Your data stays yours.

Who is responsible (the controller)

The controller for personal data processed through Match My Crew is Pascal Rost, Rost Software & Media, Neustadter Straße 4, 91085 Weisendorf, Germany. Full contact and tax details are listed on our Impressum page.

You can reach us for any privacy question at [email protected]. Where the GDPR requires us to appoint a data protection officer, that person's contact details will be published here; today, please contact us directly using that email address.

What we collect, why, and on what legal basis

We only collect personal data needed to operate your account, present the public profile you choose to publish, connect you with other users, and keep the platform safe. We never sell personal data.

• Account data (name, email address, hashed password, account role, marketing consent flag) — processed to create and administer your account and to provide the service you asked for (Art. 6(1)(b) GDPR, performance of a contract).
• Public profile data you choose to add as a provider (bio, city, day rate, languages, equipment, portfolio images, service categories) — processed to display your profile to prospective clients and to make you discoverable in search (Art. 6(1)(b) GDPR, and Art. 6(1)(f), our legitimate interest in operating a working marketplace).
• Discovery and search activity (search terms, saved providers, filters) — processed to run the search and map features and to let you keep track of providers you're interested in (Art. 6(1)(b) and Art. 6(1)(f) GDPR).
• Inquiry messages between clients and providers — processed to deliver your messages and maintain a record either party can refer back to (Art. 6(1)(b) GDPR).
• Reviews and ratings you submit — processed to display trust signals to other users (Art. 6(1)(b) and Art. 6(1)(f) GDPR).
• Reports you file, and moderation records created when our team reviews a report or takes action on an account, profile, or review — processed for platform safety, abuse prevention, and to maintain an audit trail of moderation decisions (Art. 6(1)(f) GDPR, our legitimate interest in a safe platform, and Art. 6(1)(c) GDPR where we are legally required to keep such records).
• Marketing communications — only if you opt in via your account's marketing consent setting (Art. 6(1)(a) GDPR, consent, which you can withdraw at any time without affecting the lawfulness of processing before withdrawal).
• Transactional emails (confirming your address, password resets, inquiry notifications) — processed to operate account security and core functionality (Art. 6(1)(b) GDPR).
• Authentication/session cookies and basic server logs (IP address, timestamp, requested URL, user agent) — processed to keep you signed in and to secure the service against abuse (Art. 6(1)(f) GDPR, and Art. 6(1)(b) GDPR for the session cookie itself).

Map tiles on the Discover page

The Discover page (/discover) renders a map using tiles loaded directly from the OpenStreetMap Foundation's tile servers (tile.openstreetmap.org). When your browser requests a map tile, your IP address and standard browser request data (such as user agent) are transmitted directly to OpenStreetMap's servers — this happens independently of our own backend, in the same way loading any embedded map does. That transfer is processed on the basis of our and OpenStreetMap's legitimate interest in providing a functioning map (Art. 6(1)(f) GDPR). OpenStreetMap's own privacy practices govern that processing; see their privacy policy at https://osmfoundation.org/wiki/Privacy_Policy. We do not control retention of that data on OpenStreetMap's infrastructure.

Who else receives your data

We share personal data only where necessary to run the service, and never sell it. Recipients include:

• Hetzner Online GmbH, which hosts the Match My Crew server in Nuremberg, Germany.
• checkdomain GmbH, which relays transactional and account emails (verification, password reset, and inquiry notifications) through its SMTP service.
• The OpenStreetMap Foundation, as described above, for map tiles shown on /discover.
• Google Ireland Limited / Google LLC, only if you opt in to Google Analytics as described below. Google's processing may involve a transfer to the United States; Google provides its applicable privacy information at https://policies.google.com/privacy.
• Authorities or third parties where we are legally required to disclose data, or where necessary to establish, exercise, or defend legal claims.

International transfers

Where a recipient listed above is located outside the EU/EEA, we rely on an adequacy decision or appropriate safeguards (such as the European Commission's Standard Contractual Clauses) to ensure your data continues to receive an equivalent level of protection.

How long we keep data

• Account and profile data: retained while your account is active, and deleted or anonymized within 30 days of a confirmed deletion request, unless a longer period is required by law (for example German commercial and tax retention rules of up to 10 years for records qualifying as business correspondence or accounting documents).
• Inquiry messages: retained for as long as either party's account exists, and for up to 12 months afterward to allow either party to resolve a dispute, unless deleted sooner at your request.
• Reviews: retained while your account exists, or until you delete the review or your account.
• Reports and moderation records: retained for up to 3 years after the underlying report or action, to let us demonstrate compliance and defend against claims. If a reporter, reported profile owner, or moderator deletes their account, we remove the direct account/profile link while retaining the de-identified safety record.
• Basic server/security logs: retained for a rolling period of up to 90 days.
• Marketing consent records: retained until you withdraw consent, plus a reasonable period afterward as evidence that consent was withdrawn.

Cookies and similar technologies

Match My Crew uses one strictly necessary session cookie to keep you signed in and to protect your account (set by our authentication system). This cookie is required for the service to function and falls under the "strictly necessary" exemption in Art. 5(3) of the ePrivacy Directive, so it does not require your consent — but we're telling you about it here regardless.

If you opt in via the cookie consent banner, we use Google Analytics 4 (Google Ireland Limited / Google LLC) to measure aggregate use of the site. Google Analytics may store analytics cookies and receive technical information such as your IP address, browser, device information, visited pages, and interaction data. We use this information to understand and improve the service. It is processed only on the basis of your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time through Cookie settings in the footer. We do not load Google Analytics or send data to Google unless you opt in.

The cookie consent banner shown on your first visit lets you accept or reject non-essential cookies before any are set; your choice is recorded locally in your browser (not synced to our servers) so the banner does not reappear on later visits. You can change your mind at any time via the "Cookie settings" link in the footer.

As noted above, the Discover page loads map tiles directly from OpenStreetMap's servers; that request may be subject to OpenStreetMap's own technical identifiers, governed by their policy rather than ours.

Your rights

Under Art. 15–21 GDPR, you have the right to request access to your personal data, correct inaccurate data, request erasure, restrict or object to certain processing, receive a copy of your data in a portable format, and withdraw consent at any time without affecting past processing.

The most direct way to exercise access, correction, and deletion rights is from your account at /dashboard/settings. If a control you need is unavailable, contact us at [email protected] and we will handle the request manually.

You also have the right to lodge a complaint with a data protection supervisory authority, including the authority responsible for our registered seat: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, https://www.lda.bayern.de. You may also contact the supervisory authority in your own EU member state of residence.

Changes to this policy

We may update this policy as the platform evolves, for example as self-service export/deletion tools ship or if we introduce new processors. We'll update the "last updated" date above whenever we do.