Privacy Policy

This is a summary to help you read the rest. The numbered sections are the policy.

• CrewLog is construction-management software run from Ontario, Canada, for companies in Canada and the United States.
• We collect what you give us (your account, your jobs, reports, photos, voice notes, crew hours, documents) and a little technical information to run and secure the Service.
• Your voice notes, report text, documents and questions are processed by two AI companies, Anthropic and OpenAI, to deliver the AI features. Site photos and videos are never sent to them.
• We never sell your information, never use it for advertising, and never train AI models on it.
• Your account and content are stored in Canada. Several of our providers process it in the United States.
• The time clock records where a shift started and ended (three points, only while the app is open). Your employer turns it on and decides whether it is required.
• Information about your crew and clients is collected by your company, not by us; we process it for your company as its service provider.
• You can see, correct, export and delete your information. Deleting your account is immediate and permanent.
• We use one cookieless page-view counter and first-party cookies only. No ads, no tracking, no session replay.
• This policy is published in English and the English version governs. A French or Spanish translation is available on request: email us.

CrewLog Technologies Inc. (“CrewLog”, “we”, “us”) is an Ontario corporation that provides software for running construction jobs. This Privacy Policy explains what personal information we collect, how we use and share it, where it is kept, and the choices and rights you have. It applies to crewlog.ai and the CrewLog apps (the “Service”).

Where CrewLog is offered. CrewLog is offered in, and intended for, Canada and the United States only. This policy is written for the privacy laws that apply to us: Canada’s federal PIPEDA, Quebec’s Law 25, and, for our U.S. users, state privacy laws such as California’s CCPA/CPRA, whose rights we give to everyone in the United States whether or not a business our size is covered. Section 16 explains what that means if you are in Europe.

Three kinds of people read this policy, and the rules differ a little for each:

• Account holders and their teams: the company that signed up, and the people it invited. For your own account information (your name, email, login, billing), CrewLog decides how it is used, and this policy is our notice to you.
• People your company records: crew whose hours are logged, workers who sign a safety talk, clients whose jobs are documented. Your company decided to collect that information and is responsible for it. We process it on the company’s behalf, as its service provider, under the commitments in our Terms of Service. Section 13 says who to contact.
• People outside CrewLog who receive a link: a client who accepts a quote or signs a change order, an architect who answers an RFI or returns a submittal, anyone who opens a shared report. Section 2 says what we collect from you and Section 13 says how to reach us.

Language. Parts of CrewLog are available in French and Spanish, but this policy and our Terms of Service are published in English, and the English version governs. A French or Spanish translation is available on request, for information.

This policy is a notice about how we handle information: it is not a contract. Your agreement with us is our Terms of Service. If anything here is unclear, contact us; details are in the last section.

Account information. When you create an account we collect your name, email address and password (stored only in hashed form by our authentication provider), an optional company name, and, if you add them, a profile photo, a drawn signature, your country and state or province, and your company logo. If you own the account and gave us your mobile number when the first-job setup screen asked for one (it no longer does), we use it only to call or text you about setting up and using your account. It is never shown to your crew, never sold and never used for advertising. Reply STOP to any text and we will not text you again, and you can ask us to delete the number at any time.

Sign in with Google or Apple. If you sign in with Google, Google confirms your identity to our authentication provider and passes us your name, email address and profile picture. If you sign in with Apple, Apple passes us your name and an email address. We never receive your Google or Apple password. Apple lets you hide your real address, in which case what we receive is a private relay address ending in privaterelay.appleid.com. That relay address is then the only address we have: it is what we store, what we send your reports and notifications to, and what Apple forwards to your real inbox. You can stop that forwarding at any time in your Apple Account settings; if you do, our email to you stops arriving, and we cannot recover your account by your real address because we have never seen it.

Content you create. We collect the content you put into the Service: daily report notes, voice recordings (see Section 4 for how briefly), AI-generated reports, the companies and headcounts you record on site, site photos and videos and their captions, job and client details, safety and toolbox-talk records and the per-attendee signatures on them, your own toolbox talks and handouts, meeting minutes and the files attached to them, workplace incident records (including who was involved, the part of the body, the type of injury and what happened), corrective actions, tasks, schedule and forecast plans, the crews you create and who is in them, where each crew is scheduled to work each day, crew time entries and hours, the shifts your crew clock in and out of and the append-only log of every correction a manager makes to one, cost codes on hours, wage and pay-rate information, who reports to whom and each person’s access settings, time-off requests, material delivery records, change-order details and amounts, contract schedules of values and progress bills, job cost and expense entries and the receipt images you upload, plans, drawings and documents you upload and the markup you draw on them, requests for information (RFIs), submittals and their revisions, the layout you give a report, change order, quote or invoice in the document editor, the document styles an owner or admin saves for the account (including any words kept on every new document), the messages and files you send to the AI Construction Assistant, and the contacts you add. If you use the Service offline, some of this is stored on your device until it syncs to our servers.

Spreadsheets you import. If you import jobs or other records from a spreadsheet, the file is read on your device and only the columns you map are sent to us. We store the file’s name and a fingerprint (hash) of it with the import, so the same file is not imported twice and an import can be undone for 24 hours. The file itself is not uploaded and is not sent to an AI provider.

Information from people outside your account. Some features work by sending someone a link they can use without logging in. Here is what we collect from each:

• Signing a change order. The name given, the signature drawn or typed, the date and time, and the internet (IP) address and browser user-agent string the signature was submitted from: a technical record of how and when it arrived, shown to the contractor on the change order. The page tells the signer this is recorded. We also keep a copy of the change order’s words and price exactly as shown, with a fingerprint of that copy, and, if the contractor put the client’s email on the change order, we email the client a copy of what they signed. If the contractor replaces a change order with a new version, the old link stays readable and names the version that replaced it.
• Accepting or declining a quote. The name typed, an email address if given, which optional items were selected, whether it was accepted or declined and any reason written, the date and time, and, on an acceptance, the IP address and browser user-agent string it came from, shown to the contractor. We also record when the link was first opened; we cannot tell who opened it, only that someone holding the link did.
• Answering an RFI. The name given and the answer. No IP address is stored.
• Returning a submittal. The reviewer’s name, the status chosen and the notes written, with the date and time. No IP address is stored, and the reviewer cannot upload files.
• Opening a shared report or invoice. Nothing beyond the ordinary server and page-view information described below.
• Being named in meeting minutes. Minutes name the people at a meeting, many of whom are not on the account (an owner’s representative, an architect, a subcontractor). We store the name, company and, if entered, the email address for each, what the minutes say about them, and the minutes emailed to them. The email addresses are never printed on the minutes or shown to a client. If the meeting was recorded for AI minutes, their voice is in the recording (Section 4).

If you contact us or book a demo. Our contact and demo-request forms collect what you type: your name, email and, on the demo form, your company and crew size, what you want the call to cover and when, plus any message. We use it to reply to you and to arrange the demo. It is emailed to our team and also posted to our own internal team chat so someone sees it quickly; both providers are named in Section 6.

Payment information. When you start a free trial, subscribe or make a one-time purchase, our payment processor (Stripe) collects and processes your payment details on its own systems. Starting a free trial requires a valid card, which Stripe checks with a $0 authorization. We never see, receive or store your card number, expiry or security code: not even the last four digits. What we keep is the Stripe customer and subscription identifiers, your plan, your billing interval, your subscription status and your trial end date. To see or change your card you go to Stripe’s own billing portal, linked from your settings.

If you buy inside the iPhone or Android app. Anything bought in the app is processed by Apple or Google on their own systems, under their own privacy policies. We see even less than with Stripe: no card details, and no customer record we could use to look you up with them. What reaches us is confirmation of what was bought, passed on by RevenueCat, which checks that the store’s receipt is genuine and tells our servers which plan or AI usage pack to apply. RevenueCat receives a random identifier we generate for your account, not your name or email, along with the product and the store’s transaction record. It receives that identifier as soon as the in-app plan screen opens, because that is when the app connects to RevenueCat to load the store’s prices, so it reaches RevenueCat (with basic technical details such as the app version and your phone’s operating system) even if you buy nothing.

