Privacy Policy

What we collect

From business owners and team members we collect names, company and trade details, contact information, account credentials and 2-step settings, roles, billing choices, support communications and security activity. When payments are connected, a payment provider will process card or bank details; we will receive transaction information and limited identifiers such as a card fingerprint, not store full card numbers.

Companies may provide their customers’ names, phone numbers, email addresses, service addresses, job descriptions, estimates, signatures, invoices and payment records. Time-clock users may provide GPS coordinates and accuracy at a punch; denied location is recorded without coordinates. Future AI phone answering may process calls, recordings, transcripts and booking information where legally permitted and disclosed. We also receive device/request information and essential session storage needed to sign in and protect the service.

Our waitlist collects your name, shop, trade, team size, mobile, email, city, state, current software, founding interest and consent to contact you. Abuse controls store only a hashed IP, not the raw IP, in their rate-limit records. Limited IP information may separately appear in restricted security audits.

How we use information

We use information to operate accounts, schedule jobs, prepare estimates and invoices, record time and payments, answer support requests, prevent abuse and provide requested communications. Waitlist details let us contact you before launch and manage founding interest; joining is not a payment authorization or contract. You can withdraw contact consent by emailing us. Your company controls its customer records and instructs us how to process them; CrewMaster Pro processes those records on its behalf.

No sale and no AI training

We never sell personal information or customer data, and we do not share it for cross-context behavioral advertising. AI never trains on customer data. Providers may process the minimum information needed to answer a call or perform another requested task under restrictions against using that data to train their models. Provider terms and safeguards must be verified before AI calling is launched.

Service providers and other disclosures

We use or plan to use providers for hosting and storage, authentication, payments, texting, email, AI phone answering, monitoring and support. They receive only information needed for their services and must protect it under appropriate agreements. Payments, texting and AI calling are not all connected yet. We may also disclose information when required by law, to protect safety or legal rights, or as part of a business transfer with continuing privacy protections. We do not make customer records public; customer links are restricted to the specific document and expire or can be revoked.

Security and access

We use encryption in transit and at rest, required 2-step login, company-separated records and access permissions. Internal costs, private customer contacts and location records are restricted according to company permissions. Team-console access is separate from company accounts. We retain audit histories to investigate changes and protect records. These controls reduce risk but cannot guarantee perfect security; keep login details private and report suspicious access.

Retention and export

We keep active-company data for the subscription and as needed to provide service. Non-payment never triggers data deletion: after seven days unpaid, sign-in, viewing and export remain available in read-only mode. Companies can export their data any time. After account closure or a valid deletion instruction, we delete or de-identify data when no longer needed, except records required for legal, tax, security or dispute purposes. Backups may retain copies until their normal rotation ends, with access restricted.

Rate-limit rows older than seven days are removed during limit checks. We keep waitlist information until launch follow-up is complete or you ask us to remove it, unless a legal obligation requires retention. Exact post-closure and backup retention schedules, and provider-specific retention periods, will be confirmed in the final policy before launch; they are not invented in this draft.

California privacy rights

Where the CCPA/CPRA applies, California residents may request access to and a copy of personal information, learn the categories, sources, purposes and recipients, correct inaccurate information, and request deletion subject to lawful exceptions. You may opt out of sale or sharing and limit certain uses of sensitive personal information where applicable. We do not sell or share for behavioral advertising, and sensitive information is used only for permitted service and security purposes. We do not discriminate against people exercising privacy rights and honor legally required opt-out preference signals where applicable.

Email privacy@crewmasterpro.com with your request. We will verify identity using proportionate information and respond within applicable legal deadlines, ordinarily 45 days for access or deletion, with notice of any permitted extension. Authorized agents may submit requests with proof of authorization. Please do not email passwords, full card numbers or unnecessary sensitive data.

If you are a customer of a trade company using CrewMaster Pro, contact that company first: it controls your service records. We will help it respond and direct misaddressed requests to the appropriate company where lawful. Team members can contact their employer about company-controlled time or job records.

Children, changes and contacts

CrewMaster Pro is for businesses and adult account holders, not children. We do not knowingly collect personal information from children under 16 for our own purposes. Contact us about improperly provided information. Material policy changes will be communicated before taking effect where required, and this page will show the updated date.

Privacy requests: privacy@crewmasterpro.com. Legal notices: legal@crewmasterpro.com. These are the designated contact addresses; mailbox delivery and final legal details must be confirmed before launch.