Privacy Policy
Crowdable is an ambassador platform operated by Crowdable SIA, registered in Latvia at Ventspils nov., Tārgales pag., Tārgale, "Zelmeņi" - 4, LV-3621, registration number 40203708984. You can reach us about anything on this page at crowdable@crowdable.co.
1. Who is responsible for your data
We are. Crowdable SIA is the controller of every piece of personal data in the product: your account, your profile, your applications, your submissions and files, your points and rewards, your delivery details, your support messages, your activity in every programme you join. Not "the account is ours and the rest belongs to the brand". All of it is ours to protect and ours to answer for, and this page is the one document that says what we hold, why, on what legal basis, for how long, and who receives it.
The brands whose programmes you join receive some of that data from us, to run their programmes. What each receives and what it may do with it is in section 7, in the same words the brand agreed to. A brand is not our processor and we are not its. Every request about your data, whichever programme it concerns, is made to us and answered by us.
An earlier version of this page said we were a brand's processor for what happened inside its workspace. That was a description of a contract, not of the product, and we have replaced the contract to match the product rather than the other way round.
2. What we collect
Account. Your name, email address and date of birth. There are no passwords: you sign in by opening a single-use link we email you, valid for 30 minutes, so there is nothing for us to store, leak, or ask you to remember. If you asked for an account through our waiting list, we also hold the brand you told us you were there for and whether and when a person here approved or declined the request.
Profile. Whatever you add: a photo, a short bio, and your social accounts with platform, handle, profile URL and follower count. All of it is optional, all of it is self-declared, and you can remove it from your settings. We verify nothing against any social network; we have no connection to any of them.
Applications. When you apply to a programme: your name, email address, date of birth, country, the social accounts you list, and your answers to the questions on that programme's form, together with the version of the Ambassador Terms you accepted and the IP address the application came from. Most questions come from our question bank, each shown with the reason it is asked, plus one optional open question for anything else you want the brand to know. A brand can also add questions of its own, each shown with the brand's stated reason for asking. Brands add these without waiting for us; we read them after they go live and can switch a brand's own questions off. An application exists before an account does, and it is ours to protect from the moment you submit it. When the brand decides on it, your answers, social accounts, date of birth, country and that IP address are deleted, and your name and email address follow 30 days later.
Membership. For each programme you are in: when you joined, your role, whether you completed onboarding, which version of the programme's rules you were shown, the results of any knowledge check, and the level you have reached.
Delivery details. Where a programme ships rewards, and only when you give them: a recipient name, address, city, postal code, country, phone number, and your top, bottom and shoe sizes. Held per programme, so a brand you have not given them to does not have them.
Content and participation. Campaign submissions and their status, links to your posts, the proof images and files you upload, and your participation history. Images may show your face.
Community. Reactions, comments and poll votes in a programme, and your posts, comments and votes on the feature board shared across Crowdable.
Points and rewards. The points ledger for each programme with the reason for every entry, and your redemptions with the reward, points spent, status and the brand's note on fulfilment.
Support. Tickets, messages and attachments you raise, whether with a brand's programme or with us.
Notifications. Your delivery preferences, notification records, and, if you turn push on, the subscription endpoint your browser issued with the keys it generated.
Security records. When you sign in we record the IP address and browser user-agent attached to your session, so you can recognise and end a session you do not recognise and so we can detect abuse. Separately we count sign-in and sign-up attempts against your email address and your IP address so the front door cannot be hammered. When you accept the Ambassador Terms we record the version, the time and the IP address it came from, so the acceptance can be shown later.
Records after you leave a programme. When a membership ends we keep a record of when and by whom, together with the delivery city, postal code, country, phone number and sizes as they stood, so that a reward already in the post can still be delivered and a dispute about it answered. The street address is not kept.