Trial-abuse records. The free trial is one per person, so we keep two small records to enforce that. We store a one-way SHA-256 hash of the email address (not the address itself) so the same address cannot claim a second free trial. It is written when an account that has had a trial or paid is deleted, and also at sign-in if we find that a trial has already been used on that device. And we set a browser flag (cl_tr, described in Section 7) recording that a trial has been seen on that device. Neither is used for anything else.

Who you email from CrewLog. When CrewLog emails anyone on your behalf (a daily report, an owner update, a quote, an invoice, a change order, an RFI, a submittal, meeting minutes, a team invitation, or a missed-punch request to the person who approves it), we record each recipient’s email address against your account, with when we first and last mailed it, what kind of send it was, and which record it related to. This is anti-abuse infrastructure, not a marketing list: it is how we cap how many different addresses one account can mail in a day, which is what stops CrewLog being used to send spam from our domain. It is stored in our own database, it is not readable from the browser by anyone including you, we never mail these addresses ourselves, and we never sell, rent or share them. These are addresses of people who did not sign up for CrewLog (you chose to email them), so please read “Information about other people” below. Retention is in Section 9. We keep a similar record of the billing and follow-up notices we send, so a notice is never sent twice.

Work saved on your own device. So you do not lose what you are typing when you switch tabs or lose signal, CrewLog saves work in progress in your browser’s own storage on your device. That covers text you are part-way through (report notes, safety-talk notes and attendee lists, incident descriptions, immediate actions and root causes, corrective actions, change-order notes and documents, RFI questions and answers, owner updates, schedule-phase notes, job instructions, email messages, and what you type to the Assistant) and, for the report form, the photos and voice recording on a report you have not submitted. Some of this is health-adjacent: an incident description can say who was hurt and how. This never leaves your device until you save or send. Each saved item is keyed to the signed-in user, so one person’s draft is not shown to the next person on a shared tablet; if we cannot tell who is signed in, nothing is saved and nothing is restored. Text drafts expire after 7 days, and signing out wipes them all, along with the saved photos and voice recording. Clearing your browser’s site data removes them too. Reports you queued while offline are the deliberate exception: they survive sign-out so they can still be sent by the person who captured them. Clock-ins and clock-outs made with no signal are kept on the device the same way, with their time and (if location is on) their position, until they reach us.

Pages saved for offline use. So the app works with no signal, it keeps a copy of the pages you open (your jobs and job pages, the schedule, tasks, timesheets, change orders and similar) and some of the account information those pages show, on your device. While you have a connection, including on mobile data, it also saves the main tabs and the pages of your active jobs ahead of time. Saved pages belong to the person signed in: they are never shown to someone else who signs in on the same device, they are deleted when you sign out and when your session ends, and their total size is capped. A page with pay, prices or costs on it is never saved on the device: pay rates and wages, job costing, invoices and insights, and, for anyone who can see money, the job page, the dashboard, change orders and work history. Settings and the Assistant are never saved either.

Actions taken with no signal. Ticking or adding a task, marking a delivery received, signing a toolbox talk, reporting a safety incident, requesting time off and asking for a missed punch are saved on the device, with who did them, until they reach us. Like queued reports, they survive sign-out so they can still be sent by the person who captured them, they are only ever sent for that person and that account, and they can be discarded in the app.

A meeting recorded or uploaded for AI minutes is kept on the device in its own browser storage, in parts of a few minutes each. Each part’s audio stays there only until its text comes back from transcription and is then deleted; the text, and the AI draft of the minutes, stay until you add the draft to the minutes or discard it. Unlike text drafts these do not expire after 7 days, so a recording made with no signal can wait for one. Signing out wipes them all.

Phone notifications and the home-screen widget. If you choose to get your report reminder on your phone, the CrewLog app asks your phone for a notification token (from Apple on an iPhone or iPad, from Google’s Firebase Cloud Messaging on Android) and sends it to us so the reminder can reach that phone. We store the token with your account, the kind of phone, the language its notifications are written in, and when it was added and last used, for up to eight phones per person. We use it only to send the notifications you turned on, and delete it when you sign out of the app on that phone, when you remove the phone in Settings, when you reset your password or sign out your other phones, or when Apple or Google tell us it no longer works. A notification’s text is what you see on the lock screen: a report reminder names the jobs still waiting for today’s report. If you add the CrewLog widget to your home screen, the app gives it its own key, which we store only in scrambled (hashed) form and which can read nothing but the summary the widget shows; signing out cancels it, and it stops working after 60 days unused.

Usage and device information. We use exactly one usage-measurement tool: Vercel Web Analytics, built into our hosting provider. It counts page views across the whole site: the public pages, the app once you log in, and pages opened from a share link. It sets no cookies, stores nothing on your device, does not follow you to other websites, and does not build a profile of you. Visits are identified only by a temporary value our hosting provider works out from the incoming request, which it rotates daily. What we see is the page, the time, the page you came from, your browser, operating system and device type, and a rough location (country or region) estimated from your IP address. Pages are counted by their address, and the address of a page opened from a share link (a report, quote, invoice, change order, RFI or submittal link) includes the secret part of that link, so the full share link is sent to Vercel and kept in our analytics data there, which only we and Vercel can see.

Server and sign-in logs. Like any website, our hosting provider logs technical details of each request (IP address, browser user-agent, the time and the page requested), and our login provider records similar details for sign-ins and sessions. We use these only for security and troubleshooting. If our contact or demo form is ever flooded and a genuine message cannot be emailed to us, what was typed into it is written to our server log instead, so we can still reply.

Error reports. When something in CrewLog breaks (a page that fails to load, a save that errors on our side), we record a short technical report of it in our own database: what failed and where (the kind of page, not its exact address), the error message, which kind of device, browser or CrewLog app it happened in, the app version, and, if you were signed in, your user ID, so we can tell how many people an error affects (up to 25 per distinct error). Before a report is stored, email addresses, phone numbers, access tokens, the private parts of links (such as share codes) and the values a database error quotes back are taken out of it. The full browser user-agent string and your IP address are not stored. A report is built from the error itself, not from your reports, photos or forms, though an error’s own message can occasionally include a word or name from what it was working on. We use error reports only to find and fix problems. New errors are emailed to our own support inbox, and may be posted to our own internal team chat with no account identified, and each report is deleted once that error has not happened again for 90 days.

That is the only third-party measurement in CrewLog. We do not use session recording, session replay or heatmaps: there is no tool in CrewLog that plays back how an individual moved through the app. We do not use any advertising, retargeting or cross-site tracking technology, and we do not use event, funnel or cohort analytics products (we removed the one we had tried, so this stays true).

AI usage records. Every plan includes a monthly AI allowance shared across an account, so we have to count what gets used. Each time an AI feature runs we record what kind of action it was, when, how much of the allowance it consumed, the account, and which member made the request. We record the measurement, not the content: these entries do not contain your notes, your messages or the AI’s answer. Because they are what the allowance is counted from, they are kept as a running ledger and are not removed when you delete an Assistant conversation or a report. The account owner can see how much of the allowance each member has used, so they can divide it up: see the note below about your responsibilities as an employer.

Location information. Several things in CrewLog touch location, and they work differently. Read the first one first: the time clock is the only feature in CrewLog that records where a person is and sends it to us.

