Last updated: October 2026
Aventaryk Pty Ltd (ABN 86 628 196 921) ("we", "us", "our") is committed to protecting the privacy of your personal information. This Privacy Policy explains how we collect, use, store, and disclose personal information in accordance with:
By using the Service, you acknowledge the collection, use, and disclosure of personal information as described in this Privacy Policy. You also acknowledge that certain service metadata — including transactional email content — may be disclosed to overseas recipients (including in the United States) as described in Section 11.
We collect, use, and disclose personal information where reasonably necessary for our functions and activities, to provide the Service, comply with legal obligations, and otherwise as permitted by applicable law.
This Privacy Policy applies to all Organisations you create or manage within the Service, regardless of the country or jurisdiction in which each Organisation operates (including Australia, Canada, New Zealand, and the United Kingdom). Each Organisation's data is stored in the region described in Section 4.1. Where an Organisation operates in a jurisdiction with its own privacy legislation, the Organisation remains responsible for ensuring its collection and use of personal information complies with applicable local privacy laws. We will handle data for all Organisations in accordance with this Privacy Policy and, where required, take reasonable steps to support compliance with applicable local privacy legislation.
UK organisations may request a Data Processing Agreement (DPA) under Article 28 UK GDPR by contacting privacy@crewnly.com.
Applicable frameworks: AU — APP 3.3 | GB — UK GDPR Art. 9
The Service may store limited sensitive information, specifically:
We only collect sensitive information where you have provided it by entering it into the Service on behalf of your workers, or where collection is required or authorised by law. The Organisation remains responsible for obtaining appropriate consent from workers before entering compliance or background-check documents into the Service. We apply additional safeguards to sensitive information, including encryption at rest and in transit, strict access controls, and audit logging of relevant access and security events.
For UK organisations: GPS location data collected during worker clock-in/out is processed on the basis of Art. 6(1)(b) (performance of the employment contract between the worker and the Organisation) and Art. 6(1)(f) (legitimate interests in site attendance verification). Crewnly does not perform continuous location tracking — coordinates are captured only at the point of clock-in or clock-out. The Organisation is responsible for ensuring workers are informed of location data collection as required by the ICO's guidance on employee monitoring.
When you create an account, we collect: full name, email address, phone number (optional), organisation name, country or region, and password (stored in hashed form — we cannot see your password).
When you use the Service, you may enter data about your organisation, including:
Important: The Organisation remains responsible for determining the purposes and lawful basis for the collection and use of worker and client information. Crewnly acts as a service provider and processes personal information only to provide the Service and in accordance with the Organisation's instructions.
We may receive personal information from Organisations, administrators, or other authorised users of the Service (for example, when an owner invites a worker or imports records via CSV).
When you sign up, we record which page, campaign or website brought you to Crewnly, and keep it with your organisation record to understand which channels work. That is: the campaign tags on the link you used (the “utm” values), the address of the website that sent you (the site only, never the page you were on there), the first Crewnly page you visited, and whether you arrived by clicking a Google Ads advertisement. For an advertisement we record only that you did, never the click identifier itself. No cookies are used for this and nothing is stored on your device for it: the details travel in the web address of the links you click, from one page of our website to the next and on to the Crewnly app, so you can see them in your browser’s address bar, and they are not kept in your browser once you leave. Our lawful basis is our legitimate interest in knowing which of our marketing channels work (UK GDPR Art. 6(1)(f)). It is kept for the life of the account, is seen only by Crewnly’s own team and is not shared with anyone else.
We use your information to:
We do not use your information to:
All customer data is currently stored in AWS Sydney (ap-southeast-2), Australia. This applies to all countries we operate in, including Canada, New Zealand, the United Kingdom, and the United States. We do not yet operate regional infrastructure outside Australia, though we plan to provision infrastructure in additional AWS regions as our international customer base grows. We take reasonable technical and organisational steps to protect data stored in this region.
For New Zealand organisations: your data is stored in Australia by an Australian entity. We handle New Zealand personal information in accordance with the New Zealand Privacy Act 2020 and the Australian Privacy Act 1988. We consider Australia to provide comparable privacy protections for the purposes of Information Privacy Principle 12 of the NZ Privacy Act 2020.
