Privacy Policy

1. Scope and roles

This Policy covers CrowdSafeData websites, accounts, subscriptions and support. For account, billing, security and website information, CrowdSafe generally acts as a business or controller. For event or venue data uploaded by a customer, CrowdSafe generally acts as a service provider or processor under the customer’s instructions.

2. Information we collect

• Account identity, including sign-in email and optional display name supplied through the authentication service.
• Organization, membership, role, subscription, billing-status and invitation records.
• Authorized event, access, crowd, location, concession and operational data uploaded by customers.
• Mappings, findings, importance settings, reports, source fingerprints and audit activity.
• Support communications, service diagnostics, security events and basic request metadata.

3. How we use information

We use information to provide and secure the service; isolate organizations; process authorized analytical instructions; manage subscriptions and support; maintain audit and recovery records; detect abuse; improve reliability; and comply with law. We do not sell personal information or use customer event data for cross-context behavioral advertising.

4. Legal bases

Where applicable, processing is based on performance of a contract, legitimate interests in providing and securing a professional service, compliance with law, consent where requested, and the customer’s documented instructions for customer-controlled data.

5. Sharing and subprocessors

Information may be processed by infrastructure, authentication, storage, security, billing and support providers necessary to operate CrowdSafeData; professional advisers bound by confidentiality; and authorities where legally required. Current core providers include OpenAI Sites for site delivery and authentication, Cloudflare services for hosted runtime and protected storage, and PayPal or Stripe only when the applicable billing method is activated. Customer data is not disclosed to unrelated advertisers.

6. International transfers

CrowdSafeData is operated from the United States and may process information in other locations used by service providers. Where required, the parties may use approved transfer mechanisms, including the European Commission’s Standard Contractual Clauses, together with appropriate supplementary measures.

7. Retention and deletion

Data is kept only for operational, contractual, security and legal purposes under the published Retention Policy and organization settings. Customers should export needed results before deletion or termination. Backups expire on a separate controlled schedule.

8. Security

Controls include authenticated access, organization scoping, role checks, protected object storage, server-side source fingerprints, audit events, security headers, bounded uploads and recovery snapshots. Customers should not upload unnecessary direct identifiers and must promptly report suspected unauthorized access.

9. Privacy choices and rights

Depending on location, individuals may request access, correction, deletion, portability, restriction or objection, and may appeal or complain to a regulator. CrowdSafe does not sell or share personal information for targeted advertising. Account users can submit a privacy request through Support; DPA and Standard Contractual Clause requests use the same documented request path. Requests about customer-uploaded event data should normally be directed to the customer controlling that data. We verify only the information reasonably necessary to process a request.

10. Children and changes

The service is intended for organizations and professional users, not children. We do not knowingly collect children’s personal information through public registration. We may update this Policy prospectively and will identify the effective date and material changes.