Legal hub
Legal hub
CREWPORT LLC ("CREWPORT," "we," "our," or "us") is committed to protecting the personal data of our clients and website visitors. This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, and what rights you have.
This policy applies to personal data collected through crewport.io, our distribution platform ("Platform"), our Platform Ticketing System, and all related services we provide.
CREWPORT LLC is a California limited liability company and the data controller for personal data processed under this Privacy Policy.
| Company | CREWPORT LLC |
| Address | 2108 N ST STE N, Sacramento, CA 95816, United States |
| support@crewport.io |
| Category | Examples | When collected |
|---|---|---|
| Account & identity | Email address, password, account type (individual/label), country, display name | Registration |
| Profile | Display name, avatar image, artist/roster names, alternate credit names, artist bio, genre, social and DSP links | Optional, during account and roster setup |
| Label & team | Label name, label logo, invited team members' names and email addresses, assigned roles | Label and team setup |
| Application data | Email, legal/full name, artist name, desired label name, country, role, music links, bio, genres, goals | Club / membership application |
| Release & catalog content | Audio files, cover art, release and track titles, lyrics, performer and contributor credits (which may include real names), publisher and copyright lines, ISRC/UPC where you provide them | Release submission |
| Public page content | Artist Pulse / Lens page content: artist name, description, optional public contact email, images, links | When you build a public page |
| Communications | Support tickets, messages, uploaded attachments, feedback | When you contact us |
| Promotional contacts | If you use our promo tools: recipient email, name, role, genres, notes you enter about your contacts | When you build a promo list |
| Early access | Email, role, founder-pricing interest, optional survey answers | Early-access signup |
Features in development. Identity verification (KYC), tax documentation (such as W-9 / W-8BEN forms and tax identification numbers), and payment, billing, and payout details are described in this policy because they are planned features. They are not yet active and we do not currently collect this information. When these features launch, we will update this policy and notify users before activating them, and the related data categories and sub-processors described below will apply from that point.
| Purpose | Data used | Legal basis |
|---|---|---|
| Provide and operate the Services | Account data, content, usage data | Performance of contract |
| Identity verification and fraud prevention | Identity documents, date of birth, address, IP address | Legal compliance (OFAC sanctions screening, IRS reporting), fraud prevention, contractual necessity, and legitimate business interests |
| Tax reporting and withholding | Tax forms (W-9/W-8BEN), SSN/EIN | Legal obligation (IRS/FATCA) |
| Process payments and remit royalties | Payment data, payout info, royalty statements | Performance of contract |
| Sanctions and prohibited party screening | Name, country, date of birth | Legal compliance, including sanctions screening where applicable; fraud prevention; and legitimate business interests |
| Customer and account support | Account data, communications history | Performance of contract; legitimate interests |
| Platform improvement and analytics | Usage data, pseudonymized first-party analytics data | Legitimate interests |
| Security and fraud detection | Log data, IP address, device info | Legitimate interests |
| Legal compliance and record-keeping | All categories as required | Legal obligation |
| Service and marketing communications | Email address, name | Legitimate interests (opt-out available) |
We do not sell, rent, or trade your personal data.
We share personal data with third-party service providers who process data on our behalf under data processing agreements, and who may only use data for the specified purpose.
| Sub-processor | Purpose | Data shared |
|---|---|---|
| Supabase | Database, authentication, and storage of platform data | Account data, catalog and metadata, support content, analytics, activity logs |
| Cloudflare R2 | Object storage for uploaded media | Audio masters, cover art, images, ticket attachments, promo assets |
| Cloudflare Turnstile | Bot protection on public and application forms | Visitor IP address and browser signals, sent to Cloudflare for verification |
| Vercel | Application hosting and edge delivery | Request/log data; IP-derived approximate location (country/region) |
| Resend | Transactional and promotional email (main app) | Email address, recipient name |
| Namecheap Private Email (SMTP) | Transactional email (admin and membership approvals) | Email address, recipient name |
| Replicate | Optional AI-assisted cover-art generation | The text prompt you provide and the generated image |
| Sundesire Media | Distribution and delivery of releases to digital stores | Release metadata, audio files, cover art, artist and label names |
| Odesli (song.link) | Resolving store links across platforms | Public release and track URLs |
| Spotify | Catalog search, metadata, and fan pre-save functionality | Public release URLs and metadata; encrypted pre-save authorization tokens where a fan opts in |
Planned sub-processors (not yet active). When the features described in Section 2.1 launch, we expect to use additional sub-processors for payment and payout processing, identity verification (KYC), and sanctions screening. We will identify them and update this policy before those features go live. A current list of active sub-processors is available on request. We do not sell, rent, or trade your personal data.
Note on AI features. Our optional AI cover-art tool sends the text prompt you enter to a third-party AI provider (Replicate) to generate an image. Please do not enter personal, confidential, or sensitive information into AI prompt fields.
We transmit release metadata — including artist names, label names, and release information — to DSPs as part of the distribution process. DSPs receive only what is necessary for distribution and royalty reporting. Identity documents, tax data, and financial details are never shared with DSPs.
We may disclose your information if required by law, court order, subpoena, or other legal process, or where we reasonably believe disclosure is necessary to protect the rights, property, or safety of CREWPORT, our users, or the public.