For Canadian organisations: your data is stored in Australia by an Australian entity. We handle Canadian personal information in accordance with PIPEDA. All data is encrypted at rest (AES-256) and in transit (TLS 1.2+). We use contractual safeguards with our hosting provider (Amazon Web Services) to ensure Canadian personal information receives a comparable level of protection as required by PIPEDA Principle 7. Details are available on request by contacting privacy@crewnly.com.
For UK organisations: Australia does not hold a UK adequacy decision under UK GDPR Article 45. We transfer UK personal data to Australia on the basis of the UK International Data Transfer Agreement (UK IDTA) or equivalent Standard Contractual Clauses (SCCs) as approved by the ICO, which provide appropriate safeguards for the transfer. We will make a copy of the applicable transfer mechanism available on request — contact privacy@crewnly.com. We also offer a Data Processing Agreement (Art. 28 UK GDPR) on request.
For United States organisations: your data is stored in Australia by an Australian entity. We take reasonable technical and organisational measures, including encryption at rest (AES-256) and in transit (TLS 1.2+), to protect personal information in accordance with applicable US state privacy laws (such as the California Consumer Privacy Act, where applicable to your organisation). Details on our data handling practices are available on request by contacting privacy@crewnly.com.
While we implement reasonable security safeguards, no method of electronic transmission or storage is completely secure and we cannot guarantee absolute security.
We retain your data for the following periods:
| Data Type | Retention Period | Reason |
|---|---|---|
| Timesheets & payroll data (AU) | Up to 7 years | ATO requirements; Fair Work Act |
| Worker & payroll records (CA) | Up to 3 years (or longer where required by provincial law) | Provincial employment standards legislation; federal payroll record requirements |
| Worker & payroll records (NZ) | Up to 7 years | Holidays Act 2003 wage and time record requirements |
| Worker & payroll records (GB) | Up to 3 years after the end of the tax year they relate to | HMRC PAYE record-keeping requirements |
| Audit logs (other than the security audit trail below) | Up to 7 years (or longer where required by law) | Regulatory audit compliance |
| Security audit trail (sign-ins, password changes, two-factor and session events, with IP address and browser type) | 730 days, then deleted | Account security and investigating unauthorised access |
| Account information | Duration of account + 30 days | Service provision |
| Notification history | 90 days | Operational reference |
After your subscription ends, your data remains in read-only mode for 30 days to allow you to export your records. After the read-only period, your account is suspended. Following account closure, we may retain archived records for the applicable period set out above where required to support legal, regulatory, audit, security, or record-keeping obligations. The Organisation remains responsible for maintaining its own copies of records required under applicable legislation. We strongly recommend exporting all data before or during the 30-day read-only period.
The security audit trail records sign-ins, password changes, two-factor and session events, together with the IP address and browser type they came from. It is kept for 730 days and then deleted. When an account is deleted, the user id and IP address on its audit records are anonymised, so the records can no longer be tied to you.
We use the following third-party services to operate Crewnly:
| Service | Purpose | Data Shared |
|---|---|---|
| Amazon Web Services (AWS) | Infrastructure & hosting | Customer and operational data stored within the Service (encrypted, within our AWS region) |
| Stripe | Payment processing | Billing email, payment method (we never see full card numbers) |
| Resend | Transactional email | Recipient email address, sender address, email subject and body content. Processed in the United States. |
| OpenAI | AI-assisted quote generation (optional feature) | Quote details you choose to submit through that feature. Not used to train OpenAI's models under our commercial terms. |
| Google Places API | Address autocomplete | Address text entered while typing into address fields |
We do not share your organisation's worker or client data with any third party for any purpose other than providing the Service.
We may engage carefully selected subprocessors and service providers to support the Service. A current list of subprocessors is available on request by contacting privacy@crewnly.com.
We may disclose personal information where required by law, court order, warrant, regulator request, or lawful request from a government authority. Where legally permitted, we will notify the affected Organisation before making such a disclosure.
Under the Australian Privacy Principles, you have the right to:
To exercise any of these rights, contact privacy@crewnly.com. We will respond within 30 days.