• Clocking in and out on the time clock. If your employer uses CrewLog’s time clock, we take a location fix when you clock in, when you clock out, and about every three minutes while a shift is running and you have the app open on screen, and we store it on that shift with its accuracy. Exactly three points are kept per shift: where it started, where it ended, and the most recent one while it was running. The most recent one is overwritten each time it refreshes, so there is no trail, no route and no history of where you went between those points. Nothing is collected while the app is closed or in the background, or while your phone is locked. The apps ask for “while using the app” location only; they have no background-location permission and we are not adding one. We also store how far the clock-in was from the job site, so a clock-in a long way from the job (500 metres by default, which your employer can change) can be flagged for someone to check. It is used for tying a work session to a place and for that flag, never for advertising, and it is never sold. Who can see it: your employer (the account owner and the admins who approve your hours) and you, on your own shifts. Approving your hours is what grants the view, and who approves them is set by your employer’s reporting chain: an admin sees the shifts of the people whose hours go to them, not the whole crew’s. Nobody outside your account. Location is set one worker at a time, by the account owner: off, standard (a fix is taken if the phone gives one, and clocking in works either way) or required (clocking in is refused until the phone gives a fix). The account owner can also switch location off for the whole account. On standard or off you can deny your phone’s location permission and still clock in and out normally, showing as “location off” on your employer’s board. On “required” you cannot: the clock-in is refused, and you would need to speak to your employer, who chose that setting. Clocking out is never refused. It is kept for as long as the shift and its timesheet are (Section 9). Because this is monitoring of employees, please read “If you record your crew’s hours, wages or locations” below.
• Photos. Most phone cameras save GPS coordinates inside the photo file. When you upload a site photo that carries them, we read them and store them with the photo so the Field Map can drop a pin where it was taken, unless the account owner has switched location off for the whole account or for the person uploading. These coordinates are precise: they show where the person holding the phone was standing. Everyone on the account who can see that job’s photos sees the pins, including a client the owner has given access to; the team also sees who took each photo, a client does not. Photos taken without location data are stored with no coordinates. If you do not want coordinates collected, turn off location tagging in your phone’s camera settings. The coordinates can also travel inside the photo file itself. Photos added to a job’s photo gallery are stored as the original file, with the location and camera details still inside it, even when location is switched off for the account or for you: we do not store a pin, but the location inside the file stays in it. Photos attached to a daily report are normally re-saved without that information before upload, but if your browser cannot process the file (common with HEIC photos on a computer) the original is uploaded as it is, and the location inside it goes wherever that report goes, including a share link or an emailed report.
• Job addresses. When you enter a job address, or import jobs from a spreadsheet, we send the address to a mapping service to turn it into map coordinates so the job appears on the map. A job address is often someone’s home (a client’s, or your own), so we treat it as personal information, and only the address text is sent: no names and nothing else from your account. While you type an address, what you type is sent from your browser to an address-lookup service to suggest matches.
• Your own position on the Field Map. If you tap the “My location” button on the map, your browser asks your permission and then reports your position (precisely, and continuously while the map is open) so the map can show where you are and measure a route. This happens between your device and the map in your browser: we do not send it to our servers and we do not store it. That is true of the map button only; the time clock above does send and store its three points. Denying or revoking the browser permission turns it off.
• Who is on site. A job’s pin on the Field Map shows the profile pictures (or initials) of whoever is clocked in on that job right now, to the people who approve their hours. It shows the job’s position, not the worker’s: no time-clock location is used for it.
• The map itself. The street map is drawn from map data and lettering your browser fetches directly from a mapping provider, so that provider sees your IP address and roughly which part of the map you are looking at. It is named in Section 6.
• Satellite view, terrain and radar. When you switch the map to satellite, the aerial photographs are fetched by our servers, not by your device, so the imagery providers never see your IP address or anything else about you: they receive only a request for a numbered square of the map. The same is true of the optional terrain layer’s elevation data and the optional rain radar.
• Directions. If you tap Directions, we hand the job’s address or coordinates to Google Maps or Apple Maps in the link; from there their own privacy policy applies.

Invoices you send your clients. When you invoice a client through CrewLog we store the invoice and everything on it: your client’s name, email address and billing address, the job, its line items, your tax registration number, any holdback, and whether you have marked it paid. Sending it emails a link and a PDF to the address you entered. That link has no expiry and cannot be revoked: anyone holding it can open that invoice, and a sent invoice cannot be deleted, because it is a financial record. Treat the link the way you would treat the invoice itself.

Information about other people. Content you submit may include personal information about other individuals: your clients, crew, subcontractors, outside reviewers, or anyone named or shown in reports, photos and toolbox talks. For that information, you decide what to collect and why, and we process it on your behalf to provide the Service. You are responsible for having the authority and any consents needed to give it to us and for honouring those individuals’ privacy rights. If an individual contacts us about information you submitted about them, we may refer them to you as the party responsible for it.

If you record your crew’s hours, wages or locations. Timesheets, pay rates, cost codes on hours, worker photos, photo GPS coordinates, safety-talk signatures, injury details, crew assignments (which named people are in a crew and which job that crew is sent to on a given day), where each shift was clocked in and out and where the worker last was while it was running, and the per-member AI usage figures above are information about your employees, and you are the one deciding to collect it. Telling your workers what you collect and why is your job as their employer, not ours. Some places require it in writing: Ontario requires employers with 25 or more employees to have a written electronic-monitoring policy, and Alberta and British Columbia require notice before collecting employee information. Using CrewLog does not satisfy those obligations for you.

Who on your account sees pay is your decision. Pay rates, labour burden and each person’s labour cost are shown only to the account owner and to the people the owner turns “See pay” on for, and they see them for everyone on the account; approving someone’s hours does not show their pay. The owner also sets who reports to whom, which decides who approves, and sees, each person’s hours and shifts. We process this wage and hours information for the employer, as their service provider, and apply the settings they choose.

The time clock is electronic monitoring, and switching it on is your decision. Location on the time clock is on by default and the account owner can switch it off for the whole account in settings. If you leave it on, your crew’s clock-in and clock-out positions are collected and you can see them: that is the feature working as intended, and it is the kind of collection an electronic-monitoring policy has to describe. We will not tell your workers on your behalf, and CrewLog is not a substitute for the notice or written policy your law requires. Location is set per worker as well as per account: off, standard or required. On standard or off a worker can decline the phone permission and the clock keeps working for them without a position. On “required” it does not: the clock-in is refused without a fix. Choosing “required” for someone is a decision to compel the collection, and it is the kind of thing an electronic-monitoring policy has to say out loud.

We use your information to: provide, operate and maintain the Service; generate AI-powered reports and drafts from your notes; deliver reports and documents to recipients you choose; process payments and manage subscriptions; provide customer support; secure the Service and prevent fraud or abuse; understand and improve how the Service is used, including looking at account-level activity (such as how recently an account was used and how many reports it has filed) to spot accounts that may need help; and communicate with you about your account, security, billing and changes to the Service.

Emails we send you. The emails you get from us about your own account (report reminders, morning briefs, weekly digests, change-order follow-ups, trial and renewal notices, invitations, security notices) are part of the Service. Reminders, briefs, digests and follow-ups each carry an unsubscribe link and can be switched off in Settings; billing and security notices cannot, because you need them. We do not send marketing email. If we ever start, we will ask for your consent first, as Canada’s anti-spam law requires, and every such email will have a way to unsubscribe.

Consent and other grounds. We collect and use your information with your consent, which you give by signing up and using the features you choose, and which you can withdraw (Section 13). Some uses rest on something else: keeping billing and tax records (a legal obligation), preventing trial abuse and spam (our legitimate interest in protecting the Service), and processing your crew’s and clients’ information (your company’s instructions). Where we rely on consent for something new, we will ask.

We do not sell your personal information and we do not share it for advertising. We do not use your content to train any AI model. We build no models, we run no training, and we do not hand your content to anyone for that purpose. That part is entirely within our control and we can promise it outright. Our AI providers, Anthropic and OpenAI, both state in the standard commercial API terms we use them under that they do not train their models on data submitted through the API. That is their commitment rather than ours, so we describe it as what their terms say, not as something we can independently guarantee. If either provider changed that, we would tell you before it took effect (Section 19).

