Legal
Privacy notice
How Krewsys collects, uses and protects personal data.
Last updated: 18 October 2026
1. Who we are
Krewsys (“we”, “us”) is provided by Krewsys (company details to be confirmed). For personal data we process for our own purposes, such as running accounts, billing and this website, we are the controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. You can contact us about privacy at [email protected].
When our customers (studios and agencies) upload their projects, files and client feedback to Krewsys, the customer is the controller of that content and we process it on their behalf as a processor. If you are a client of one of our customers, please contact that studio first about your data; we will help them respond.
2. What we collect
- Account details: name, email address, password (stored hashed), workspace and role, and profile details you choose to add. If you sign in with Google, we receive your name, email address and Google account identifier.
- Content you upload: videos, images, documents, comments, drawings, voice and screen recordings, tasks, messages and approval decisions.
- Reviewer details: when someone reviews through a share link, the name and email address they enter, and what they comment on or approve.
- Billing details: plan, invoices and payment status. Card details are handled by our payment provider and are not stored by us. (Payment provider to be confirmed.)
- Technical data: IP address, browser and device information, and logs of sign-ins and actions, kept for security, audit and troubleshooting.
- Messages to us: what you send when you email us or report a problem.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Providing the service: accounts, workspaces, review, file storage, notifications | Contract |
| Billing and keeping financial records | Contract; legal obligation |
| Security, fraud prevention, audit logs and service reliability | Legitimate interests |
| Service emails (verification, password resets, review and approval notifications) | Contract; legitimate interests |
| Answering questions and support requests | Legitimate interests |
| Product news and marketing emails, if we send them | Consent, which you can withdraw at any time |
4. AI Visual QA
AI Visual QA reads the text in images and video frames you choose to check, and compares it with copy you provide. It produces suggestions only; a person decides what to do with each one. We do not use your content to train third-party AI models. (Owner to confirm where checks run and whether any third-party AI provider is used.)
5. Who we share it with
We use carefully chosen service providers (sub-processors) to run Krewsys, under contracts that require them to protect your data. Depending on configuration these include hosting, file storage, email delivery and payment providers. A current list is available on request. (Owner to publish the list, for example: hosting provider, Cloudflare R2 for file storage, Resend for email, Google for sign-in, and the payment provider.)
We do not sell personal data. We may disclose data if required by law, or as part of a sale or reorganisation of the business, subject to this notice.
6. International transfers
Where a provider processes data outside the UK, we rely on UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
7. How long we keep it
We keep account data while your account is active. When a workspace is closed we delete or anonymise its content within a reasonable period, except where we must keep records (for example invoices, typically six years for UK tax purposes). Security logs are kept for a limited period. (Owner to confirm exact retention periods.)
8. Security
We use encryption in transit, access controls by role, hashed passwords and audit logging. No system is perfectly secure; if a breach affects you we will tell you and the regulator where the law requires.
9. Your rights
Under UK GDPR you can ask to access, correct or delete your personal data, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on consent you can withdraw it at any time. Email [email protected] and we will respond within one month.
You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk. We would appreciate the chance to help first.
10. Cookies
See our cookie policy.
11. Children
Krewsys is a business tool and is not intended for children under 16.
12. Changes
We will update this notice when our practices change and show the date at the top. For significant changes we will tell account owners by email.