Crew Data Processing Agreement

DRAFT — not legal advice. Must be reviewed by a qualified Ghanaian lawyer before use with real customers or payments, and by a US lawyer before the planned Wyoming company takes over.

• Document: data-processing-agreement
• Version: 1.0
• Effective date: 2026-11-13

Summary in plain language

If your app collects personal data from its users, you decide what happens to that data. Crew only stores and handles it to run your app, as you instruct. We keep it secret and secure, tell you about breaches within 72 hours, help you answer your users' requests, and delete or return the data when you leave. It meets the main data laws your users may have, such as Ghana's, the GDPR and South Africa's. It is part of the Terms of Service.

1. Parties and roles

• You (the app owner) are the data controller (in South Africa, the "responsible party") for personal data of your app's users ("end users").
• Crew is the data processor (in South Africa, the "operator"; in California, the "service provider"). We process that data only on your behalf. Crew is run today by [OWNER FULL LEGAL NAME], an individual operating from Ghana. Planned: [CREW LLC], a Wyoming company, takes over when it is formed, as the Terms of Service, section 1.2, say.
• This agreement is meant to meet the controller-processor contract rules of the laws that may apply to you and your end users, including Ghana's Data Protection Act, 2012 (Act 843), Article 28 of the GDPR and the UK GDPR, Nigeria's Data Protection Act, 2023, Kenya's Data Protection Act, 2019, South Africa's POPIA, and the CCPA. Lawyer question: does it meet each of them, and what must be added for each?

This agreement is part of the Terms of Service. It applies from the moment your app first collects end-user personal data, and lasts as long as Crew processes it.

2. What is processed

Today: live sites made with Crew are static pages with no scripts, sign-in or forms that store data. The only end-user data Crew handles for them is each visitor's IP address and browser details, used for a moment to count visits with a key that changes daily, and never stored.

Planned: apps that store end-user data (ADR-0053) are not built yet. This table must match the platform when they launch.

3. Your instructions

• We process end-user data only on your documented instructions. Your instructions are: these terms, your app's design as you approved it, and the settings you choose in Crew.
• Asking Crew to build or change a feature is an instruction to process data as that feature needs.
• If we think an instruction breaks the law, we tell you and may refuse it.
• We do not use end-user data for our own purposes. We do not sell or share it, use it for advertising, combine it with other data, or train AI models on it.
• Crew's AI agents work on your app's code. They are designed not to read live end-user data. Previews use synthetic test data only. Your app's code repository on GitHub holds code, not end-user data.

4. Your duties as controller

• You have a lawful basis for collecting the data.
• You give your end users a clear privacy notice. Crew provides a template, filled from your app's real data use.
• You register with a data protection regulator, if the law requires it of you.
• You answer your end users' requests, with our help (section 7).

5. Confidentiality

Everyone at Crew who can access end-user data is bound to keep it confidential. Access is limited to people who need it to run, support or secure the service, and is logged.

6. Security

We protect end-user data with measures suited to the risk, including:

• a separate database for each app, so one app cannot read another's data;
• each app on its own web address, so one app's pages cannot read another's stored data;
• encryption in transit (HTTPS) and at rest, by our providers;
• passwords stored only as strong one-way hashes (argon2id), never in plain text;
• app code that holds no third-party secret keys; secrets are kept by a trusted service;
• automatic security checks before each version is published;
• tested backups, and the ability to restore an earlier state;
• limits on messages and sign-ups to prevent abuse.

Planned: the separate database, password hashing, secrets service and backups apply to apps that store data, which are not built yet.

We review these measures regularly. We may improve them, but we will not reduce the overall level of protection.

7. Helping with end users' rights

End users have rights under the laws that protect them, such as access, correction, deletion, objection and portability. We help you meet them:

• per-end-user export: you can export everything your app holds about one end user, in a readable format;
• per-end-user deletion: you can delete one end user's data from your app;
• whole-app export: you can export all your app's data at any time;
• if an end user contacts Crew directly, we pass the request to you without delay and do not answer it ourselves, unless the law requires.

Planned: per-end-user export and deletion are part of every app that stores data. They are not built yet, and must exist before any hosted app holds real end-user data.

We also help you, where reasonable, with security, breach notices, and any data protection impact assessment.

8. Sub-processors

• You agree that Crew may use the sub-processors listed in the Privacy Policy, section 4, as far as they handle your app. For hosted apps the main ones are Cloudflare (runtime, database, files, visit counts), Neon (larger databases) and, once your app sends them, an email and an SMS provider. GitHub and Anthropic receive your app's code, not its end-user data.
• Your own Paystack account processes your app's payments under your contract with Paystack. Paystack is not our sub-processor for them.
• We bind each sub-processor by contract to protection at least as strong as this agreement.
• We tell you at least 30 days before adding or replacing a sub-processor that handles end-user data. You may object on reasonable grounds. If we cannot solve the objection, you may end the affected service and get a refund of prepaid fees for it.
• We remain responsible to you for our sub-processors.

9. Breach notification

• If we become aware of a breach of security that affects end-user personal data, we tell you without undue delay, and within 72 hours.
• We tell you what happened, what data and how many end users are affected, the likely effects, and what we are doing about it. If we do not know everything at first, we send what we know and follow up.
• We help you notify regulators and your end users where the law requires.

Lawyer question: what notice periods do Ghana (Act 843 and the Cybersecurity Act, 2020, Act 1038), the US states, Nigeria, Kenya and South Africa set for controllers and processors, and to whom?

10. Deletion and return

• When your app is deleted or this agreement ends, you can export all your app's data first.
• We delete end-user data within 30 days after the end, and from backups within a further 35 days, unless the law requires us to keep it.
• If your app stops because your balance is unpaid, we do not delete data for at least 12 months, and only after 30 days' notice (see the Terms, section 5).

11. Audits and information

• On request, we give you the information you reasonably need to show that this agreement is being met. This includes a description of our security measures and our sub-processor list.
• If that is not enough, you may audit us, or have an independent auditor do so, at your cost, once a year, with 30 days' notice, during working hours, and under confidentiality. We may provide an independent report instead.

12. Transfers across borders

• Your app's data is stored in the European Union by default. *Assumption: in Western Europe (Cloudflare D1 location weur) or Germany (Neon, AWS Frankfurt).* Crew itself is run from Ghana, and some providers are in the United States.
• We transfer end-user data only to sub-processors bound to protect it as this agreement requires, and as the law allows.
• EU, EEA and UK end users: where their data leaves the EEA or the UK to a country without an adequacy decision, the European Commission's Standard Contractual Clauses (controller to processor, or processor to processor) and the UK's International Data Transfer Addendum apply between you and Crew, and between Crew and its sub-processors. They are part of this agreement by reference, and win if they conflict with it.

Lawyer question: which modules, the choice of law and court in the clauses, and whether the app owner needs anything more under Act 843, the NDPA, Kenya's Act or POPIA, such as consent or a notice to a regulator.

13. California

Where the CCPA applies, Crew is your service provider. We process end-user personal information only for the business purposes in section 2, and we do not sell or share it, keep or use it outside our direct relationship with you, or combine it with other data, except as the CCPA allows. We tell you if we can no longer meet these duties.

14. Liability and order of documents

• Liability under this agreement is subject to the limits in the Terms of Service, as far as the law allows.
• If this agreement conflicts with the Terms of Service about end-user data, this agreement wins.

15. Contact

Data protection contact: [NAME OR ROLE], [privacy@crew domain].