CrewLog uses third-party artificial-intelligence services to power core features. Specifically:

• Voice recordings you make (on a report, a change order, in the Assistant, or of a meeting for AI minutes), and audio files you upload to be turned into minutes, are sent as audio to OpenAI for transcription into text. A meeting goes in parts of a few minutes each, each with the last few words of the part before so the text joins up. The recording is used for that and nothing else, and we do not keep it: once it has been turned into text, only the text is saved. A long recording is first uploaded to our file storage (Supabase) so it can be sent in full; that stored copy is deleted as soon as its text is saved, and any copy left behind (for example after a failed transcription) is deleted automatically within about three days. A recording in an unsent draft, a report queued offline, or a meeting part still waiting for its text stays on your own device until it is sent (Section 2).
• Daily reports. Your report notes and transcripts are sent to Anthropic to write the report and to flag items such as delays, deliveries and safety events. To keep a report consistent with the day before, we also send yesterday’s report, your open tasks and RFIs, your scheduled phases, the job and client name, the weather, and the names of crew who clocked in that day. A report that mentions a safety event or a change order may be written by a different Anthropic model than other reports; if that model declines, the usual one writes it.
• Meeting minutes. To draft minutes, the transcript (or the notes you paste) is sent to Anthropic with the meeting’s context: the series, number, date and job; the agenda; the open items’ titles, notes and owners; and the names and companies of the attendees and, depending on your access, of the job’s contacts and your team. Never their email addresses or phone numbers. Neither the transcript nor the draft is stored on our servers: the draft is shown to you to review, and only the changes you accept become part of the minutes. Once minutes are issued, you can ask for a short “Summary for the owner”: the issued minutes (names and companies, never email addresses) are sent to Anthropic to write it, and the summary you keep is saved on the issued minutes, printed on their PDF, offered for the email when you send them, and shown to everyone on your account who can read issued minutes, which can include a client.
• Your job information (such as report text, change-order and cost figures, safety records and schedule data) may be sent to Anthropic to draft change orders and RFIs, write cost briefings and owner updates (including a plain-language read of a job’s health), and forecast schedule risk. A change order also sends the site address and the client contact name; your internal cost and margin are deliberately withheld from it.
• Receipt and expense images you upload for job costing are sent to Anthropic as images to read the vendor, date, total, tax, a category and a short description. It does not itemise the receipt line by line.
• Translation. When a teammate views typed crew content (reports, notes, safety talks, tasks, photo captions) in a language other than the one it was written in, that text is sent to Anthropic to translate it, and the translation is cached: see “About the translation cache” below.
• Read-aloud. The text you ask to have read aloud is sent to OpenAI to make the voice: see “About read-aloud” below.
• The AI Construction Assistant: your messages, the files you attach, the country and state or province you set, and whatever it looks up in your account are sent to Anthropic to generate answers. See “What the Assistant sends” below.
• Our own internal reporting. We use Anthropic to write a short summary of how CrewLog is being used, for our own dashboard. It is sent account-level figures (such as plan and subscription status, how many reports were filed in the last 30 days, and how long since an account was last used) and, for the few accounts using CrewLog least, a health score we work out from that activity together with the account’s company name, or the owner’s email address where no company name is set. None of the content in your account is included.

Your site photos and videos are never sent to an AI provider. This is worth stating plainly, because it is the thing people ask about most. When CrewLog writes a daily report it is told how many photos are attached and nothing more. There is no photo captioning, photo analysis or facial recognition anywhere in CrewLog. Only two things send an actual image out: a receipt you upload for expense scanning, and an image or document you deliberately attach to an Assistant message. Everything else the AI knows about a photo is the caption you typed.

What the Assistant sends. The Assistant can look things up in your own account to answer a question about your jobs, and what it finds is sent to Anthropic as part of writing the answer. Depending on what you ask and what your role and permissions allow, that can include your job names, statuses and addresses, tasks and who they are assigned to, open RFIs, the text of your daily reports, photo captions, schedule phases, change orders with their amounts and client contact names, job budgets, costs and margins, safety incidents including the free-text description of what happened and who was hurt, deliveries, and crew hours by person and by job.

It can also look up your crew. If you ask about a person (“what is Mike working on?”) the Assistant looks them up in your team list and sends what it finds to Anthropic. For anyone on the account that means the person’s name, role and status. If the person asking is the account owner or an admin, it also includes that teammate’s email address, when they were invited and joined, and, for a small number of matches, the jobs they are on, their open and overdue tasks, and how recently they filed reports. It never sends an individual’s pay rate or wages (that is deliberately walled off), though crew hours can be sent if you ask about hours, and an owner or admin who can see job costs can be shown a job’s total labour cost. If your crew’s names and work emails being processed by an AI provider is a problem for you, that is a reason to tell them about it (see “If you record your crew’s hours, wages or locations” in Section 2).

A short list of your jobs is included with every message so the Assistant knows what you are talking about. Your recent messages in the same conversation are sent again with each new message so it can follow the thread. Files you attach (photos, PDFs, spreadsheets, Word documents, CSVs, up to ten per question) are stored with that conversation and sent to the provider again with each later question in it, so you can keep asking about the same drawing. Spreadsheets and charts the Assistant builds for you are stored the same way. Deleting the conversation deletes its files, and deleting your account deletes all of them. Your Assistant conversations are stored in your account so you can refer back to them, and you can delete them at any time, though the usage measurements described in Section 2 remain. When the Assistant searches the web, the request carries your country, state or province and time zone so results fit where you are; it carries no name, email or account identifier.

The Assistant does not change anything on its own. When it proposes a task, a report draft, a schedule change, a safety talk, a change order, an RFI, an invoice draft or an email to your client, it produces a draft and shows you exactly what would be written before anything happens. Nothing is saved and nothing is sent until you confirm it. When you confirm, the same rules that apply everywhere else in CrewLog are checked again: your plan, your role, your job access, and the feature permissions your account owner set.

About the translation cache. To avoid paying to translate the same sentence twice, a translated piece of text is stored in a cache. The cache is kept per account: each entry is found by a one-way fingerprint (a SHA-256 hash) of your account together with the original text, so a translation made in your account is only ever reused inside your account and is never shown to anyone else. The translated text itself is stored in readable form. Cached translations are kept while your account is active and are deleted when you delete your account.

About the AI providers. We use two established AI companies, and only two. Anthropic (Claude) handles written reports, change orders, RFIs, meeting minutes and owner summaries, cost briefings, owner updates, job-health narration, schedule forecasts, receipt reading, translation, the AI Assistant, and our own internal reporting described above. When the Assistant looks something up on the public web (a code edition, a permit rule, a supplier’s price) or opens a link you paste, the search or page request is made by Anthropic, which may use a third-party search provider to run it; your device does not contact those sites. What goes into a search is the general question, such as a product and a town: the Assistant is instructed never to put names, addresses, or client or job details into a search, so avoid typing anything into a question that you would not want searched. OpenAI handles voice transcription, including meeting recordings, and the read-aloud voice. Nothing else goes to them. We do not attach your name, email address or user ID to a request as an identifier; what can be inside the content itself is described above. Both are used under their standard commercial API terms, which state that they do not train their models on data submitted through the API (see Section 3 for exactly how far that promise goes). Each keeps what is sent to it for a limited period, generally up to 30 days under those standard terms, to detect misuse of its own service, and can keep something longer if it is flagged for misuse or the law requires it; each provider’s own policy has the detail. Both process data in the United States. If we change AI providers, we will update this policy and tell you before the change takes effect.

About read-aloud. On any device with a connection, read-aloud uses a natural voice made by OpenAI: the text you asked to have read (a daily report, its voice transcript, or an Assistant answer) is sent to our server in short pieces and on to OpenAI, which returns the audio. Each read counts toward your account’s AI allowance (Section 2). If the voice is unavailable or the allowance is used up, your device’s own voice reads the text instead, and with no connection that is the only voice used, so nothing leaves your device. The audio that comes back is kept in the app’s storage on that device so the same text is not sent twice. It is not removed when you sign out; it is removed when the app updates itself, and clearing the app’s or browser’s site data removes it too. If you would rather the text never left your device, do not use read-aloud.

Recording a meeting records everyone in it. A meeting recording captures the voice of everyone who speaks, including people who are not on your CrewLog account. Before the microphone starts, CrewLog asks the person recording to tell everyone at the meeting and to stop if anyone objects. Telling people and getting any consent the law requires is the responsibility of the customer who records, as our Terms of Service set out. We do not identify speakers: the transcript does not say who said what, and we create no voiceprints. If you were at a meeting recorded in CrewLog and have a question about it, ask the company that ran the meeting first (Section 13).

We process your content this way because it is what you signed up for: AI is part of what CrewLog does. If you would rather not have content processed by AI, do not use the voice-recording, AI-report, AI meeting minutes, translation, read-aloud, receipt-scanning or AI Assistant features. The rest of CrewLog works without them, and daily reports, change orders and meeting minutes can all be written by hand.

Some CrewLog features produce a rating or a prediction: a job’s health status, a schedule-risk forecast, a flagged safety item, a draft of meeting minutes, a clock-in flagged as far from the job. These are suggestions for a person to look at, not decisions.

We do not make any decision about you (about your pay, your employment, your credit or your access to the Service) based only on automated processing. AI output can be wrong, and it is built to be reviewed before anyone relies on it.

Three time-clock rules act on their own, and all are set by your employer, not by us. A shift nobody clocked out of is closed automatically at the time limit your employer chose, and flagged for a manager to check; until someone corrects it, the hours it counts are the hours up to that limit. If your employer has set your location to “required”, the clock refuses a clock-in that comes without a location. And a clock-in further from the job site than the distance your employer set is flagged for a manager to check; it is not refused. If any of these affects you, your employer can correct the shift, and you can ask us what information was used.

We share personal information with service providers who process it on our behalf, only as needed to run the Service, and under terms that require them to protect it and use it only for us. They are:

• Supabase: cloud database, login and file storage; where your account and content live
• Vercel: application hosting and cookieless web analytics; serves the app and counts page views
• Stripe: payments, subscriptions and card verification, for anything bought on our website
• Apple and Google: process the payment for anything bought inside the iPhone or Android app, on their own systems and under their own privacy policies
• Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging): only if you turn on phone notifications, to deliver them to your phone; they receive the notification’s text (a report reminder names your jobs) and your phone’s notification token
• RevenueCat: checks that in-app purchases are genuine and tells us what to unlock; it receives a random identifier for your account, never your name or email
• OpenAI: voice-to-text transcription, including meeting recordings, and the read-aloud voice
• Anthropic: AI reports, drafting, meeting minutes, receipt reading, translation, the AI Assistant (including the web searches and pages it looks up), and summaries for our own internal reporting
• Resend: sends reports, documents, invitations and account emails from our sending domain
• Google Workspace: our own email. Anything you email us (support questions, privacy requests) and the copies of contact and demo-form submissions we receive are held there
• Google and Apple: only if you choose to sign in with them, to confirm who you are
• Google (Gmail), Microsoft (Outlook), or your own email provider: only if you link your email account, to send the emails you send from CrewLog from that account and save them in its Sent folder (see “Your own email account” below)
• Your accounting software’s provider: only if you connect your accounting software (see below)
• Slack: only for the demo-request and contact forms on our website, where the details you type are posted to our own team channel so we see the enquiry, and, if we route them there, alerts that something in CrewLog broke, which name the page and the error with the same details taken out as in error reports (Section 2) and never say whose account it was
• OpenStreetMap Foundation (Nominatim): turns a job address into map coordinates
• NOAA / U.S. National Weather Service and Environment and Climate Change Canada: weather for a job’s coordinates
• Esri (ArcGIS World Imagery, the main picture behind the map’s satellite view), the U.S. Geological Survey, GEOspatial Ontario and the City of Toronto (public aerial photography, in extra detail close in) and EOX IT Services GmbH (worldwide Sentinel-2 satellite mosaic, as a backup): the imagery behind the satellite view, fetched by our servers so these providers never see you
• AWS Open Data (Terrain Tiles): the elevation data behind the map’s terrain layer, built from USGS and Government of Canada elevation sources and fetched by our servers the same way
• Environment and Climate Change Canada (its North American radar composite, which includes the U.S. NEXRAD radars), with NOAA/NCEP as a backup: the live precipitation radar behind the map’s rain radar layer, also fetched by our servers

Canadian weather contains information licensed under the Open Government Licence - Canada, and observations provided by NAV CANADA. U.S. weather is public-domain data from the National Weather Service. Satellite imagery is Esri World Imagery (source: Esri, Vantor, Earthstar Geographics, and the GIS User Community), used under Esri’s ArcGIS Location Platform terms. Public aerial imagery is from the U.S. Geological Survey / USDA National Agriculture Imagery Program (public domain), and contains information licensed under the Open Government Licence - Ontario and the Open Government Licence - Toronto. The worldwide mosaic is Sentinel-2 cloudless by EOX IT Services GmbH (CC BY 4.0, contains modified Copernicus Sentinel data 2016 & 2017). Elevation data is from USGS 3DEP/SRTM and contains information licensed under the Open Government Licence - Canada. Precipitation radar is from NOAA/NCEP (public domain) and contains information licensed under the Open Government Licence - Canada.

Services your own browser contacts directly. A few things are fetched by your device rather than sent by us, which means those companies see your IP address and what you requested, even though we send them nothing about you:

• OpenFreeMap (using OpenMapTiles and OpenStreetMap data): the map images and the fonts used to label them
• Komoot (Photon): address suggestions while you type a job address
• Google Maps or Apple Maps: only when you tap Directions, which opens their app or site

Accounting software you choose to connect. Only if you connect your own accounting software, invoices and the client details on them (your client’s name, email address and billing address) are sent to it at your direction, so the invoice appears in your books. That service is yours rather than ours, and it handles them under its own terms and privacy policy. Nothing goes to it unless you make that connection, and the connection’s access token is stored encrypted, the same way as a linked mailbox’s. The accounting import files you download from Settings are built by us and sent to nobody.

Your own email account, if you link one. In Settings you can link a Gmail or Google Workspace, Outlook or Microsoft 365, or other mailbox, so the quotes, invoices, change orders, reports, RFIs, submittals, meeting minutes and owner updates you send to clients go out from your own address and a copy lands in your Sent folder. Nothing is linked unless you link it, and CrewLog’s own messages to you (billing, reminders, invitations) never use it.

• What we ask for. From Google, only permission to send email on your behalf (the gmail.send permission) and your email address. From Microsoft, only permission to send mail as you (Mail.Send), your name and email address, and permission to stay connected so a send works after you close the app. For any other mailbox, your email address, an app password you create for CrewLog, and its server names.
• What we do with it. One thing: send the emails you choose to send from CrewLog, when you press Send. We never read, search, download, scan or keep the mail in your mailbox, we never use anything from it for advertising or to train AI models, and we never sell or share it. For another mailbox, we sign in to its incoming server only to put a copy of the email you just sent in your Sent folder.
• How it is kept. The access token (or app password) is encrypted with AES-256 before it is stored, can only be used by our servers, and is never shown to anyone, including your team and our staff. If a send fails, we keep a short error code so we can show you why; never the token.
• Turning it off. Disconnect any time in Settings, or by leaving the team. We delete the stored token, and for Google we also revoke CrewLog’s access at Google. Deleting your account deletes our copy of the token; to be sure the grant is also revoked at Google or Microsoft, remove CrewLog from your Google Account’s or Microsoft account’s app permissions as well, and for another mailbox, delete the app password at your email provider.

Google API Services User Data Policy. CrewLog’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We hold what we receive from Microsoft to the same rules.

Vercel’s cookieless page-view counter, listed above, is the only usage-measurement service we use. We use no session-replay, heatmap, advertising or cross-site tracking service, and no event or funnel analytics product.

This is our current list, and it is the whole list: there is no unnamed “and others”. If we add or change a provider we will update this policy, as described in Section 19.

We may also disclose information if required by law (for example by a court order or a lawful request from a Canadian or U.S. authority, which we will tell you about unless the law forbids it), to enforce our Terms, to protect the rights, safety or property of CrewLog or others, or in connection with a merger, acquisition or sale of assets (in which case we will tell you, and this policy will continue to apply to your information).

Browsing crewlog.ai sets no cookies, with one small exception: if you pick a plan on the pricing page, a cookie remembers whether you chose monthly or yearly billing for one day, so the plan screen after you sign up opens on the same choice. The one other thing our website keeps on your device is a small offline helper (a “service worker”) with copies of the site’s own files (its scripts, styles and an offline page) so the app can still open with no signal. It holds nothing about you, reads nothing about you, and sends nothing anywhere, which is why there is no cookie banner: there is nothing to consent to. Apart from that pricing-page cookie, cookies only start when you sign in, or click a sign-in, sign-up or password-reset link in an email from us. Every one of them is set by CrewLog itself (first-party), none are advertising cookies, none belong to a third-party tracker, and none follow you to other websites.

Here is every cookie we use:

• sb-… (authentication): keeps you logged in and keeps your session secure. Strictly necessary. With “stay signed in on this device” on, it is renewed while you keep using CrewLog and is cleared when you sign out; with it off, your session ends 12 hours after you signed in.
• cl_tr: a flag on your browser so the same device cannot repeatedly claim a new free trial. Fraud prevention. Lasts up to 180 days.
• tz: your time zone, so hours, dates and reports land on the right day. Functional. Lasts one year.
• cl-locale: the language you picked for the app. Functional. Lasts one year.
• cl-nav: whether you prefer the app’s full sidebar or the narrow icon rail. Functional. Lasts one year.
• cl-pick-interval: the billing interval (monthly or yearly) you picked on the pricing page. Functional. Lasts one day.
• cl_sx: when you turn off “stay signed in on this device”, this holds the time your session should end, so a shared or borrowed device signs itself out. Security. It holds a timestamp and nothing else, and it only exists while that setting is off. Turning it back on deletes it.
• cl_elink: when you click a sign-up, sign-in or password-reset link in an email from us, this holds that one-time link (and, if the link carries it, the email address it was sent to) between the click and you pressing Continue, so the link is never left in the page address. Security. Lasts up to one hour, and is deleted when it is used.
• cl_qbo_oauth: a one-time security value while you connect your accounting software, so the connection can only be completed by the browser that started it. Security. Lasts up to 15 minutes, and is deleted when the connection finishes.

The cl_tr flag is the only one that recognises a device rather than an account. It is written once (the first time you sign in on that browser to an account that has had a trial) and it holds nothing but a timestamp. It is used for nothing except declining a second free trial on a browser that already had one, and it never blocks a sign-up or an account on its own. It does not profile you, does not record where you go, and does not follow you off our site.

Clearing or blocking cookies. Clearing your browser cookies removes all nine, including cl_tr. In Chrome: Settings → Privacy and security → Delete browsing data. In Safari: Settings (or Preferences) → Privacy → Manage Website Data. In Firefox: Settings → Privacy & Security → Cookies and Site Data. In Edge: Settings → Cookies and site permissions. The same settings let you block cookies for any site. Blocking the sign-in cookie will stop you being able to log in.

For measuring usage we use our hosting provider’s built-in web analytics, which is cookieless: it sets no cookie and stores nothing on your device (Section 2). We do not use session recording, session replay or heatmaps. We do not use cookie data for advertising, and we do not sell it. Because we do no cross-site tracking, there is nothing for a browser “do not track” or Global Privacy Control signal to switch off.

CrewLog is operated from Ontario, Canada, and serves customers in Canada and the United States. Your account and the content you create are stored in Canada, in our database provider’s Canadian region. But several of our providers process data in the United States, including our hosting, AI, email and payment providers, so your information does leave Canada when it is processed, and the servers that answer your requests can be the ones nearest to you rather than in a fixed place. That means it may be handled outside your own province, state or country, in places whose privacy laws are different from yours, and where courts, law enforcement and government authorities may in some circumstances be able to get access to it. If you are a Canadian customer, assume your information is processed in the United States as well as stored in Canada; if you are a U.S. customer, assume it is stored in Canada and administered from there.

A few of the services your own browser contacts (the map, address suggestions) are run from Europe; they receive your IP address and what was requested (a piece of map, a partial address). The weather services, run by the U.S. and Canadian governments, are called by our servers rather than your browser and receive only a job’s coordinates. No account, report, photo or crew information reaches any of them.

Sending your information to a provider so they can do a job for us is a use of that information: it is not a sale, and it is not us handing your data over for someone else’s purposes. The companies that process information for us (Supabase, Vercel, Stripe, RevenueCat, OpenAI, Anthropic, Resend, Slack, Apple, Google and Microsoft) do so under written terms that require them to protect it and to use it only to provide their service. The mapping, address-lookup, weather and imagery services in Section 6 are different: most are public services we use without a contract (Esri’s imagery is used under its platform terms), and we send every one of them only what it needs (an address, a job’s coordinates, or a square of the map) and nothing else about you or your account.

We keep your information for as long as your account is active and for as long as we need it to run the Service, then we delete it as described here.

When you delete something inside CrewLog. Deleting a job, a daily report, a safety incident, a corrective action or a toolbox talk hides it everywhere in the app and it never comes back: there is no restore, no trash and no undo. Behind the scenes the record itself is kept in a hidden state, where nobody using CrewLog can see it, until you delete your whole account. For a safety incident that is deliberate: an incident record that whoever filed it could erase would be worth nothing to an inspector. A deleted report also still counts, for 24 hours, toward the limit on how many reports one account can generate in a day. Deleting a job also hides all of that job’s reports. Two things are different: the photos and drawings attached to what you deleted are permanently erased from storage straight away and cannot be recovered, and the AI usage entries in Section 2 always remain. So “delete” inside CrewLog means: gone for you and your crew immediately, photos gone for good immediately, and the underlying record retained by us until you delete your whole account. Meeting minutes are the exception: deleting a meeting deletes its minutes outright, and its attached files are erased unless another meeting’s minutes still use them. Deleting an Assistant conversation deletes it and its files outright.

Shift locations. The three location points on a shift (Section 2) live on the shift record and are kept for as long as that shift and the timesheet it rolls up into are, which is as long as the account keeps its payroll records. There is no location history to age out, because only those three points exist and the most recent one is overwritten rather than appended. One other place holds a copy: the append-only correction log records the whole shift record as it stood before and after each change, so the copy it keeps includes those three points. A line is written when a shift is opened, closed, corrected, voided or auto-closed, not each time the position refreshes, so the log is a record of changes to the shift, not a trail of where anyone went. If a manager corrects or voids a shift, the shift record changes but the log does not: it is kept so the worker can see what was changed. All of it is deleted with the account.

When you delete your account. Account deletion is done by the account owner and is permanent. We cancel your subscription and delete your Stripe customer record so you can never be billed again, erase every file you uploaded (photos, videos, drawings, documents, receipts, signed change orders, signatures, Assistant attachments and your logo, including the ones belonging to records you had already deleted), and then delete your account and everything cascading from it: your content, your team’s memberships of your account, push tokens, widget keys, linked-mailbox tokens, Assistant conversations, imports and cached translations. Team members keep their own logins and are simply unlinked. If you are, or were, a member of another company’s account, your hours, clocked shifts and time off there are part of that company’s payroll records: deleting your own login does not delete them, so in that case we close your login through support and leave the employer’s records in place. If a storage error stops a file from being erased at the moment you delete, that file can stay in storage until it is removed by hand: email us and we will check that your files are gone and remove any that are left. In practice erasure completes within 30 days, but a few things are different:

• Encrypted backups are overwritten on a rolling cycle, so copies can survive for a short period after the live data is gone. Backups are never used to restore an account someone deleted.
• Stripe keeps payment and invoice records to meet its own tax and chargeback obligations.
• Apple, Google and RevenueCat keep their own records of purchases made inside the apps, for the same reasons. A subscription bought through a store must be cancelled there before you delete your account, because we are not the ones billing you.
• Our AI providers keep what was sent to them for a limited period, generally up to 30 days, to detect abuse, and longer if something is flagged for misuse or the law requires it (Section 4).
• AI usage entries (Section 2) are the ledger our monthly allowances are counted from. They hold no content, they are attached to your account, and they are deleted with it.
• The recipient log (Section 2) is attached to your account and is deleted with it. While your account is live, an address you have not mailed for 90 days is deleted from it automatically, every day; if you want a specific recipient removed sooner, ask us. The record of billing and follow-up notices we sent is deleted the same way 120 days after each notice was recorded.
• A one-way hash of your email address is kept after deletion, on purpose, so the same address cannot claim a second free trial. It is a hash rather than the address, but anyone who already knows your address could match it, so we treat it as personal information. It is used for nothing else.
• Error reports that mention your user ID stay until that error has not happened for 90 days.
• The cl_tr flag in your browser stays until it expires (up to 180 days) or you clear your cookies.
• We keep the minimum records we need for tax, accounting, legal-hold and fraud-prevention obligations.

Meeting recordings are never kept by us. The audio, and the transcript made from it, are not stored on our servers; on your device they last only until the minutes are drafted and you add or discard the draft, or until you sign out (Section 2). What lasts is the minutes themselves, until you delete the meeting or your account.

A few things time out on their own. Drafts saved in your browser expire after 7 days and are wiped when you sign out (Section 2). A voice recording’s transport copy is deleted when its text is saved, and within about three days in any case. A file you uploaded that never got attached to anything is swept within hours (a week for receipts). Photo links inside a report you emailed stay openable for about 60 days, so the recipient can still see the pictures weeks later: treat an emailed report as something you cannot take back. The image of your signature in an emailed change order is linked the same way and also lasts about 60 days. A change order’s signing link works for 30 days after it was last sent. A report share link has no expiry: anyone holding it can open that report until you turn the link off or delete the report. Error reports (Section 2) are deleted automatically once that error has not happened for 90 days.

Here is what actually protects your data. Everything travels over an encrypted connection (TLS). Our database and file storage sit with Supabase, which encrypts data at rest on its own infrastructure. Access is enforced in the database itself with row-level security, which is designed so that one account cannot read another’s data, and your role, job access and feature permissions are checked again on the server for every request rather than only being hidden in the interface. Some parts of the service have to work with wider access (sending email, taking payments, serving a share link) and are written and reviewed to stay inside your account. Files are served through signed links that expire: usually within hours, although photo links in an emailed report, and the image of your signature in an emailed change order, last about 60 days, and a report share link lasts until you turn it off or delete the report. Your company logo is the exception: it sits at a public address so it can appear in the emails you send. Passwords are stored only as hashes by our authentication provider: we never see them. Linked-mailbox and accounting tokens are encrypted with AES-256 before they are stored. Deleting your account asks you to sign in again first, so a session left open on a shared device cannot be used to wipe a company’s records. Automated checks compare the live database’s permissions with what the app expects every morning and alert us to any drift.

What we are not claiming: we hold no security certification, we have not completed a SOC 2 or ISO audit, and we are a small company rather than a security organisation. No method of transmission or storage is completely secure and we cannot guarantee absolute security. You are responsible for keeping your password confidential and for activity under your account. If you handle data that needs certified infrastructure, please take that into account.

If a breach of our security safeguards involving your personal information creates a real risk of significant harm to you (in Quebec, a risk of serious injury), we will report it to the Office of the Privacy Commissioner of Canada (and, if you live in Quebec, to the Commission d’accès à l’information) and notify you as soon as feasible. We will tell you what happened, what information was involved, what we have done about it, and what you can do. Where the information is something a CrewLog customer collected about you (an employer’s record of your hours, for example), we also tell that customer, within 72 hours of confirming the breach, so they can meet their own duties to you. We keep a record of every breach of our security safeguards, whether or not it has to be reported, for at least 24 months.

We do not collect biometric information. When you or a client signs a change order, we save the signature as a picture. We do not measure pressure, speed or stroke timing, and we do not turn a signature into a biometric template. Illinois’ biometric privacy law specifically excludes written signatures and photographs from what counts as a biometric identifier.

What we keep alongside a signature. A signature on its own proves little, so we also record the plain circumstances of the submission: the name given, the date and time, and the internet (IP) address and browser user-agent string it came from. That is a technical record of how and when the signature arrived, kept so the contractor has some evidence of it, and it is shown to the contractor on the change order. We also keep a copy of the words and price that were signed, with a fingerprint of that copy, so the signature can be checked against what the client was shown. It is not identity verification: we do not confirm who actually signed. The signing page tells the signer that this record is kept; if you send a change order for signature, telling them is also your responsibility as the sender.

Signatures on toolbox talks. When your crew signs a safety talk, we record each attendee’s name, whether they tapped or typed it, and when. That is an attendance record about your workers: see Section 2 about your responsibilities as their employer.

Voice recordings, including meeting recordings, are used for one thing: turning speech into text. We do not create voiceprints, we do not use voice to identify or authenticate anyone (a meeting transcript does not say who was speaking), and we do not run facial recognition on your photos.

Wherever you live, we will honour these rights: see the personal information we hold about you; correct it if it is wrong; delete it; get a copy of the information you gave us in a structured, commonly used electronic format so you can take it somewhere else; withdraw consent where we relied on it; and ask how an automated feature used your information. We give these to everyone, not only to people whose local law requires them.

How to actually do it. You can edit most of your own information in your account settings, and you can delete your whole account there (owners) or leave a team (members). For a copy of your data, email us: we will put it together and send it to you, free, whatever plan you are on. We want to be straight about why: CrewLog has handy per-feature exports (a whole-job folder, reports to CSV, timesheets and payroll files, expenses, contacts, submittal logs, accounting import files, safety and report PDFs), but some of them are on paid plans only and there is no single “download everything” button in settings. Those exports are a product feature. Your right to a copy of your data is not a product feature, it is not gated on your plan or your role, and asking us is how you use it.

We will respond within 30 days, or sooner where the law where you live requires it. We may need to confirm who you are first, usually by confirming you control the email address on the account. We will not treat you differently for asking.

If you are an employee or a client of a CrewLog customer rather than an account holder yourself (a crew member whose hours are logged, a client who signed a change order, a reviewer who returned a submittal), the contractor decided to collect that information and controls it. Contact them first. If you contact us, we will help, but we may need to refer you to them, and we will tell you who they are.

If we turn down a request, we will tell you why, and you can ask us to reconsider. If we still say no, you can take it further: Canadians can complain to the Office of the Privacy Commissioner of Canada under PIPEDA; Quebec residents can complain to the Commission d’accès à l’information du Québec; and if you are in a U.S. state that gives you an appeal right, we will give you your attorney general’s contact information.

California is one of the states we serve, so this section describes your rights under the CCPA as amended by the CPRA if you are a California resident. We give the rights below to every California user who asks, without arguing about whether a business our size is technically covered.

What we collect and where it comes from. The categories are in Section 2: identifiers (name, email address, the account holder’s mobile number if they gave us one, and the email addresses of people you email from CrewLog), commercial information (your plan, billing interval and subscription status; we hold no card details at all), internet and device activity, coarse location from your IP address, precise location from the time clock and from photo GPS data, audio in the form of voice notes and meeting recordings (which we do not keep), visual information in the form of photos and a profile picture, professional and employment information about the crew you log, and the content you put into the Service. It comes from you, from the teammates you work with, automatically from your device, and from our payment processor.

