This page is maintained by HeartCrew to answer common security and privacy questions about the HeartCrew volunteer coordination platform. It describes the controls we operate today and how responsibility is shared between us, our infrastructure providers, and you.
This page is not a certification or an independent audit. It is self-reported information about our own practices, kept current as the product changes. Where a control is provided by a platform we build on, we say so.
1. Access controls
- Account authentication. Access requires an email and password. Passwords are never stored by us in readable form — they are salted and hashed by our managed authentication provider, and we cannot retrieve them.
- Leaked-password screening. New and changed passwords are checked against a database of publicly breached credentials and rejected if compromised.
- Per-organisation isolation. Every volunteer, shift, group, message and compliance record is bound to the organisation that created it, and row-level security rules are enforced in the database itself — not just in the app. A request that isn't scoped to your organisation returns no rows.
- Role separation. Volunteers signing in to the self-service portal see only their own profile, shifts and messages. Administrator screens (volunteer records, reports, billing, account settings) are gated separately.
- Session handling. Sessions are token-based and expire; signing out clears the session and cached organisation data from the browser.
- Agent / API access. If you connect an AI assistant or external tool, it goes through an explicit consent screen and acts strictly within your own permissions — it cannot see other organisations' data.
2. Encryption
- In transit. All traffic to HeartCrew — the app, the API, and webhooks — is served over HTTPS/TLS. Plain HTTP is redirected.
- At rest. The managed database and file storage underpinning HeartCrew encrypt stored data at rest, with backups encrypted by the same platform.
- Secrets. API keys, webhook signing secrets and service credentials are held in a managed secret store, injected into server-side code at runtime, and never shipped to the browser or committed to source.
- Webhooks. Incoming payment webhooks are signature-verified before any record is written.
3. Payments
Card details never touch HeartCrew. Payments are processed by Paddle, our Merchant of Record, on Paddle's own PCI-compliant checkout. We store only a subscription reference, plan and status.
4. Data retention and deletion
- You can delete individual volunteers, shifts and messages at any time from within the app.
- When an account or organisation is deleted, its data is retained for 30 days and then permanently deleted. The 30-day window exists so an accidental deletion can be reversed on request.
- Records we are legally required to keep (for example transaction records for tax purposes) are retained for the period the law requires.
- Encrypted backups may persist for a short additional period before rotating out.
5. Subprocessors
We use a small number of vendors to run the Service. Each processes data only to deliver its function:
| Subprocessor | Purpose |
|---|---|
| Lovable Cloud (Supabase) | Application database, authentication, file storage, backups |
| Lovable | Application hosting and delivery |
| Paddle | Merchant of Record — checkout, billing, invoices, tax |
| Transactional email provider | Account, invitation, shift-reminder and support emails |
We'll update this list before adding a new subprocessor that handles personal information. To be notified of changes, email support.heartcrew@gmail.com.
6. Your rights (GDPR, CCPA/CPRA, Australian Privacy Principles)
HeartCrew is operated from Australia and is subject to the Australian Privacy Principles. Where the GDPR or the CCPA/CPRA applies to you, you also have the following rights:
- Access — request a copy of the personal information we hold about you.
- Correction — have inaccurate information corrected (most of this is directly editable in the app).
- Deletion / erasure — request deletion of your account and associated personal information.
- Portability — receive your data in a machine-readable format; volunteer, attendance and hours reports can also be exported to CSV from the Reports screen at any time.
- Restriction and objection — object to, or ask us to restrict, certain processing.
- Withdraw consent — where we rely on consent, withdraw it at any time.
- Non-discrimination — we will not degrade your service for exercising a privacy right.
We do not sell or share personal information for cross-context behavioural advertising, and we do not use volunteer data for advertising. There is therefore nothing to opt out of under the CCPA's "Do Not Sell or Share" right, but you may still contact us to confirm this in writing.
How to make a request: email support.heartcrew@gmail.com from the address on your account. We aim to acknowledge within 5 business days and respond within 30 days. If you are a volunteer whose records were added by an organisation, please contact that organisation first — they control that data and we act on their instructions. We'll forward your request to them if you're unsure who to ask.
7. Controller and processor roles
For administrator account data, HeartCrew is the controller. For volunteer records an organisation uploads, that organisation is the controller and HeartCrew is its processor, acting on its documented instructions. If you require a Data Processing Agreement, contact us and we'll arrange one.
8. Shared responsibility
| Who | Responsible for |
|---|---|
| Our platform providers | Infrastructure security, encryption at rest, network isolation, backups, patching |
| HeartCrew (us) | Application access controls, per-organisation data isolation, secret handling, retention and deletion, responding to privacy requests |
| Your organisation | Who you invite as an administrator, the lawful basis for the volunteer data you upload, keeping credentials confidential, removing people who leave |
9. Reporting a security issue
If you believe you've found a vulnerability, email support.heartcrew@gmail.com with "SECURITY" in the subject line and enough detail to reproduce it. Please give us a reasonable opportunity to fix the issue before disclosing it publicly, and don't access or modify data that isn't yours while testing. We'll acknowledge reports within 5 business days.
10. Incidents
If a data breach occurs that is likely to result in serious harm, we will notify affected account holders and the relevant regulator without undue delay — within 72 hours of becoming aware where the GDPR applies, and in line with the Notifiable Data Breaches scheme in Australia.
11. What we don't claim
We are a small operation and we'd rather be plain about it: HeartCrew does not currently hold SOC 2, ISO 27001, HIPAA or PCI certification in its own right, and we do not offer end-to-end encryption (we can read data in the database in order to operate the Service). Anyone who tells you otherwise about us is mistaken. If your procurement process requires specific assurances, email us and we'll answer honestly.
See also our Privacy Notice and Terms of Service.