Privacy & pilot terms.

Actual data handling

Crew-Link holds account-owned profiles, experience, qualifications, certificate dates and uploaded originals. Self-service profile data is stored in the application’s Cloudflare D1 binding; documents use a private R2 binding behind authenticated endpoints. The current application is hosted through Sites with a custom domain. Account verification, sign-in and recovery use Clerk. This setup must not be described as UAE-only hosting.

Text reading and OCR run in your browser using models and libraries served by the site. No external AI extraction service is connected. Your original uploads nevertheless go to production storage. Files are not malware-scanned. Limits: PDF/JPG/PNG, 10 MB each, 25 files and 50 MB per account including trash; browser reading supports up to 20 PDF pages.

Prior workspace features may store device-only records in browser storage. Signing out does not necessarily clear those older device records or files you exported. Avoid shared computers and use the relevant device-reset controls after exporting anything needed.

Consent and access

Sharing is off by default. The crew member chooses a named admitted company, selected active documents and an access period of 1–30 days. The profile snapshot includes saved contact and career information, but excludes internal draft notes. A profile update does not silently update a previous snapshot: revoke the old share and consent again to the new saved version.

Authorised staff in that company can view and download the chosen records until expiry, revocation or suspension. Internal employer review notes remain in that company; a separate information-request field is visible to crew. Crew can inspect logged profile/file access and relevant changes. Access history records account identifiers, actions and timestamps. Access restriction cannot recall copies already downloaded by a recipient.

Operator access exists for staff intake, company admission and support. The new employer workflow has no general administrator impersonation feature. Technical hosting/identity administrators may have infrastructure access. Any support access and purpose must be documented. Staff-created candidate records and their backups are separate from self-service records.

Deletion and retention

The self-service deletion action revokes portal shares first, blocks future account-storage operations, then removes self-service profiles, private objects including trash, shared snapshots, linked employer reviews, linked share events and the user’s pilot/support requests. Failed deletion stays blocked and may be retried. A minimal deletion marker (account ID, request time, status) is retained to prevent accidental restoration.

It does not close the Clerk identity, remove data held independently by employers, clear browser/device copies, or remove separately held staff-intake records and candidate recovery backups. Contact help@crewlink.team for those requests. No automatic purge or retention schedule is currently configured for non-deleted records, invitation metadata, general company events or existing recovery copies. Those periods, data-subject response process, legal holds and backup erasure procedure must be approved before a real-data pilot.

A company owner must arrange company closure or transfer before self-service deletion. Necessary company or legal records must have a documented basis and retention decision; the operator must not promise universal immediate erasure.

Proposed use terms

Crew accounts and the core record/sharing tools are free. No recruitment or placement fee is charged to crew through this app. Employer pilot pricing requires a separate written agreement. No payment is collected here. Any third-party course, medical or renewal service must have an identified provider, disclosed fee and explicit approval before purchase.

Users must provide information they are authorised to hold and share, review extracted text, protect their sign-in credentials and report misuse. Employers must use data only for the consented purpose, restrict their staff, respect withdrawal and independently check legally required qualifications and eligibility. Do not upload diagnostic reports or unnecessary identifiers to test the service.

“Extracted” means a machine suggestion; “reviewed” means checked by the submitting user; “checked against source” means compared with a document. None establishes independent issuer verification, medical fitness, employment entitlement or accreditation. No placement or hiring outcome is guaranteed. The app does not make automated employment decisions.

Workflow notifications currently appear in the app. Prepared invitation links are sent by the company manually. Clerk handles account messages. Automatic branded workflow email delivery is not configured or accepted as reliable yet.

Questions that must be resolved

1. Who is the legal operator/controller and contracting entity? What are its address and privacy contact? Is Blue Iris a customer, operator, processor or other related party?
2. Which UAE jurisdiction and any foreign recruitment/privacy rules apply? What controller/processor contracts and international transfer safeguards are needed?
3. May identity and medical certificates be held in this architecture and these locations? What health-data-specific rules or restrictions apply? What documents should be excluded?
4. What retention, deletion, backup, breach handling and request-response periods apply? Who is accountable?
5. What recruitment/placement permissions, complaint routes and employer checks are required for the pilot?
6. What liability, confidentiality, termination, IP, disputes and governing-law clauses should the signed agreement use?

Sources for counsel’s review: UAE Federal Decree-Law No.45 of 2021; ILO Maritime Labour Convention. Applicability and current local obligations require legal confirmation; this draft is not a compliance certification.