If CREWPORT is involved in a merger, acquisition, asset sale, or similar transaction, your personal data may be transferred as part of that transaction. We will notify affected users before their data is transferred and becomes subject to a different privacy policy.
| Data category | Retention period | Reason |
|---|---|---|
| Identity documents | Account duration + 5 years post-termination | Sanctions screening, tax compliance, fraud prevention, contractual necessity, and audit requirements |
| Tax forms (W-9 / W-8BEN) | Minimum 7 years from date of filing | IRS record-keeping requirement |
| Royalty statements and payout records | Minimum 7 years | IRS reporting; financial audit trail |
| Account data (name, email, profile) | Account duration + 3 years after termination | Contract; legitimate interests; dispute resolution |
| Communications and support records | Account duration + 2 years after termination | Dispute resolution; compliance |
| Usage and log data | Rolling 2 years | Security monitoring; platform improvement |
| First-party analytics events | Up to 13 months | Aggregate engagement insight; data minimization |
| Payment records | Per payment processor retention policy (typically 7 years) | PCI DSS compliance |
After the applicable retention period, personal data is securely deleted or irreversibly anonymized.
| Right | Description | How to exercise |
|---|---|---|
| Access | Request a copy of the personal data we hold about you | Email support@crewport.io |
| Correction | Request correction of inaccurate or incomplete data | Account settings or email us |
| Deletion | Request deletion of your data, subject to legal retention obligations | Email support@crewport.io |
| Opt-out of marketing | Unsubscribe from non-essential communications at any time | Unsubscribe link in any email, or email us |
If you are located in the European Union, European Economic Area, or United Kingdom, applicable data protection law (including GDPR and UK GDPR) may grant you additional rights: data portability; restriction of processing; the right to object to processing based on legitimate interests; and the right to lodge a complaint with your local data protection supervisory authority. To exercise these rights, contact us at support@crewport.io.
California residents have the right to know what personal information is collected and shared; request deletion of personal information (subject to exceptions); correct inaccurate personal information; and opt out of the sale or sharing of personal information. CREWPORT does not sell personal information. CREWPORT does not share personal information for cross-context behavioral advertising. To submit a request, email support@crewport.io with subject line "CCPA Request."
If applicable law in your country grants you additional privacy rights, contact us at support@crewport.io and we will respond in accordance with our legal obligations.
If CREWPORT begins using advertising or retargeting technologies that constitute "sharing" under California law, CREWPORT will update this policy and provide a "Do Not Sell or Share My Personal Information" mechanism where required.
We will respond to verified requests within 30 days. We may need to verify your identity before processing a request.
CREWPORT collects certain categories of sensitive personal information as defined under applicable privacy law, including government-issued identification documents, tax identification numbers (SSN, EIN, ITIN), financial account details, and fraud and sanctions screening signals.
CREWPORT uses sensitive personal information only for the following purposes: identity verification, tax documentation and compliance, sanctions screening, fraud prevention, payment processing, account security, and legal compliance. CREWPORT does not use sensitive personal information to infer characteristics about users unrelated to these purposes, and does not sell or share sensitive personal information.
We implement appropriate technical and organizational security measures to protect your personal data, including:
No system is completely secure. If you suspect unauthorized access to your account, contact us immediately at support@crewport.io.
| Cookie type | Purpose | Can be declined? |
|---|---|---|
| Strictly necessary | Session management, authentication, security. Required for the platform to function. | No |
| Functional | Remembering your preferences (language, display settings). | Yes |
| First-party analytics | Privacy-friendly, first-party usage analytics (page views, interactions). We do not use third-party tracking cookies, and your raw IP address is not stored — a short-lived, daily-rotating pseudonymous identifier is used instead. | Processed under legitimate interest |
| Marketing | Retargeting and advertising. | Not currently used |
We do not currently use third-party advertising or tracking cookies. You can manage cookies through your browser settings. Disabling strictly necessary cookies will prevent the platform from functioning. If we begin using analytics or advertising technologies that require consent, we will provide a consent mechanism and update this policy.
CREWPORT is based in the United States and processes data there. If you are located outside the United States, your personal data will be transferred to and processed in the United States. Where required by applicable law — including for transfers from the EU/EEA — we rely on appropriate transfer mechanisms such as Standard Contractual Clauses (SCCs). A copy of applicable SCCs is available on request.
Our Services are available only to individuals aged 18 and older. We do not knowingly collect personal data from anyone under 18. If we become aware that we have done so, we will delete it promptly. If you believe we have collected data from an individual under 18, contact us at support@crewport.io.
You may request deletion of your CREWPORT account at any time by contacting us at support@crewport.io. Account deletion will result in removal of your profile, active releases, and personal data, subject to the retention obligations described in Section 5. Outstanding royalty balances will be processed before account closure. Releases already distributed to DSPs will be taken down in accordance with your Music Distribution Agreement.
We may update this Privacy Policy from time to time. When we make material changes, we will notify affected users by email and by posting a notice on the Platform at least 30 days before the changes take effect. Continued use of the Services after the effective date of an updated policy constitutes acceptance.
For questions, requests, or concerns about this Privacy Policy or your personal data: