PLACES helps you find somewhere good to work. This policy explains how CR3W LTD (“we”, “us”) collects, uses and protects your personal data when you use the PLACES app or places.cr3w.app. It is written to comply with the UK General Data Protection Regulation (UK GDPR), the EU GDPR and applicable US state privacy laws.
Data controller: CR3W LTD, London. For any data enquiry, email legal@cr3w.app.
1. What we collect
- Account information. When you join with Sign in with Apple: your name and email address. If you choose Apple’s Hide My Email, we only ever see the private relay address Apple creates for you.
- Your PLACES activity. Places you save, places you suggest, preferences you set, and confirmations you contribute about venues.
- Location. Only when you explicitly allow it, only while you use the app, and used solely to show places near you and estimate walking times. We do not store your location history. Your position is used on the device and in the moment, then discarded.
- Usage events. Which venues are viewed, saved or navigated to, recorded against a random per-device identifier that is not derived from anything about you. We use this to understand what works and to show venues honest engagement figures. No advertising identifiers, no cross-app tracking, no data brokers.
- Photos you contribute. If you add a photo of a venue, we store the image itself, the place it belongs to, the date, and the fact that you confirmed you took it and have the right to share it. Photos are reviewed by a person before anyone else can see them.
- Subscriptions. If you subscribe to PLACES Pro, payment is handled entirely by Apple. We never see your card details; we record only that a subscription exists and its status.
2. Lawful basis
- Contract — operating your account, saves and preferences.
- Consent — location access and marketing email. Both are off until you turn them on, and both can be withdrawn at any time.
- Legitimate interest — first-party usage analytics, security and fraud prevention.
- Legal obligation — retaining transaction records for accounting.
3. Marketing
Creating an account is not marketing consent. We only send you updates about new places or recommendations if you separately opt in, and every consent is recorded with when and where it was given. PLACES and CR3W communications are separate: joining PLACES never subscribes you to CR3W emails, or the reverse. Unsubscribe links are in every marketing email.
4. Where your data lives and who processes it
- Supabase — our database and authentication (hosted in the EU, Stockholm region).
- Apple — Sign in with Apple and, if you subscribe, payments.
- Resend — email delivery.
- Vercel — hosting for places.cr3w.app.
We do not sell your personal data, and we do not share it with advertisers.
5. Photos and other things you contribute
- You keep ownership. Adding a photo gives PLACES permission to store, resize and show it alongside that venue. It does not transfer the copyright, and you can ask us to take it down at any time.
- A person reviews every photo before it appears. Nothing you upload is public until it has been checked.
- Credit. If you have set a display name, published photos are credited to that name. If you have not, they are credited to “a PLACES member”. Your email address is never shown.
- If a photo is not used, the image file is deleted and only the record of the decision is kept.
- If you delete your account, photos still awaiting review are deleted outright. Photos already published stay on the venue but lose all connection to you: your name and account are removed, and the credit reverts to “a PLACES member”. If you would rather a published photo were removed entirely, email us and we will take it down.
- Please do not photograph identifiable people without their agreement. We ask this in the app, and we will take down a photo reported to us for this reason while we look at it.
6. Your identity across CR3W products
PLACES is a CR3W product and uses one shared sign-in system. Having a PLACES account does not create a CR3W Network profile, does not make you visible on the CR3W network, and does not share your PLACES activity with it.
7. Your rights
You can access, correct, export or erase your data, object to processing, and withdraw any consent. You can delete your account directly in the app (Profile → Delete account): this erases your PLACES data immediately. If you also hold a CR3W Network account, deleting PLACES removes your PLACES data while leaving your CR3W membership intact. For anything else, email legal@cr3w.app — we respond within one month. You may also complain to the ICO (ico.org.uk) or your local supervisory authority.
8. Retention
Account data is kept while your account exists and erased on deletion. Venue engagement counts survive deletion only in anonymised form, detached from any identity. Transaction records are retained as required by accounting law.
9. Children
PLACES is not directed at children under 13 and we do not knowingly collect their data.
10. Changes
If this policy changes materially we will tell you in the app before the change takes effect.