Document version 1.0, effective [DATE]
Controller / Processor: UBGRADE Technologies Group LLC acts as an independent Data Controller for account registration, platform administration, website enquiries and operational data processing, and as a Data Processor when processing personal data on behalf of its business customers.
Document owner: UBGRADE Technologies Group LLC, UIC BG200956833, registered office and management address: "Sv. Sv. Kiril i Metodiy" Str. No. 124, Sofia, BG 1202, Bulgaria
Contact (Privacy / DPO): Desislava, privacy@crewbase.cloud
Jurisdiction: European Union
Applicable regulation: Regulation (EU) 2016/679 (GDPR)
1. Introduction
This Privacy Notice explains how UBGRADE Technologies Group LLC ("Crewbase", "we", "us", "our") processes personal data when individuals and organisations visit crewbase.cloud or use the Crewbase service.
Crewbase lets customers rent a team of AI agents that carries out their work, with vetted human experts who review and sign off deliverables that need a professional. The AI agents are powered by third-party AI model providers.
We are committed to ensuring compliance with Regulation (EU) 2016/679 ("GDPR") and applicable data protection laws.
2. Data controller and data processor roles
2.1 Crewbase as Data Controller
We act as an independent Data Controller when we determine the purposes and means of processing personal data for:
- creation and management of user accounts;
- platform administration and authentication;
- answering "Build my team" requests and contact form messages sent through our website;
- system security, logging, rate limiting and abuse prevention;
- provision and maintenance of core platform functionality;
- billing and account-related communications (where applicable).
2.2 Crewbase as Data Processor
We act as a Data Processor when we process personal data on behalf of business customers (Data Controllers) in providing the Crewbase service. This includes:
- storage and processing of documents, data and instructions the customer gives its AI team;
- execution of AI-based work initiated by the customer;
- review of deliverables by the human expert assigned to them;
- transfer of data to approved subprocessors strictly for service delivery purposes.
In this role we process personal data solely on the documented instructions of the Data Controller. Such processing is governed by a Data Processing Agreement (DPA) under Article 28 GDPR.
2.3 No hybrid or unauthorised processing
We do not use personal data processed as a Data Processor for independent purposes, including profiling, marketing or model training. We process it only on documented instructions, protect it with appropriate technical and organisational measures, and do not reuse it beyond the scope of the service.
2.4 Determination of role
Where Crewbase provides services to individual end users, we generally act as a Data Controller. Where we provide services to business customers to process data within the platform, we act as a Data Processor under a DPA.
3. Categories of personal data
3.1 Account data
- Email address, name, user identifier, company (if provided), authentication data (hashed passwords)
3.2 Website enquiries
- "Build my team" request — the text you type describing what you need, so we can design and propose an AI team for you
- Contact form messages — your email address and your message
3.3 Technical and usage data
- IP addresses for rate limiting and abuse prevention — held in memory only, for at most 1 hour, and never written to a database
- Server logs — time, requested path, status and error information needed to operate and secure the service
- Login activity and feature usage metadata
3.4 Customer content
Documents, data, instructions and conversations customers give their AI team, and the deliverables it produces. This content may include personal data, business information and communications.
4. Purposes of processing
- Providing the Crewbase service, including running the customer's AI team and expert review
- Responding to "Build my team" requests and contact messages
- Ensuring system security and preventing misuse, including rate limiting
- Billing, once paid plans launch
- Maintaining and improving platform functionality (excluding model training on customer data)
Personal data is processed strictly for these purposes and on the legal bases in Section 5. No personal data is processed in a manner incompatible with these purposes.
5. Legal basis for processing (Art. 6 GDPR)
5.1 Performance of a contract (Art. 6(1)(b))
Creating and managing accounts, running the customer's AI team, expert review of gated deliverables, and taking steps at your request before entering into a contract (such as answering a "Build my team" request).