If your Organisation is based in the United Kingdom, you have additional rights under the UK GDPR and Data Protection Act 2018, including the right of access, rectification, erasure (subject to legal retention requirements), data portability, restriction of processing, and objection. To exercise these rights, contact privacy@crewnly.com. We will respond within one month as required by Article 12 UK GDPR. If you are not satisfied with our response, you may lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
If your Organisation is based in New Zealand, you have rights under the New Zealand Privacy Act 2020, including access (IPP 6) and correction (IPP 7). You may lodge a complaint with the New Zealand Office of the Privacy Commissioner at www.privacy.org.nz. To exercise these rights, contact privacy@crewnly.com. We will respond within 20 working days as required by the NZ Privacy Act 2020.
If your Organisation is based in Canada, you have rights under PIPEDA, including access, correction, and withdrawal of consent (subject to legal or contractual restrictions). You may lodge a complaint with the Office of the Privacy Commissioner of Canada at www.priv.gc.ca. To exercise these rights, contact privacy@crewnly.com. We will respond within 30 days as required by PIPEDA.
Where we process personal information on behalf of an Organisation, requests relating to worker or client records should generally be directed to that Organisation in the first instance.
We use minimal cookies and browser storage required for the Service to function, plus analytics and advertising-measurement cookies where you have given consent via our cookie banner ("Accept All"). The advertising-measurement cookie is set by Google Ads so we can tell which ad led to a sign-up; it is not used to personalise advertising or to build advertising profiles, and ad personalisation is switched off. Until you accept, the Google tag sets no cookies and sends Google only cookie-free signals (such as the page address, browser type and IP address), which Google uses to model advertising performance. Choosing "Necessary Only" keeps all of these off. We do not use third-party advertising cookies for any other purpose. How you found us (section 2.5) is not kept in cookies or in any other storage on your device.
For Canadian users: our use of cookies that collect personal information is governed by PIPEDA Principle 3 (consent) as well as CASL where applicable.
If we become aware of a suspected security incident or eligible data breach, we will investigate and assess the nature and scope of the incident and notify affected parties as required by law.
Australia: We will notify the OAIC and affected individuals as soon as practicable after becoming aware that there are reasonable grounds to believe an eligible data breach has occurred, in accordance with the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988.
Canada: We will notify the Office of the Privacy Commissioner of Canada and affected individuals as soon as feasible after becoming aware of a breach of security safeguards that poses a real risk of significant harm, as required by PIPEDA.
New Zealand: We will notify the New Zealand Privacy Commissioner and affected individuals as soon as practicable after becoming aware that a notifiable privacy breach has occurred, as required by section 113 of the New Zealand Privacy Act 2020.
United Kingdom: We will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of a personal data breach where feasible, as required by Article 33 UK GDPR, and affected individuals without undue delay where the breach is likely to result in high risk (Article 34 UK GDPR).
The Service is intended for use by businesses and their authorised staff, not by children directly. We do not knowingly collect personal information directly from children under 18.
All customer data is stored in AWS Sydney (ap-southeast-2), Australia. If you are based outside Australia, your data is transferred to and stored in Australia — see Section 4.1 for jurisdiction-specific detail on the safeguards that apply.
Cross-border operational data: Certain service metadata may be processed outside Australia by our service providers, including email delivery (Resend, Inc., United States) and AI-assisted quote generation (OpenAI, United States, for organisations that use that optional feature). We take reasonable steps to ensure overseas recipients of personal information comply with the APPs (as required by APP 8.1), including through contractual obligations and selecting providers with robust privacy and security practices.
We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification at least 14 days before they take effect. The "Last updated" date at the top of this page indicates when the policy was last revised.
In the event of a merger, acquisition, restructuring, or sale of all or substantially all assets, personal information may be transferred as part of that transaction subject to applicable privacy laws. Where required by law, or where reasonably practicable, we will notify you of any such transfer.
If you believe we have breached the Privacy Act or the APPs, please contact our Privacy Officer first. We will acknowledge receipt of your complaint as soon as reasonably practicable and aim to provide a substantive response within 30 days. If you are not satisfied with our response, you may contact the OAIC, the Office of the Privacy Commissioner of Canada, or the ICO as applicable (see Sections 7 and 9 for links).
Aventaryk Pty Ltd
ABN: 86 628 196 921
NSW, Australia
Privacy Officer: privacy@crewnly.com
General enquiries: hello@crewnly.com