Privacy Policy.

Crewsteer collects only what we need to run your trade business: your account info (name, email, phone), your customers' info (the same fields, plus addresses), job and invoice records, device info (so push notifications work), and your live location (only while a tech is clocked in on a job).

We do not collect: contact lists from your phone, photos that aren't attached to a job, any biometric data, your browsing history outside Crewsteer, or the contents of conversations on other apps.

Your data is used only to operate Crewsteer for you: scheduling jobs, sending invoices, tracking AR, syncing with QuickBooks/Stripe/etc., and generating your reports. We send transactional emails and texts (job confirmations, receipts, reminders) on behalf of your business to your customers, never to ours.

We do not sell your data. We do not advertise to you. We do not train ML models on your data.

Customer data sits in Supabase Postgres in us-east-1, encrypted at rest. App traffic is served from Vercel's edge. Backups run nightly with 7-day point-in-time recovery. The full vendor list:

• Supabase, primary database, auth, storage
• Vercel, application hosting + edge cache
• Stripe, payment processing (PCI Level 1; we never see card data)
• Telnyx / Twilio, SMS delivery
• Resend, transactional email
• Inngest, background jobs + webhooks
• Plaid, bank-account connections (only if you connect a bank)
• Sentry, error tracking (no payload data, just stack traces)
• Apple / Google, push notifications

Inside your company, only the team members you invite, gated by Postgres Row Level Security so a tech can't read another company's data even if they tried. Inside Crewsteer, only support engineers responding to a ticket you opened, and only with your explicit consent recorded in our audit trail.

We will never share your customer list, financial records, or tech locations with anyone except in response to a valid legal request, and we'll fight overbroad requests in court.

You can export your data anytime (Settings → Export → Full backup, or any list page's CSV button). You can delete your company by emailing us and we'll wipe it within 30 days. EU residents can exercise GDPR rights (access, rectification, erasure, portability, objection) via the same email.

We retain audit logs for 365 days for fraud/security investigations even after deletion. Financial records may be retained longer where US tax law requires (typically 7 years).

We use cookies for two things: (1) keeping you signed in, and (2) Vercel's anonymous web analytics (page views, no personal data). No third-party ad tracking.

Crewsteer is not directed at kids under 16 and we don't knowingly collect data from them.

If we change this policy in a way that affects your data, we'll email every account owner at least 30 days before the change takes effect.

Privacy questions: privacy@crewsteer.com
Anything else: hello@crewsteer.com