Sensitive personal information. Three things qualify. The first is your account login: your email address together with your password, which our authentication provider stores only as a hash and uses only to sign you in (if you sign in with Google or Apple, there is no CrewLog password at all). The second is precise geolocation, and it reaches us from two places: the time clock, which stores where a shift was clocked in, where it was clocked out, and the most recent position while it was running (Section 2), and GPS coordinates saved inside a photo you upload, when the photo carries them. A third location feature, the “My location” button on the Field Map, stays on your device and is never sent to us, so it is not information we hold. The third arises where an employer records a workplace injury: the injury details in an incident record are health-related information about the person involved, submitted by the employer who collected it. We use each only to deliver the feature that was asked for: signing you in, recording where a work shift started and ended and flagging one clocked in far from the job site, dropping a pin on the map, and keeping the safety record you entered. We do not use any of it to infer anything about you, and we do not sell or share any of it. Voice recordings are ordinary audio information rather than sensitive information, because we never use them to identify anyone: we do not create voiceprints, and we do not keep the recording once it has been turned into text (Section 4). Because we only use sensitive information for purposes the CCPA permits, there is no “Limit the Use of My Sensitive Personal Information” link: there is nothing to limit.

We do not sell or share your personal information as the CCPA defines those words, and we have not in the last 12 months. We do no cross-context behavioural advertising. That is why there is no “Do Not Sell or Share My Personal Information” link: there is nothing to opt out of, and nothing for a browser opt-out signal such as Global Privacy Control to switch off.

How long we keep it is set out in Section 9. Your rights (to know, access, correct, delete, take a copy, and not be treated differently for asking) are in Section 13. Email support@crewlog.ai to use them. You may use an authorized agent.

If you live in Quebec, Quebec’s Law 25 gives you extra rights and gives us extra duties. It applies to us even though we operate from Ontario, and it is stricter than Canada’s federal law in several places. That is why it has its own section rather than being folded into the rest. We ship CrewLog in French, so we expect Quebec users and we would rather set this out properly than hope it does not come up.

Privacy by default. The settings that collect the most are the ones you or your employer choose: phone notifications, a linked mailbox, location on photos, and the time clock’s location setting for each worker. The exception is that the account-wide time-clock location switch is on when an account is created, so an employer who turns the time clock on collects locations unless they switch that off first; Section 2 explains it and the owner can switch it off at any time.

Technology that can identify or locate you. Four things in CrewLog fall into this category, and we are required to tell you about them and how they are turned on. The first is the cl_tr browser flag described in Section 7, which recognises a device so the same device cannot claim repeat free trials: clearing your browser cookies removes it at any time. The second is reading GPS coordinates out of photos you upload, described in Section 2: turning off location tagging in your phone’s camera settings stops those coordinates from ever reaching us. The third is the “My location” button on the Field Map, which asks your browser for your position and follows it while the map is open: it only runs if you tap it and grant permission, we never receive or store the position, and denying or revoking the permission in your browser turns it off. The first three are not used to profile you, to track your movements or to monitor your work.

The fourth is the time clock, and we will not describe it the same way, because it is different in kind. It takes a location fix when a worker clocks in, when they clock out, and periodically while the shift is running with the app open, and it stores those three points on the shift so the employer can see where the work session was and whether it started far from the job site (Section 2). That is workplace monitoring, it is switched on by the employer who holds the account, and it is the employer, not CrewLog, who decides to use it and who has to tell their workers about it before collecting it. The account owner can turn location collection off for the entire account. Beyond that it is set one worker at a time: off, standard or required. On standard or off, a worker can deny the location permission on their own phone and go on clocking in and out normally. On required, the clock-in is refused without a fix, and that is the employer’s choice rather than ours. Even at its fullest, it records three points per shift, only while the app is open, and never when the app is closed or the phone is locked; it does not follow a worker between shifts or after hours.

Sending information outside Quebec. Quebec law requires us to assess, before personal information is sent outside Quebec, whether it will be adequately protected there. Your information is stored in Canada and is processed by the providers in Section 6, most of them in the United States, each under written terms that require them to protect it and use it only for us; Section 8 explains what that means for you. We have reviewed where each provider processes data and under what terms, and we keep that review up to date as the list changes.

Your Quebec rights. On top of the rights in Section 13, you can ask us for the personal information you gave us in a structured, commonly used electronic format, you can ask what personal information was used to make a decision based exclusively on automated processing and have it reviewed by a person (we make none, Section 5), and you can complain to the Commission d’accès à l’information du Québec.

Person in charge. Our Privacy Officer is the person in charge of the protection of personal information at CrewLog. Contact details are in the last section.

An earlier version of this policy said CrewLog was available “anywhere, including the European Economic Area, the United Kingdom, and Switzerland”, and pointed European users at their data protection authorities. That was more than we can stand behind, so we corrected it rather than quietly leaving it in place.

CrewLog is offered in Canada and the United States only. We do not market or sell into Europe, our prices are in U.S. dollars, and our support and our whole company sit in Ontario. Our French and Spanish translations are there for Quebec and for Spanish-speaking crews in North America, not to reach Europe.

We do not claim to be GDPR compliant, and we are not going to pretend otherwise. The GDPR asks a business for specific things: a documented lawful basis for each use, records of processing, an appointed EU representative, assessments before high-risk AI processing, a standard-form data processing agreement for business customers. We have not done that work, because we do not serve that market. Saying “GDPR compliant” without it would be a promise we could not keep, and a false compliance claim is worse for you than an honest gap.

What you get anyway. The protections in this policy are not geographic. If you somehow end up with data in CrewLog while in Europe, the UK or Switzerland, everything here still applies to you: the rights in Section 13, no sale of personal information, no advertising or cross-site tracking, no training AI models on your content, and the same security and retention practices. Section 8 tells you where your data is processed. Email us and we will handle your request the same way we handle everyone else’s.

Who is responsible for what. For your own account information, CrewLog decides how it is used. For the content you upload about other people (your clients, crew and subcontractors) you decide what to collect and why, and we handle it on your instructions to run the Service for you, under Section 11 of our Terms of Service. If you need that relationship set out in a separately signed document, contact us; we do not have an off-the-shelf European data processing agreement to hand you.

You own the content you create on CrewLog: your reports, photos, voice recordings, documents and job data belong to you. We claim only the limited rights needed to operate the Service for you, as described in our Terms of Service.

Accounts are for business use by people 18 years of age or older, and we do not knowingly let anyone under 18 sign up. The sign-up form does not ask your age; by creating an account you agree to our Terms of Service, which require you to be 18 and using CrewLog for business. An employer may lawfully employ younger workers and record their hours or safety records in CrewLog; that information is the employer’s, handled as described in Section 2. If you believe someone under 18 has signed up for an account, contact us and we will delete it.

We may update this policy. If we make a material change (a new provider that handles your content, a new use of your information, a new category of data we collect, or a change to where it is stored) we will update the “Last updated” date and tell you by email or in the app before the change takes effect. Smaller changes, such as describing a new feature that collects nothing new, take effect when they are posted. We keep earlier versions; email us for one.

This policy is a notice about how we handle information. It is not a contract, and reading it or continuing to use CrewLog is not you signing anything.

For questions about this policy, about how we handle your information, or to use any of the rights in Section 13, contact our Privacy Officer at support@crewlog.ai. Our Privacy Officer is the person accountable for how CrewLog handles personal information, and complaints can be sent to the same address.

CrewLog Technologies Inc. · Ontario, Canada

If you are not satisfied with how we handled your request or complaint, you can contact the Office of the Privacy Commissioner of Canada at priv.gc.ca, or, if you live in Quebec, the Commission d’accès à l’information du Québec at cai.gouv.qc.ca.