Privacy Policy

CrewBrief is operated by CrewBrief LLC ("CrewBrief," "we," "us," or "our"). This Privacy Policy explains how CrewBrief collects, uses, stores, and protects information when you use the CrewBrief platform, including our mobile application, contractor dashboard, and website (the "Service").

By using CrewBrief, you agree to the collection and use of information in accordance with this policy. If you do not agree, do not use the Service.

For personal information of workers and other individuals that a contractor causes to be collected through the Service — job records, session records, GPS snapshots, photos, and signatures — the contractor is the controller (the "business" under the CCPA/CPRA), and CrewBrief acts as the contractor's processor ("service provider"), processing that information solely on the contractor's documented instructions as expressed through the Service. Those processor obligations are set out in the CrewBrief Data Processing Agreement, incorporated into our Terms of Service for every contractor.

CrewBrief is the controller of account registration data (your name, email, phone, role, and preferences), of platform security and audit data, and of data we must process to comply with our own legal obligations.

If you are a worker and want to exercise privacy rights over records a contractor directed us to collect, you may contact us directly — we will act on the request to the extent our processor role allows and route the remainder to the contractor as controller.

We collect the following categories of information:

• Account information: name, email address, phone number, and role (contractor or worker).
• Job records: job title, scope of work, agreed rate, job address, classification selected by the contractor, and accepted terms.
• Session records: check-in and check-out timestamps, GPS coordinate snapshots, photos, and work notes.
• Approval records: contractor review actions, dispute notes, amendment justifications, and approval timestamps.
• Signature records: e-sign consent, document-text hash, optional drawn signature, and verification events.
• Device information: device type, operating system version, app version, IP address, and integrity signals such as the Android mock-location flag.
• Usage data: feature interactions and error logs (with location data and personal identifiers scrubbed from error telemetry).

CrewBrief captures a single GPS coordinate snapshot at the moment of check-in, check-out, and stop/travel boundaries — always initiated by the worker's own action. This is a point-in-time snapshot, never continuous or background location tracking. We do not monitor anyone's location between clock events.

GPS coordinates are stored as part of the session record and are included in sealed records. The GPS state is recorded as one of three values:

You may deny location permissions. If you do, your check-in will still be recorded, but the GPS state will be marked UNAVAILABLE. This is noted in the sealed record.

Photo documentation captured during sessions is stored securely and associated with the session record. Photos are used solely for job documentation — never for advertising, profiling, or any secondary purpose.

Photos may incidentally capture third parties (for example, a passerby at a job site). Workers and contractors are responsible for capturing photos lawfully; we process them only as part of the session record.

Photo retention is governed by the single retention rule stated in the Data Retention section below. Seal or export records you need before the retention window closes.

Photos are not shared with third parties except as required by law or as part of a sealed record shared by a party to that record.

CrewBrief records explicit consent events in the audit log, each timestamped and versioned:

• GPS consent: granted when you enable location for check-ins; you can revoke it in your device settings at any time.
• E-sign consent: recorded when you agree to sign documents electronically (ESIGN Act consent).
• SMS opt-in: recorded when you enroll your mobile number for text messages.
• Terms and policy acceptance: recorded against the exact document version you accepted.

CrewBrief uses SMS for operational messages only. Message types include:

• Verification codes: one-time codes to confirm your identity for sign-in and e-signing.
• Job invitations: sent when a contractor invites a worker to a job.
• Status updates: sent when a session is approved, disputed, or closed.

CrewBrief never sends marketing SMS. Message and data rates may apply; message frequency varies by job activity. Reply STOP to any message to opt out and HELP for assistance. Your opt-in and any opt-out are logged. For full program terms, see our SMS Opt-In Disclosure.

We use the information we collect to:

• Operate the CrewBrief platform and deliver core features.
• Generate GPS-documented, photo-documented, tamper-evident sealed records.
• Send operational SMS and email notifications you have opted into.
• Support contractor approval, dispute, and amendment workflows.
• Improve platform reliability, performance, and security.
• Comply with legal obligations and respond to lawful requests.

Access inside CrewBrief is strictly scoped:

• Contractors see sessions, photos, and records for their own jobs only.
• Workers see all of their own records across every contractor they work with — their records travel with them.
• Workers never see each other's rates or records.
• Contractor internal notes are never shown to workers.
• Sealed records are visible to the parties to that record; neither party can edit them.

We may share data only in the following limited circumstances:

• Service providers: vendors who help us operate the platform (listed below), contractually bound to protect your data and prohibited from using it for their own purposes.
• Legal requirements: if required by law, subpoena, court order, or lawful government request — and we will notify affected users where legally permitted.
• Business transfers: in a merger, acquisition, or sale of assets, data may transfer subject to this policy's commitments.
• With your consent: when you explicitly authorize a share.

Sealed records are controlled by the parties who hold them. Once a record is exported and shared outside the Service, its further distribution is the responsibility of the person who shared it.

CrewBrief uses a small set of infrastructure providers to run the Service. Each processes data solely on our instructions:

• Supabase — database, authentication, and file storage.
• Render — API application hosting.
• Netlify — website and dashboard hosting.
• Twilio — SMS delivery (phone numbers and message content).
• Sentry — error monitoring (personal identifiers and location data scrubbed).
• RFC 3161 timestamp authority — independent trusted timestamps for sealed records (receives record hashes only, never record content).
• Email delivery vendor — transactional email.

