Privacy policy

Who we are

Crewclash is run by the person or business that operates this site. In this policy, “we” and “us” mean them.

You can contact us at the request form on our website.

Our role, and your agency’s

Crewclash is used by agencies. Two different things happen to your information:

• Agencies and people who enquire. For the details an agency gives us to open and pay for an account, and for enquiries made on this website, we decide how the information is used. We are the “controller”.
• An agency’s creators and schedule. The names, TikTok handles, Discord details and events an agency puts into its portal belong to that agency, and it decides how they are used. We look after them for the agency and only act on its instructions. We are its “processor”. If you are a creator and want to see, correct or remove your details, ask your agency first.

What we collect

• Enquiries. If you use the request form: your name, email address, agency name, roughly how many creators you have, the plan you are interested in, and anything you write.
• Agency accounts. The agency’s name, web address, plan and settings, and its admins’ details.
• Portal members. A name, a TikTok handle, a Discord username and Discord ID, and whether someone is a creator or an admin. A person may also have a username and password; the password is stored only as a one-way scrambled value, never as the password itself.
• Signing in with Discord. We receive your Discord ID, username and display name. We do not ask for your email address, your servers or your messages. The bot checks that you are in the agency’s Discord server and which roles you hold there, so that only members get in and the agency’s chosen roles get admin access.
• Schedules. Events and battles: type, time, opponent, notes, tags, and which creators are taking part. When an agency sends a battle or event request to a partner agency, that partner sees the time, the message, and the names and TikTok handles of the creators offered, and nothing else about the agency’s members.
• The Discord bot. It posts and edits messages in the channels an agency chooses, sends direct messages to creators who have linked their Discord account, and can draw a welcome picture using a new member’s display name and profile picture. It reads the server’s member list and roles for sign-in. It does not read what people say in the server.
• Payments. Subscriptions are handled by Stripe. We keep the Stripe customer reference, the plan, the subscription status and renewal date, and a billing email address. Your card details go to Stripe and never reach us.
• Technical information. A sign-in cookie that keeps you signed in (it is needed for the site to work, and ends after 14 days), small notes your browser keeps for convenience (for example that you have seen the tour or hidden a prompt), and the IP address and request details our servers and hosting provider see when you visit, used for security and to limit abuse.
• Fonts. Our pages load the Figtree font from Google Fonts, so your browser contacts Google when a page opens.

Why we use it

• To provide the service an agency has asked for, including signing people in, showing the schedule, posting in Discord and taking payment. This is the contract with the agency.
• To keep the service secure, prevent misuse and fix problems. This is our legitimate interest in running a safe service.
• To answer enquiries and to tell an agency about changes to the service or its account.
• To keep records of payments as accounting and tax rules require.

Who else sees it

We use a small number of providers to run the service, and share only what each needs:

• Railway, which hosts the site and its database.
• Discord, because the bot and Discord sign-in work through it.
• Stripe, which takes payments and manages subscriptions.
• Google Fonts, for the typeface, as described above.

Another agency sees an agency’s creators only when the agency offers them on a request, as described above. We may also share information where the law requires it. When we sign in to an agency’s portal as one of its admins or creators to help with a problem, we do so only to support the agency.

Moving information abroad

Some of these providers handle information outside the UK, including in the United States. Where that happens we rely on the safeguards the law recognises for such transfers, which those providers offer.

How long we keep it

• An agency’s portal information is kept while it uses the service. Removing a creator removes their record, and removing an agency removes everything in its portal.
• Sign-in sessions end on their own after 14 days.
• Enquiries are kept only as long as we need them to deal with the enquiry, and we will delete yours if you ask.
• Payment records are kept for as long as accounting and tax rules require.

Your rights

Under UK data protection law you can ask to see the information we hold about you, have it corrected or deleted, restrict or object to how it is used, and receive a copy in a portable form. Contact us at the request form on our website. If you are a creator, your agency is the best first contact for the information in its portal, and we will help it respond.

If you are unhappy with how we have handled your information you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would like the chance to put it right first.

Keeping it safe

The site is served over an encrypted connection, passwords are stored as one-way scrambled values, sign-in attempts are rate limited, and each agency’s portal is kept separate from the others. No service can promise perfect security, but we take reasonable steps and will tell the people affected, and the regulator where required, if something goes wrong.

Children

Crewclash is for agencies and the creators who work with them, who are adults. It is not meant for anyone under 18.

Changes

If we change this policy we will update the date at the top, and tell agencies about anything important.