5.2 Legitimate interests (Art. 6(1)(f))
Ensuring the security, stability and integrity of the platform; detecting and preventing fraud, abuse or unauthorised access (including in-memory rate limiting by IP address); monitoring performance; and answering general enquiries. Where required, we conduct balancing assessments to ensure these interests are proportionate.
5.3 Legal obligation (Art. 6(1)(c))
Keeping billing and accounting records required by tax and accounting law.
5.4 Consent (Art. 6(1)(a))
We do not rely on consent for core functionality. Consent is used only for optional processing such as marketing communications (if enabled). Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.
6. Data sharing and recipients
6.1 Infrastructure
Self-hosted infrastructure operated by UBGRADE in Sofia, Bulgaria (EU).
6.2 AI model providers (subprocessors)
To run your agents, the relevant instructions and content are sent to the AI model providers we use: Anthropic, OpenAI, Google, Voyage AI, Z.ai, Moonshot AI (Kimi) and DeepSeek. The provider used for a given agent depends on the model configured for it. These providers process data for inference purposes.
6.3 Human experts
When a deliverable needs expert sign-off, the vetted expert assigned to it sees the content needed for that review, under confidentiality obligations.
6.4 Payment providers
When payments launch, Stripe and/or Mollie will process payment data.
6.5 Email / communication providers
SMTP or transactional email service providers, for example to deliver contact form messages.
All subprocessors are bound by appropriate data protection agreements. A list of subprocessors is maintained and may be updated; where required by law, customers will be notified of material changes. We do not sell personal data.
7. International data transfers
Some subprocessors, in particular AI model providers and payment providers, may process data outside the European Economic Area, including in the United States and the People's Republic of China (Z.ai, Moonshot AI and DeepSeek). For such transfers we ensure appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission or an adequacy decision, Transfer Impact Assessments (TIA), and technical and organisational safeguards such as encryption in transit.
8. Data retention
We retain personal data only for as long as necessary for the purposes for which it is processed, in accordance with the GDPR storage limitation principle. In general terms:
- IP addresses used for rate limiting are kept in memory only, for at most 1 hour;
- account data is retained until account deletion;
- customer content is retained until deleted by the customer or on termination;
- "Build my team" requests and contact messages are retained for as long as needed to handle the enquiry;
- system logs are retained for security, auditability and operational integrity purposes;
- billing records are retained as long as tax and accounting law requires.
Detailed retention periods are defined in our Data Retention & Deletion Policy and are subject to review in accordance with legal, security and operational requirements.
9. Data security
We implement appropriate technical and organisational measures under Article 32 GDPR, including encryption in transit (TLS) and at rest, role-based access control, multi-factor authentication for administrative access, audit logging, least-privilege access, security monitoring, and backup and disaster recovery.
10. Automated processing and AI
- Crewbase does not engage in automated decision-making that produces legal or similarly significant effects on individuals.
- Crewbase does not perform behavioural profiling.
- AI-generated outputs may contain inaccuracies. For gated deliverables a human expert reviews and signs off the work; outside that, users are responsible for verifying outputs before relying on them.
11. Cookies and local storage
This website uses no tracking cookies and no third-party analytics. The only thing stored in your browser is a small localStorage entry that remembers when you last used "Build my team", so the page can enforce the one-request-per-hour limit. You can clear it in your browser settings at any time. Fonts are loaded from Google Fonts, so your browser connects to Google's servers to fetch them.
12. Data subject rights
Under the GDPR you have the right of access, to rectification, to erasure ("right to be forgotten"), to restriction of processing, to data portability, and to object to processing. You also have the right to lodge a complaint with a supervisory authority, in Bulgaria the Commission for Personal Data Protection (cpdp.bg), or the authority in the EU country where you live or work.
Requests can be submitted to privacy@crewbase.cloud or to our DPO, Desislava, at privacy@crewbase.cloud.
13. Changes to this notice
We may update this Privacy Notice to reflect changes in legal, technical or business requirements. Updates will be published on this website and within the Crewbase platform.