We keep this list current; material changes to our subprocessors will be reflected in an updated version of this policy.

We retain your data for as long as your account is active or as needed to provide the Service. Specific retention periods:

• Job and session records (text data, GPS snapshots, timestamps, signatures): retained for the life of the account and as needed for sealed records.
• Raw photos: retained for at least 30 days after upload (or per your paid tier) and deleted per the retention schedule, unless embedded in a sealed record or the session is under active objection or dispute — in which case they are retained. This is the single photo-retention rule; every other reference to photo retention in this policy and in our Terms of Service refers to this rule.
• Sealed records: retained as locked, immutable records for the parties to them, for as long as needed to preserve record integrity and to support the establishment, exercise, or defense of legal claims by either party — which, given the statutes of limitations that apply to wage, tax, and contract claims, means retention for the life of the parties' accounts and thereafter as the law permits records kept for those purposes.
• Account data: retained until account deletion is requested and processed.
• Dispute records: retained for the life of the session records they relate to.
• Consent and audit logs: retained for the life of the records they authenticate.

Configurable retention windows (such as the raw-photo period) are drawn from the same configuration the software enforces.

You may request deletion of your account at any time by contacting hello@crewbriefapp.com. Upon deletion:

• Your account profile and login credentials are permanently deleted.
• Active job records associated with your account are closed.
• Raw photos remain governed by the photo-retention rule in the Data Retention section — account deletion does not accelerate photo deletion. Photos embedded in a sealed record, photos of a session under active objection or dispute, and photos of sessions that are not yet sealed survive your account deletion and are deleted only under that rule.
• Before your deletion is processed, we will warn you, in the language of your account, that deletion is permanent for data not covered by the retention holds above, and prompt you to export or seal your records first.
• Sealed records that other parties hold survive your deletion — workers keep their own signed documents and sealed records even if a contractor's account closes, and vice versa.
• Data we must keep to satisfy legal obligations, resolve disputes, or enforce agreements is retained only as long as required.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Correction: request correction of inaccurate data. Note that sealed records are corrected by signed amendment, not by editing — the amendment mechanism preserves record integrity.
• Deletion: request deletion of your personal data, subject to the sealed-record and legal-retention exceptions described above.
• Portability: request your data in a portable format.
• Objection / restriction: object to or restrict certain processing.
• Non-discrimination: we will never retaliate against you for exercising a privacy right.

To exercise any of these rights, contact hello@crewbriefapp.com. We will verify your identity and respond within the time required by applicable law — generally within 45 days, extendable once where the law permits, in which case we will tell you why and when to expect our response. You may use an authorized agent where the law allows; if we deny a request you may appeal by replying to our decision.

California residents: under the CCPA/CPRA you have the rights to know, access, correct, delete, and port your personal information, and to opt out of sale or sharing. CrewBrief does not sell or share personal information as those terms are defined by the CCPA/CPRA, and has not done so in the preceding 12 months. We do not use or disclose sensitive personal information for purposes requiring a right to limit.

Texas residents: the Texas Data Privacy and Security Act (TDPSA) provides similar rights of access, correction, deletion, portability, and opt-out of targeted advertising, sale, and profiling. CrewBrief does not conduct targeted advertising, sale, or profiling.

Colorado, Connecticut, Virginia, and Utah residents: the Colorado Privacy Act, Connecticut Data Privacy Act, Virginia Consumer Data Protection Act, and Utah Consumer Privacy Act provide rights of access, correction (except Utah), deletion, and portability, and the right to opt out of targeted advertising, the sale of personal data, and (in Colorado, Connecticut, and Virginia) profiling in furtherance of decisions with legal or similarly significant effects. CrewBrief does not sell personal data and does not engage in targeted advertising or such profiling. Residents of Colorado, Connecticut, and Virginia may appeal a refused request by replying to our decision; if the appeal is denied, you may contact your state Attorney General.

Some states require notice before an employer records worker location. Contractors are responsible for providing any notice their state requires to their own workers; CrewBrief's in-app consent flow is designed to support, not replace, that obligation.

We protect your data with industry-standard safeguards: encryption in transit (TLS) and at rest, scoped access controls (each party sees only their own records), hash-chained tamper-evident audit logs, secrets management, and personal-data scrubbing in error telemetry. No system is perfectly secure, and we do not promise absolute security.

If a breach of security affecting your personal information occurs, we will notify affected users and regulators as required by applicable breach-notification laws, without unreasonable delay, and will tell you what happened, what data was involved, and what we are doing about it.

CrewBrief is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that a minor has provided us with personal information, we will delete it promptly.

We may update this Privacy Policy from time to time. Every published version is archived, and the "Last updated" date reflects the current version. For material changes, we will notify users via email or in-app notification before the changes take effect. Continued use of the Service after changes take effect constitutes acceptance of the updated policy. This policy may be offered in languages other than English; a non-English rendering is published only as a professionally certified translation of the English text, and the English version controls in case of any conflict or difference in interpretation, to the extent permitted by applicable law.

For privacy-related questions, data requests, or concerns: