a professional summary, is imported as written — please check it before saving.

Records created when you use the Service

  • which version of the Terms of Service and Privacy Policy you accepted, and when;
  • when you published or unpublished a CV, and its public link identifier;
  • account deletion requests (dates and the browser type the request was made from);
  • CV import records: when an import took place, the CV type and whether it succeeded — never the file, its text or the result (section 6);
  • your consent to AI processing before an import, and when it was last given;
  • your email preferences and which certificate expiry reminders were sent to you;
  • technical error reports (section 7).

Some technical data (such as IP addresses and connection logs) is processed automatically by our infrastructure providers as part of delivering the Service — see section 7.

  • Performance of a contract — Article 6(1)(b) GDPR. Creating an account, storing and editing your CVs, generating PDFs, publishing a CV at your request, importing a CV file at your request, sending account emails and certificate expiry reminders, and answering your requests are necessary to provide the Service you asked for.
  • Explicit consent — Article 9(2)(a) GDPR. Certificate records that may qualify as health data, and any health-related details contained in a file you choose to import (sections 2 and 6).
  • Legitimate interests — Article 6(1)(f) GDPR. Error monitoring and technical logs, to keep the Service stable and secure. You can object to this processing (section 9).
  • Legal obligation — Article 6(1)(c) GDPR. Keeping records of the documents you accepted and the consents you gave, so that we can demonstrate compliance (Articles 5(2) and 7(1) GDPR).

Apart from the special-category data described above, we do not rely on consent (Article 6(1)(a)) for the core functionality of the Service. This means the processing described in this Policy is not something you can withdraw consent for while continuing to use the Service — instead, you can stop using the Service and delete your account at any time (see section 8).

4. Why we process your data

  • To create and maintain your account and allow you to log in.
  • To store, display and let you edit your CV data.
  • To generate PDF documents from your CV data.
  • To publish a CV as a Public CV, where you have explicitly chosen to publish it.
  • To pre-fill the CV editor from a file you upload, at your request (section 6).
  • To email you a reminder when a certificate in your CV is about to expire (about 3 months, 30 days and 14 days before the expiry date). Every reminder contains a link to unsubscribe.
  • To send you service messages, such as account confirmation, password reset and notices about changes to our terms.
  • To detect and fix technical errors.
  • To respond to your support and data protection requests.

We do not use your data for advertising, profiling, automated decision-making, or to build any kind of behavioural profile. We do not sell or rent your data to anyone.

5. Publication of your CV (Public CV)

By default, everything you enter is private and visible only to you.

A CV is made public only by your own explicit action in the dashboard. When you publish a CV:

  • it becomes accessible to anyone holding the public link, without login;
  • the information visible to those viewers is the information contained in that CV, as you entered it;
  • the link may be shared onward, saved, or indexed by search engines outside our control.

You choose what to publish. Some fields, including date of birth, can be hidden with a show/hide switch in the editor. If you do not wish other information — such as your phone number, photograph, nationality or visa status — to be publicly visible, do not include it in a CV you intend to publish, or do not publish the CV at all.

You can unpublish a CV at any time. Unpublishing stops future public access but cannot recall copies already made by third parties, and cached versions may remain available briefly outside our control.

6. Importing an existing CV

You can pre-fill an empty CV from your existing CV file (PDF or Word .docx). This feature is optional: you can always fill in your CV by hand.

How it works

  1. Before choosing a file, you tick a box to confirm that you agree to the AI processing described here. Without this confirmation the import does not start.
  2. Our server reads the text of the file in memory. The file itself is not stored — not on our servers, not in our database and not in file storage.
  3. The text (up to 60,000 characters) is sent to Anthropic (section 7), which uses an AI model to structure it into CV fields and translate it into English where needed.
  4. Our server checks the result, removes data we do not keep (see below) and sends it to your browser. Fields that need your attention are marked "Check this".
  5. Nothing is saved until you review the form and press Save. If you leave the page without saving, the imported data is discarded.

What is sent. The full text of your file is sent, including anything it contains. Please do not import a file that contains information you do not want processed, such as medical details or other people's data.

What we do not keep. Identity document numbers and certificate numbers are not extracted. The only exception is a WINDA ID in Project Crew CVs: if your file contains it, it is copied exactly as written and marked "Check this". Vaccinations and drug and alcohol tests listed as certificates are not added to your CV; other text is imported as written, so check it before saving. We do not store or log the text of your file or the AI response. We keep only a record that an import took place (time, CV type, result) to apply the daily limit of 3 imports, and a record of your consent.

AI can make mistakes. Imported data may be incomplete or inaccurate. You are responsible for checking it before saving (Terms of Service §5).

No automated decisions. The AI only suggests values for a form you review and edit. It does not make any decision about you within the meaning of Article 22 GDPR.

Anthropic. Anthropic processes the text only as our processor, under its data processing addendum, which includes the EU Standard Contractual Clauses. Processing may take place in the United States. Anthropic deletes API inputs and outputs within 30 days; it may keep them longer only where required by law or where content is flagged for a violation of its usage policy. Anthropic does not use this data to train its models.

7. Who processes data on our behalf

We use the following service providers (processors). Where a provider is established in the United States or may access data from outside the EEA, the transfer is protected by the provider's data processing agreement and appropriate safeguards under Chapter V GDPR (EU Standard Contractual Clauses and, where the provider is certified, the EU-U.S. Data Privacy Framework).

Database, login and file storage — provider established in the USA. Data, including profile photographs, is stored in the EU (Sweden).

Website hosting — provider established in the USA. The application runs in the EU (Netherlands).

AI processing of the text of CV files you choose to import (section 6) — provider established in the USA. Processing may take place in the USA.

Email delivery (confirmation, password reset, certificate expiry reminders) — provider established in the USA. Processing takes place mainly in the USA.

Error monitoring — provider established in the USA. Data is stored in the EU (Germany). Error reports contain technical information only, such as the error message, page address, and browser and operating system type.

Email to support — messages to support@crewmag.net are forwarded to a mailbox hosted by a provider established in the USA.

PDF documents are generated by the Service's own infrastructure. No separate third-party PDF service receives your data.

We do not use third-party analytics services, advertising networks, or any other third-party tracking services. The visit and sign-up counters described in section 10 run on our own servers.

8. How long we keep your data and how it is deleted

We keep your account and CV data for as long as your account exists. There is no inactivity-based deletion. Specific records:

  • CV import records (time, CV type, result) — deleted after 30 days.
  • The file you import and its text — not stored at all; the AI provider deletes its copy within 30 days (section 6).
  • Records of accepted documents and given consents, publication history, email preferences and reminder history — kept while your account exists and deleted with it.
  • Error reports — kept by our error monitoring provider for a limited period under its standard retention, then deleted automatically.

You can request deletion of your account from within the Service at any time. When you do:

  • any published CV is immediately withdrawn from public access;
  • your account enters a restricted state for 30 days, during which you can still read your data and cancel the request;
  • after 30 days, your data is permanently erased.

Erasure covers your profile, all CVs and related records, your uploaded photograph in storage, the records listed above, and your authentication account. Data is not retained in anonymised form — it is removed.

If you cancel the deletion request within the 30-day period, normal access is restored. Previously published CVs remain unpublished until you publish them again.

9. Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you (Article 15);
  • rectify inaccurate data (Article 16) — most data can be corrected directly in the CV editor;
  • erase your data (Article 17) — see section 8;
  • restrict processing (Article 18);
  • data portability — receive your data in a structured, commonly used, machine-readable format (Article 20);
  • object to processing based on legitimate interests (Article 21);
  • withdraw consent at any time (Article 7(3)) — for a medical certificate, by deleting it from your CV. Consent to AI processing is given separately for each import; if you do not tick the box, no file is sent. Withdrawal does not affect processing that already took place.

How to exercise these rights: send a request to support@crewmag.net from the email address associated with your account.

The Service does not currently include an automated data export function. Access and portability requests are fulfilled manually: we will extract your data and provide it to you in a machine-readable format. We will respond within one month of receiving your request, as required by Article 12(3) GDPR. If a request is complex, this period may be extended, and we will inform you if that happens.

Right to complain. If you believe your data has been handled unlawfully, you may lodge a complaint with the Latvian supervisory authority, the Data State Inspectorate (Datu valsts inspekcija), or with the supervisory authority in your country of residence within the EU.

10. Cookies and browser storage

CrewMag uses only what is strictly necessary to keep you logged in: a session cookie set by CrewMag and browser storage used by our authentication provider.

Visit and sign-up counters. We count visits to the home page and new registrations by source: the tag in the link you followed (for example, utm_source), the domain of the website that sent you, and your optional answer to "How did you hear about CrewMag?" on the registration form. We keep only daily totals. The counters run on our servers: they use no cookies, store or read nothing on your device, do not store your IP address or your browser's identification string (User-Agent), and are not linked to your account. When you register, the ID of your new account is used only to check that the registration is genuine; it is not stored.

We do not use analytics cookies, advertising cookies, or any other technology that stores or reads information on your device beyond what is strictly necessary. Because only strictly necessary technologies are used, no cookie consent banner is required.

If we introduce a technology that stores or reads information on your device beyond what is strictly necessary, this Policy will be updated to a new version and a consent mechanism will be implemented before that technology is activated.

11. Children

The Service is not intended for persons under 18 years of age. Date of birth is an optional CV field: it is shown on your CV only if you enter it and do not hide it, and we do not use it to verify your age.

If you believe a minor has registered an account, contact support@crewmag.net and the account will be reviewed and removed.

12. Security

Access to your data is restricted so that each user can only read and modify their own records, enforced at database level. Data in transit is encrypted. Uploaded images are validated before storage. Files you import are processed in memory and not stored, and their content is not written to logs.

No system can be guaranteed fully secure. We do not claim that a breach is impossible. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the supervisory authority and, where required, affected users, in accordance with Articles 33 and 34 GDPR.

13. Changes to this Policy

This Policy is versioned. Each version carries a version number and an effective date.

If we change how data is processed — for example, by adding a new processor or introducing analytics — we will publish a new version before the change takes effect and notify registered users of material changes by email or through the Service. Such notices are service messages and are sent regardless of your email preferences.

14. Contact

Data protection questions and requests: support@crewmag.net

CrewMag Privacy Policy, Version 1.3.