Privacy Policy

Privacy Policy

Last updated: November 3, 2026

Verified Crew Technologies LLC ("Verified Crew", "we", "our", or "us") is committed to protecting your privacy and the privacy of your personal credentials, identity documents, and professional records. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

Information We Collect

We collect information that you provide directly to us, including:

• Account information (name, email, phone number, role, employer)
• Identity documents submitted for verification (wallet, photo ID)
• Biometric information captured during identity verification (for example a selfie or video used for liveness and face matching against your photo ID, and derived signals such as match scores and a mathematical representation of the verification selfie used for fraud prevention and duplicate-identity detection)
• Maritime credentials and certificates (CoC, STCW, ENG1, endorsements)
• Sea time records and voyage history
• Background check consent and results (depending on the checks ordered, these may include criminal record, civil litigation, bankruptcy, credit, directorship, education, and adverse media findings)
• Payment and billing information when you purchase paid services (processed by our payment provider; we do not store full payment card numbers)
• Communications with our support team
• Medical fitness certificates

We also automatically collect certain information when you use our platform:

• Device and browser information
• IP address and location data
• Usage patterns and feature interactions
• Error logs and performance data

How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our platform
• Verify your identity through our verification partners
• Process credential verification requests
• Process payments for paid services
• Detect and prevent fraud, including document tampering and duplicate identities
• Send you technical notices, expiry reminders, and support messages
• Send you marketing communications where you have opted in or where otherwise permitted by law (you can unsubscribe at any time via the link in the message or your account settings; opting out of marketing does not affect service messages)
• Respond to your comments and questions
• Develop new features and services
• Train and improve our AI capabilities (using anonymized, aggregated data only, and excluding any data sourced from LinkedIn or other third-party APIs whose terms prohibit such use)

Text Messaging (SMS)

If you provide your mobile phone number, we use it to send service messages by SMS, such as two-factor authentication and account verification codes and, where you have separately opted in, other account notifications. Your consent to receive these messages is collected at the point where you provide your phone number.

We do not share, sell, rent, or otherwise provide your mobile phone number, SMS opt-in status, or messaging consent information to any third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third parties. The only exception is our SMS delivery provider, which processes your number solely as our service provider to deliver the messages you request.

• Message frequency varies based on your account activity (for example, one message per sign-in or verification request)
• Message and data rates may apply
• Opt out at any time by replying STOP to any message; reply HELP for help, or contact us at hello@verifiedcrew.com
• Opting out of SMS may mean you need to use an alternative method (such as email) for sign-in and account verification

Credential Data

Your credential data receives special handling:

• You control sharing. Credentials are only shared when you explicitly grant access through a sharing link or QR code.
• Access is revocable. You can revoke any sharing link at any time.
• Verification is separate from storage. Third-party verifiers see only the verification result (pass/fail), not the underlying documents, unless you choose to share them.
• Expiry data is yours. We use certificate expiry dates to send you reminders, but we never share this information with employers without your consent.

Vessel Operators and Crew Lists

When you ask a vessel's operator to confirm you were aboard, we tell that operator what the request says it will: your name, the role you logged, the dates you gave and the vessel, and your profile photo where the request says so. We only tell an operator whose registration our team has checked, and you can withdraw the request until the operator answers.

If the operator confirms you, you join its crew list for that vessel. The crew list is the operator's own record of who was aboard. Like everyone on it, you appear there with your current profile photo, if you have one, so changing or removing your photo changes what the operator sees.

Vessel Movement Data (AIS)

When you add a voyage with a vessel identifier (an MMSI number) and enable AIS verification for that voyage, we collect the vessel's publicly broadcast position history for the period of your engagement and link it to your sea time record. This is how we corroborate your claimed sea days against the vessel's actual movements.

• It is opt-in, per voyage. We only track a vessel for your voyage when you enable AIS verification for that voyage. You can turn it off at any time, which stops future collection for that voyage.
• What we collect: the vessel's broadcast AIS positions (location, speed, heading, timestamps), port calls, and derived activity such as days underway or in port. This data describes the vessel's movements. Because it is linked to your voyage dates, it also evidences where you were during your engagement.
• Where it comes from: public AIS broadcast data obtained from third-party aggregation services (currently AIS Friends, AISHub, and ShipFinder). These services receive only the vessel's identifier from us, never your personal details. They are sources we obtain data from, not processors of your personal data.
• What it is used for: verifying sea service. Your testimonials state how many of your claimed sea days are corroborated by vessel movement data, and crew edits can never increase the corroborated figure.
• Retention and deletion: once a voyage is approved, the detailed position history is reduced to an hourly summary and a tamper-evident proof of the evidence is sealed. Deleting your account removes your voyages, their tracking data, testimonials, and evidence records from our systems. A sealed technical archive of vessel movement fixes, which does not directly identify you, may be retained for evidence-integrity purposes, and copies of signed testimonials you have already shared with employers or maritime authorities remain with those recipients.