Something about uploads worth knowing before you make one. Your profile photo and a brand's own logos and artwork are served from addresses that do not ask who you are, so anyone holding the address can open the file. The addresses contain a random identifier and are not listed or guessable, but that is obscurity rather than a lock. Proof images and files you submit for a campaign, and support attachments, are private: they are served only through a short-lived link, issued after we have checked that the person asking may see them.
3. Why, and on what legal basis
Every purpose below has one basis, and the list is complete. We process your data only to provide Crowdable to you and to comply with the law. We do not process it for any other purpose of our own: no advertising, no profiling, no sale, no training of anything, no products for anyone else. That sentence is a promise and it is also a constraint we have accepted on what the product may become; if it ever stops being true, this page changes first and you are told.
| Purpose | What it uses | Basis |
|---|---|---|
| Running your account: sign-in, sessions, email, push | Account, notifications, security records | Performance of a contract, Art. 6(1)(b): the Ambassador Terms |
| Considering your application to a programme | Application | Steps at your request before a contract, Art. 6(1)(b) |
| Running the programmes you join: campaigns, submissions, points, rewards, delivery, support, community | Membership, content, points, delivery details, support, community | Performance of a contract, Art. 6(1)(b) |
| Keeping the service secure: session records, rate limiting, abuse detection | Security records | Legitimate interests, Art. 6(1)(f): ours and every other user's in a service that is not taken over; the records are minimal and short-lived |
| Enforcing our rules, handling reports of illegal content, suspending accounts | Whatever the case concerns | Legitimate interests, Art. 6(1)(f), and legal obligation, Art. 6(1)(c), under the Digital Services Act |
| Keeping a record of work after you are erased | Anonymised participation and reward rows | Legitimate interests, Art. 6(1)(f): ours and a brand's in being able to show what was done and rewarded if a claim is made; nothing identifying you remains |
| Aggregate page analytics (not switched on at present, see section 4) | Your IP address, discarded on arrival | Legitimate interests, Art. 6(1)(f): knowing which pages are read; nothing stored on your device, no identifier follows you |
| Push notifications | Push subscription | Consent, Art. 6(1)(a), given in your browser and withdrawn there |
| Keeping records the law requires | Whatever the law names | Legal obligation, Art. 6(1)(c) |
Where we rely on legitimate interests we have weighed them against your rights and consider the impact small given how little is involved; that is a judgement you are entitled to disagree with, and section 9 says how to object.
4. Analytics
Not switched on at present. No page loads the analytics script today. This section describes it as it will work when it is on, and we will say so here with the date when it is. We use Cloudflare Web Analytics to understand which pages get visited and where visitors arrive from. It sets no cookies, stores nothing on your device, uses no cross-site identifiers and no fingerprinting, builds no profile of you, and counts visits rather than people. Like any request your browser makes, the measurement request carries your IP address, and an IP address is personal data. Cloudflare discards it at the data centre nearest you without writing it to logs or databases. Standard tracker-blocking extensions block it and the site works normally.
5. Cookies
On the pages you sign in to we use strictly necessary cookies only: the ones that keep you signed in and protect forms against cross-site request forgery. We do not use advertising, marketing or cross-site tracking cookies anywhere. Blocking essential cookies will prevent you from signing in.
On our public home page, and on the demo pages we prepare for companies, the "Book a 45-min call" link opens our booking page on Google Calendar in a new tab. Nothing from Google loads on our pages and no cookie is set before you follow the link; on Google's page, Google's own terms and privacy policy apply.
6. Who we share data with
Our processors. We run on providers who process data on our instructions and for nothing else. Each is bound to us by a data processing agreement carrying the European Commission's Standard Contractual Clauses where anything leaves the EEA; the module is the controller-to-processor set (Module 2), because we are the controller of the data on this page, and the details are recorded with sources in our repository.
| Provider | What it does | Where it processes | Agreement and transfer basis | Personal data reaching it |
|---|---|---|---|---|
| Vercel | Application hosting and delivery | Functions run in Frankfurt, Germany (fra1). Vercel is a US company whose support staff can reach its systems from the United States. No data is stored on Vercel |
DPA in force. Certified under the EU-US Data Privacy Framework; Standard Contractual Clauses beneath | Everything, in passing, on every page |
| Neon, a Databricks company | Managed PostgreSQL database | Frankfurt, eu-central-1 |
DPA in force by incorporation into the Databricks Master Cloud Services Agreement. Standard Contractual Clauses | All data at rest, encrypted with AES-256 |
| Amazon Web Services (S3) | Storage for uploaded images and files, and the nightly database backups | Stockholm, eu-north-1 |
DPA in force. Standard Contractual Clauses, applying only if data leaves the EEA, which in the ordinary run it does not | Images and files, and a copy of the whole database each night kept for 30 days, all encrypted with AES-256 |
| Resend | Delivery of every email we send you, including sign-in links | United States. Resend offers no EU storage region | DPA in force, countersigned copy on file. Participates in the EU-US Data Privacy Framework; Standard Contractual Clauses beneath | Your name, email address and the message content, kept by Resend for 30 days, and deleted within 90 days if we close our account there |
| Sentry (Functional Software, Inc.) | Error monitoring: a report when a page or request fails | Frankfurt, Germany (Sentry's EU region) | DPA in force (version 5.1.0). Certified under the EU-US Data Privacy Framework; Standard Contractual Clauses beneath | The page address, your browser and IP address, and technical details of the error. It is set not to send the personal data it would otherwise collect by default |
| GitHub (Actions) | Runs the nightly database backup and checks that it restores | United States. GitHub does not let us choose where its standard runners are | DPA in force (October 2025). Certified under the EU-US Data Privacy Framework; Standard Contractual Clauses beneath | The whole database, in passing, once a night: it is copied from our database to our file store and test-restored, and nothing is kept at GitHub |
| Cloudflare | Aggregate web analytics. Not switched on at present | The data centre nearest you | DPA not yet accepted on our account, which we are doing. Certified under the EU-US Data Privacy Framework, which is the transfer basis | Your IP address and browser, the IP discarded on arrival as section 4 says |
Recipients that are not our processors. One party receives personal data for its own purposes rather than on our instructions:
- Your browser's push service: Google, Mozilla or Apple, depending on the browser you turned notifications on in. Your browser nominates it; we do not choose it and have no agreement with it. The notification content is encrypted end to end with keys your browser generated, so the push service relays what it cannot read; it sees the endpoint it issued and the timing of messages. Turning push off stops this.
Brands are the recipients that matter most, and section 7 is theirs.
Otherwise we disclose data only where the law requires it, or to a successor if our business is acquired, in which case we tell you before your data becomes subject to a different policy. We do not sell personal data and never have.
7. What a brand receives
A brand whose programme you join receives the following from us. For what it receives it is an independent controller, bound by its terms with us to use each thing only for the purpose stated and to delete it when that purpose ends. This table is the one in the brand's terms, in the same words.
| What | Which data | Purpose it may use it for | Keep until |
|---|---|---|---|
| Applications | Your name, email address, the social accounts you list with handle, URL and self-declared follower count, and your answers to the programme's questions, including custom ones | Deciding whether to admit you to the programme | Until the brand decides. At the decision the answers, social accounts, date of birth, country and IP address are deleted, and the name and email address 30 days later; the brand keeps nothing |
| Membership | Name, display name, email address, profile photo and bio as you show them, join date, role, onboarding status, which version of the rules you saw, knowledge check results, programme level | Running the programme: contacting members about it, allocating campaigns, judging progress | Membership ends; then the brand retains nothing except what the rows below allow |
| Participation and content | Campaign participation, submissions and their status, links to posts, uploaded proof images and files, and your handle as shown on them | Reviewing work done for its campaigns, awarding points, using content under the licence in the Ambassador Terms | Content: the licence tail. Record of work: three years after membership ends, in anonymised form (no name, handle, image or link to you) |
| Points and redemptions | The points ledger for the programme with the reason for each entry, redemptions with the reward, points spent, status and the brand's fulfilment note | Awarding and honouring rewards, and its own accounting for them | Three years after membership ends, anonymised, or longer where the brand's accounting law requires the transaction record, which it keeps under that law |
| Delivery details | Recipient name, address lines, city, postal code, country, phone number, and clothing and shoe sizes, as you gave them for that programme | Fulfilling a reward that has to be shipped, and resolving a dispute about that delivery | Delivery confirmed and any dispute closed; street address never later than that |
| Support | Tickets, messages and attachments you raise with the programme in its lane | Answering them | Ticket closed, then as the product retains it; the brand keeps no copy |
| Community in the programme | Reactions, comments and poll votes on the programme's news posts and polls, with your display name | Running the programme's community | As the product retains it; the brand keeps no copy |
A brand does not receive: your memberships of other programmes, your activity in them, your community activity outside its programme, your security records, or your date of birth.
A brand may not add you to a marketing list, share you with an agency or another company, or build a profile of you outside Crowdable without a legal basis of its own, its own notice to you, and our written agreement first. We will not agree to marketing use of delivery details or to any use of application data for an applicant a brand rejected. If a brand does something with your data you did not expect, tell us; that is a breach of its terms with us and we act on it.
Brands established outside the EEA and outside a country the European Commission has found adequate receive data under the Standard Contractual Clauses (controller to controller) or, for a US brand that is certified under it, the EU-US Data Privacy Framework.
8. Where your data is, and where it goes
Stored and processed in the EU, with three legs in the United States. The database is in Frankfurt, uploaded files and the nightly backups are in Stockholm, and the application runs in Frankfurt, all inside the EEA. Error reports go to Sentry's EU region in Frankfurt. Three things leave: email, because our email provider stores message content in the United States and offers no European option; the nightly backup job, which runs on GitHub's servers in the United States while it copies and test-restores the database; and support access by our US providers' staff. These transfers are lawful under the EU-US Data Privacy Framework, which each of those providers is certified under, with the Standard Contractual Clauses beneath as a fallback should the Framework cease to be available. Several of our providers are US companies whose support staff can reach systems from outside the EEA; section 6 says which. You can ask us for a copy of the safeguard a given provider relies on.
9. Your rights
Under the GDPR you have the right to access your data, to have inaccurate data corrected, to have it deleted, to restrict or object to how we process it, to receive it in a portable format, and to withdraw consent at any time without affecting processing that already happened. Every one of these is exercised against us, whichever programme it concerns. Write to crowdable@crowdable.co.
How. Editing your profile, removing a social account, deleting a photo and leaving a programme you can do yourself. For the rest a person here does it, with written procedures behind each: we can produce everything we hold about you as one bundle, in a readable form and a machine-readable one, with your files; we can move your sign-in address; and we can erase you. We acknowledge a request within two working days and answer within one month, and if something means we need longer or cannot tie the request to an account we tell you inside those two days.
What erasure does. We delete your account, profile, applications, delivery details, files and images, messages, and the record of your memberships. What stays is an anonymised record that work was done in a programme, when, and what it was rewarded with, with nothing that identifies you, kept for three years after the membership ended because that is how long a claim about it could be brought under Latvian commercial law, and then deleted. Each brand whose programme you were in is told to delete its copies. Your posts on social networks are yours and stay wherever you put them.
Objecting to legitimate interests. Tell us which processing in section 3 you object to and why. For analytics, a tracker-blocking extension does it without asking us.
If you think we have handled your data badly, you can complain to the Latvian Data State Inspectorate (Datu valsts inspekcija) or to the authority where you live. We would appreciate the chance to put it right first.
10. How long we keep it
| What | Kept until |
|---|---|
| Account and profile | Your account is erased |
| Applications | While the brand has not decided. At the decision the answers, social accounts, date of birth, country and IP address are deleted, and the name and email address 30 days later. A daily job removes them |
| Membership, content, points, redemptions, delivery details, support, community | While the membership and account exist; then as the erasure rule in section 9 says |
| Removal record (delivery city, postal code, country, phone, sizes) | Your account is erased, or the programme closes, whichever is first |
| Session records, including IP address and browser | 7 days after the session expires, which is 30 days after you last used it. A daily job removes them |
| Sign-in and sign-up rate-limit counters, including email and IP | Removed by a daily job once they have stopped counting, so within a day of expiring |
| Emails we sent you, at Resend | 30 days, in the United States; deleted within 90 days if we close our account there |
| Our staff's admin access log | 400 days |
| Prior versions of deleted or overwritten files | 30 days, so a mistake can be undone. Erasing your account and taking down a file delete every version at once |
| Nightly database backups | 30 days, then deleted. Each is a copy of the whole database as it stood that night |
| Anonymised record of work after erasure | 3 years after the membership ended |
| Analytics | Held by Cloudflare in aggregate only, never linked to you |
A database record you delete stays recoverable from our database provider for six hours, and in our nightly backups for up to 30 days, after which it is gone. If we ever restore a backup, we first remove from it everyone erased since it was taken.
11. Security
Written in two halves on purpose: what is in place, and what is not. A page that lists only the controls it has is a sales document.
In place. Encryption in transit with TLS. Encryption at rest, AES-256, at the hosting platform, the database and the file store, each verified on 28 August 2026; our email provider does not state its position and is not included in this claim. No passwords anywhere. Programme isolation decided on the server, not in what the screen shows, and covered by tests. Rate limiting on sign-in and sign-up, with refusals logged. Session records you can see and end, swept seven days after expiry. Uploads pinned to their declared type and never executed. A record of what our own staff do in the admin screens, append-only, kept 400 days, which is what answers "who on your side looked at my data"; it covers the application only. The database restorable to any point in the previous six hours. A copy of the whole database every night, kept 30 days, and restored into an empty database each night to prove it can be. Prior versions of uploaded files kept 30 days, since 21 September 2026. A written procedure for detecting, containing, assessing and notifying a security incident, and a register in which every incident is recorded whether or not it is notified, kept since 23 September 2026.
Not in place. No record of provider console access: our database, hosting and file storage consoles sit outside the application's own log, and someone with console access would appear only in whatever the provider itself records; MFA on those accounts is the control that reduces it, and no application-side work can close it. No multi-factor authentication yet on the accounts that open those consoles, being enabled now; when it is, this page says so with the date. No self-serve export or deletion; both are commands a person runs on request. No certification and no third-party audit or penetration test report, and none planned at our size; our providers hold theirs. No rehearsed restore of the database provider's own six-hour window; the nightly backup is restored every night, the provider's window has not been. No on-call rota and no automated alerting: nothing pages anyone, and out of hours the first signal of an incident is usually a person telling us; alerting is planned, a rota is not at two people. No formal access review; at the current headcount the list of people with access is the list of founders.
If there is a breach affecting your personal data, we notify the Latvian Data State Inspectorate within 72 hours of becoming aware where the law requires it, and you where it requires that, with what we know at the time rather than after a complete picture, and an update when we know more.
12. Age
Crowdable is for people aged 18 and over. We ask for your date of birth and refuse below that; we do not verify it. If you believe an account belongs to someone younger, contact us and we will close it and delete the data.
13. Data Protection Officer
We have not appointed one and are not required to: what we hold is a record of participation, not monitoring of behaviour, and the scale is small. We will revisit this if either changes, and we will say so here.
14. Changes to this policy
If we make a material change we update the version and date at the top, email account holders before it takes effect, and where it changes what a brand receives, the brand's terms change in the same release. A change to our providers is a change to section 6 and is notified the same way.
Crowdable SIA, crowdable@crowdable.co, +371 26126798. Ventspils nov., Tārgales pag., Tārgale, "Zelmeņi" - 4, LV-3621. Registration number 40203708984.