CRATEWIRE
Open the app

Privacy Policy

Privacy Policy

Last updated: 26 June 2026

Heads up

This is a starting template, not legal advice. Have a solicitor review it before you rely on it.

1. Who we are

CrateWire is operated by a sole trader based in the United Kingdom, who is the data controller for the personal data described in this policy. That means we decide how and why your personal data is processed, and we are responsible for protecting it.

For any data-protection matter, including a question, request, or complaint, contact us at support@cratewire.com.

2. What this policy covers

This policy explains the personal data we process when you use CrateWire, the subscription web app that identifies the tracks DJs play in their public Instagram posts. It covers what we collect, why we collect it, the legal bases we rely on, who we share it with, and the rights you have under UK GDPR.

It applies to the CrateWire web app and the marketing pages that link to it. It does not cover third-party sites or services we link out to, which have their own privacy policies.

3. Data we collect

We keep data collection tight and tied to running the service. Here is what we hold and who helps us process it:

  • Account and authentication

    Your email address and authentication data, handled via Supabase, our database and auth provider, so you can sign in and we can secure your account.

  • Subscription and billing

    Your plan, billing status, and payment records, handled via Stripe. We never see or store full card numbers, Stripe processes card details directly.

  • Tracked handles and track data

    The public Instagram handles you choose to track, and the derived track-identification data CrateWire generates from those public posts.

  • Technical and usage data

    Basic technical and usage data, such as logs, needed to run, secure, and troubleshoot the service.

4. How we use your data and legal bases (UK GDPR)

Under UK GDPR we must have a lawful basis for every use of your personal data. Here is how our purposes map to those bases:

  • Performance of a contract

    Providing the service and running your subscription: identifying tracks, building your feeds, and giving you access to the features your plan includes.

  • Legitimate interests

    Securing, operating, and improving the product, and understanding usage through privacy-friendly analytics, balanced against your rights and expectations.

  • Legal obligation

    Keeping billing and tax records for as long as the law requires.

  • Consent

    Anything that requires it, such as optional marketing emails if we offer them. You can withdraw consent at any time, without affecting earlier processing.

5. Sub-processors

We share data with the following providers only to run the service. Each acts on our instructions for the role listed:

  • SupabaseDatabase and authentication
  • StripePayment processing and subscription billing
  • VercelApplication hosting and infrastructure
  • Apify and RapidAPIRetrieval of public Instagram content
  • Google (Gemini)Automated track extraction from post text
  • Shazam-API and ACRCloudAudio fingerprinting and track recognition
  • ResendTransactional email

6. International transfers

Some of our sub-processors are based outside the United Kingdom, for example in the United States. Where your data is transferred internationally, we rely on appropriate safeguards such as UK-approved standard contractual clauses, or a finding that the destination country offers an adequate level of protection.

7. Data retention

We keep your account and billing data while your account is active, and for as long as we need it to meet legal and tax obligations, after which we delete or anonymise it. Derived track data is retained to power the product, for example to keep your tracklists and the cross-DJ feed working over time.

8. Your rights under UK GDPR

Under UK GDPR you have the right to access your data, to have it corrected (rectification) or deleted (erasure), to restrict or object to how we process it, to data portability, and to withdraw any consent you have given.

To exercise any of these rights, email us at support@cratewire.com. You also have the right to complain to the UK Information Commissioner's Office (ICO) if you are unhappy with how we handle your data, though we'd appreciate the chance to put things right first.

9. Account deletion and export

You can request an export or deletion of your account data at any time. Where the option is available, you can do this from your in-app account settings. Otherwise, email support@cratewire.com and we'll handle the request, subject to any data we must keep for legal or tax reasons.

10. Cookies and local storage

We use essential cookies and local storage for authentication and to keep you signed in. For product analytics we use privacy-friendly, cookieless measurement (Vercel) to understand how the service is used. We do not use advertising or cross-site tracking cookies.

11. No selling of personal data

We do not sell your personal data, and we do not share it for other companies' advertising. The only sharing we do is with the sub-processors listed above, purely to run CrateWire.

12. Children

CrateWire is not directed at children. You must be 18 or older to use it. If you believe a child has provided us with personal data, contact us and we will delete it.

13. Security

We take reasonable technical and organisational measures to protect your data, including working with established providers and limiting access to what is needed. No method of transmission or storage is ever 100% secure, so we cannot guarantee absolute security, but we work to keep your data safe.

14. Changes to this policy

We may update this policy from time to time. When we make material changes, we'll take reasonable steps to notify you, for example by email or an in-app notice. The “Last updated” date at the top always reflects the latest revision.

15. Contact

For any privacy question or data request, reach us at support@cratewire.com.