If you work at an issuing office

This section is for staff of a maritime administration, a flag state registry, a training school, an approved doctor's practice or any other office that issues certificates to seafarers, when we ask your office to confirm one. It gives the information UK and EU data protection law (Articles 13 and 14 of the UK GDPR and the GDPR) requires.

Who we are. Verified Crew Technologies LLC, 1621 Central Ave, Cheyenne, WY 82001, United States, is the controller. Contact us at privacy@verifiedcrew.com.

What we hold about you:

• the work email address and, where it is published, the name or job title we use to write to your office;
• the answers you give us, by email or on our secure request page, and when you gave them;
• the time, IP address and browser (the user agent your browser sends) of each time the request page or the stop page is opened, and of each answer and stop.

We do not look up where an IP address is, and the request page and the stop page set no cookies and store nothing on your device.

Where your email address came from. From your administration's or office's published contact list or website. Occasionally a seafarer suggests an address for their issuing office; our team checks it against the office's published details before we use it.

Why we use it. To ask your office to confirm a certificate that a seafarer asked us to check and authorised us to ask about; to keep a tamper-evident record of each request and each answer, so that a verification can be checked later; and to detect and prevent misuse, such as a request link being answered by someone other than your office. Our team reviews any unusual pattern, such as an answer from a different network than the one that opened the page. No answer is rejected automatically, and we make no automated decision about you.

Lawful basis. Legitimate interests (Article 6(1)(f)). The interests are ours and the seafarer's in confirming that certificates are genuine before they are relied on for safety-critical work at sea, in keeping a record of each confirmation that can be checked later, and in protecting the request process from misuse. We use only your work details and what you do on our pages, and you can stop our requests at any time.

Who sees it. The seafarer, and the employers and organisations the seafarer shares their record with, see the result of the check and that it came from your office. We do not show them, or anyone outside our own team, your IP address or browser details. We store those details apart from the tamper-evident record, which holds only a keyed fingerprint of them. Our hosting and email providers process the data for us as described in "Third-Party Service Providers" below, and "International Data Transfers" describes how we protect data processed in the United States.

How long we keep it. The network details (IP address and browser) of a page opening are deleted after 90 days, and those of an answer or a stop after 24 months. The record of the request and your answer stays after that, without the network details; the fingerprint can then no longer be linked to them. A legal hold can keep particular details longer while a dispute about a verification is open. If you ask us to stop, we keep your address on our do-not-contact list for as long as we need it to honour your request.

Your rights. You can ask us for access to the data we hold about you, to correct it, to delete it or to restrict its use, and you can object to our use of it at any time. To stop all verification requests from VerifiedCrew to your address, use the stop link at the end of any of our emails, or tell us on the request page that your office does not answer verification requests. For anything else, write to privacy@verifiedcrew.com. You can also complain to a data protection authority, such as the UK Information Commissioner's Office (ico.org.uk) or the authority where you work. You do not have to answer our requests.

Third-Party Service Providers

We use the following third-party services to operate the platform and process verifications:

• Veriff (EU) for identity verification, including document checks, liveness detection, and face matching. Veriff processes your identity documents and verification selfie under their own privacy policy. We receive the verification result, confidence scores, and related verification signals.
• Certn (Canada/USA) for background checks. Background checks are initiated only with your explicit consent. Results are stored securely and shared only as you direct.
• Checkr (USA) for background checks in supported jurisdictions, on the same basis as Certn.
• Polar for payment processing and billing. Your payment card details are collected and processed by the payment provider, not stored by us.
• Twilio for delivering the SMS messages we send you (such as verification codes) and, via Twilio SendGrid, the emails we send you (sign-in links, notifications, and, where you have opted in, marketing). Twilio processes your phone number and email address solely to deliver these messages; see "Text Messaging (SMS)" above for our no-sharing commitment.
• Amazon Web Services for cloud hosting and encrypted document storage.
• OpenAI for AI-assisted document intake (for example extracting fields from an uploaded certificate). Documents are processed via API under terms that prohibit their use to train the provider's models.
• Google Analytics for consent-based usage analytics on our marketing site, as described in our Cookie Policy.
• Microsoft Clarity (USA) for consent-based usage analytics, heatmaps and session recordings on our marketing site and, as a separate choice, on eligible signed-in pages of the app. See "Cookies" below and our Cookie Policy.

These providers act as data processors or service providers under our instruction and are bound by data processing agreements. We share with each provider only the data needed for its role.

LinkedIn Data

When we use LinkedIn-sourced information about you (for example, to verify professional history or maritime industry context), we apply strict, additional limits beyond our standard data practices:

• Retention caps. LinkedIn profile data is retained for no more than 24 hours from collection. LinkedIn social-activity data (posts, comments, likes, shares) is retained for no more than 48 hours from collection. After these windows, the data is permanently deleted from our systems.
• No AI training. LinkedIn-sourced data is never used to train, fine-tune, or evaluate any AI model.
• Limited purposes. We do not use LinkedIn data for recruiting, candidate sourcing, CRM enrichment, audience building, or sales prospecting.
• No combining. LinkedIn data is never combined, joined, or correlated with any other dataset we hold (including credential records, employment history, or platform analytics).
• No export. LinkedIn data is never exported, transferred to third parties, or made available outside the original processing context.

International Data Transfers

We are based in the United States and process data there. Where we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses with our processors, and we apply the protections described in this policy regardless of where the data is processed.

Data Security

We implement industry-standard security measures to protect your data:

• Encryption in transit (TLS) and at rest (AES-256, with keys managed in AWS KMS)
• Role-based access controls
• Regular security reviews of our code and infrastructure
• SOC 2 Type I (in preparation; not yet attested)
• Data centers in secure, certified facilities
• Two-factor authentication available for all accounts

Data Ownership

Your data belongs to you. We do not sell or rent your personal data, and we do not share your credentials for third-party marketing. If you accept Meta advertising cookies, we share marketing-site page views and browser/device information with Meta for advertising measurement and personalisation, as described in our Cookie Policy. You retain full ownership of all certificates, sea time records, and documentation you upload to the platform. You can export your complete data at any time.

GDPR Compliance

If you are located in the European Economic Area, you have certain rights under the GDPR:

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to data portability
• Right to object to processing
• Right to restrict processing
• Right to withdraw consent

To exercise these rights, please contact us at privacy@verifiedcrew.com.

US State Privacy Rights

If you are a resident of California or another US state with a comprehensive privacy law, you have rights over your personal information, including the right to know what we collect, the right to access and receive a copy of it, the right to correct it, the right to delete it, and the right not to be discriminated against for exercising these rights.

The categories of personal information we collect are described in "Information We Collect" above and include identifiers, professional information, biometric information, commercial information, internet activity, general location (IP address), and sensitive personal information such as identity documents and background check results. We collect them for the purposes described in "How We Use Your Information".

We do not sell your personal information. If you accept Meta advertising cookies, the information sent to Meta may constitute sharing for cross-context behavioral advertising. You can opt out by choosing Accept analytics only or Reject optional cookies in Cookie settings. We also honour Global Privacy Control and Do Not Track by keeping Meta off. We use sensitive personal information only to provide the services you request, to verify identity and credentials, and to prevent fraud.

To exercise these rights, contact us at privacy@verifiedcrew.com. You may use an authorized agent where permitted by law; we will verify the request before acting on it.

Data Retention

We retain your data for as long as your account is active or as needed to provide you services. You may request deletion of your data at any time, subject to legal retention requirements.

What we hold about staff of issuing offices, and for how long, is described in "If you work at an issuing office" above.

Documents you upload for us to read are kept for about a day so you can check what we read, then deleted, together with the page images and page copies made while reading them. A file you save to a credential stays with that credential until you remove it. Backup copies of deleted files and records are removed within 30 days.

When you follow a campaign or invitation link, we record its campaign tags, landing-page category, time and whether its reference matches a campaign recipient. These records help us understand arrivals and signup conversions; they do not establish who physically clicked the link. The arrival catalogue is scheduled for deletion after 90 days. Campaign attribution saved with an account is retained with the account. The catalogue does not store full invitation URLs, sign-in tokens or IP addresses.

When you delete your account:

• Personal profile data is deleted within 30 days
• Credential files are deleted from our storage, and their backup copies within a further 30 days
• Verification records are anonymized for audit compliance
• Background check results are deleted from our systems (Certn retains records per their own policy)

Cookies

We use essential cookies to enable platform functionality. With your permission, our marketing site also uses Google Analytics and Microsoft Clarity analytics cookies to understand how visitors use the site. With separate advertising consent, our production marketing site uses the Meta Pixel for advertising measurement and personalisation. Some pages of the marketing site show adverts from our own ad server at ads.verifiedcrew.com (paid partner adverts are labelled "Sponsored"); it sets a few cookies so that a sign-up can be counted for the advert that led to it, assigns no visitor identifier, stores IP addresses only in anonymised form, and shares no personal data with advertisers. See our Cookie Policy for the specific cookies we set, what each one does, and how to manage or block them.

Optional app recording is a separate choice, made in the app. With your permission, the app uses Microsoft Clarity on eligible signed-in pages to understand how those pages are used, through heatmaps and session recordings. Page content, including your documents, is masked before the recording leaves your browser, and Clarity receives a pseudonymous reference for your account, never your name or email address. Sign-in, invitation, sharing and other token-bearing pages are not recorded. Microsoft keeps recordings for up to 30 days, except favorites and a random sample, which it keeps for up to 9 months. You can decline or withdraw this choice at any time using Analytics preferences in the app, without giving up any app feature. Campaign-link attribution and the records needed to operate signup are independent of that choice.

Children's Privacy

Our Service is intended for maritime professionals and does not address anyone under the age of 18. We do not knowingly collect personally identifiable information from anyone under 18.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date.

Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:

privacy@verifiedcrew.com

Verified Crew Technologies LLC 1621 Central Ave, Cheyenne, WY 82001, United States