Privacy Policy

Crewnyx is a multi-tenant software-as-a-service platform for field-operations teams — time tracking, scheduling, job notes, messaging, receipts, and related workflows. The Services are operated by Sparky Venture Labs LLC, a Florida limited liability company with a mailing address of 206 South Grove Street, Eustis, FL 32726, United States.

For privacy questions and legal notices, contact support@crewnyx.com.

This policy applies to information we collect on crewnyx.com, in the Crewnyx web application, in the Crewnyx iOS application, and through any integrations we operate (email, calendar, payments, team messaging, accounting, and similar). It does not apply to third-party websites, services, or applications that link to or from the Services — those are governed by their own privacy notices.

Crewnyx is used by businesses ("Customer Organizations") to manage their field workforce. That creates two overlapping data flows, and we take a different legal role in each:

• Customer content — we act as a processor. When a Customer Organization uploads or generates information about its employees, customers, job sites, receipts, time entries, messages, or job notes, that information is "Customer Content". The Customer Organization is the controller (or business, under U.S. law) and decides why and how that information is used. We process Customer Content only on the Customer Organization’s documented instructions, as set out in our Data Processing Addendum.
• Account, billing, and website data — we act as a controller. When you sign up for Crewnyx, subscribe to a plan, contact us for support, or visit our website, we determine why and how we use that information. This policy describes those practices.

If you are an employee or field technician using Crewnyx because your employer has issued you an account, direct requests about your data to your employer first — they control that data. We will support your employer in responding to you.

We collect the following categories of information:

4.1 Information you or your employer provides

• Account data: full name, email address, hashed password, phone number (optional), profile photo (optional), assigned role (employee, admin, or super admin), team, and invitation status.
• Organization data: your Customer Organization’s legal name, display name, brand color, logo, time zone, workweek start, and overtime threshold.
• Field-operations content: job sites (client name, site address, access notes, and team-messaging channel); time entries (clock-in, clock-out, job type, lunch deduction, overtime); job notes; internal messages between admins and employees; receipts and their metadata (merchant, amount, purchase date, payment type, card last four digits, and associated site/time entry); time-edit requests; and notifications.
• Payroll setup (if your organization uses it): pay type and rate, W-4 details (filing status, dependents and withholding amounts — never a Social Security number), and deductions. Only the organization’s owner and the person it names as accountant can see them.
• Clock photos (only if your organization turns them on): a photo from the front camera when you clock in or out, kept for the organization’s chosen period (90 days unless it sets another) and then deleted. These are ordinary photos: we do not extract face geometry or perform facial recognition.
• Vehicle data (only if your organization connects a vehicle tracker): the vehicle’s position every few minutes, at any hour the vehicle is driven, and its odometer, kept for 30 days and associated with the vehicle and its assigned driver.
• Payment data: subscription tier, billing status, and an opaque customer identifier issued by our payment processor, Stripe. We do not receive or store full payment card numbers.
• Support and communications: emails and messages you send us, including any attachments you choose to include.

4.2 Information collected automatically

• Device and log data: IP address, browser type, operating system, device identifiers, referring URL, pages visited, and timestamps. This is used for security, abuse prevention, and operating the Services.
• Approximate location: derived from IP address for security purposes only (fraud, anomalous-login detection).
• Location while you are clocked in: with your device’s permission, we record latitude/longitude, accuracy and the device’s battery level with the clock-in and clock-out events and, while a shift or job visit is open, periodically in between (about once a minute in the browser; on the mobile apps about every 15 seconds while you are moving, then once when you stop and every 30 minutes while you stay put, with the phone’s GPS off in between). These points are used to show the organization where its crew is during working hours and, where the organization has enabled geofencing for a site, to judge whether a punch was made inside that site’s boundary and to close a job visit after the boundary reports you have left it. You are warned in the app before that happens and can say you are still on site. Your phone’s location stops being recorded when you clock out. Two things are separate from that: on iPhone, if you allow location “Always”, the app can notice when you arrive at one of your organization’s job sites while you are off the clock, so it can offer to start the job clock — nothing is recorded or sent unless you clock in; and a vehicle tracker your organization connects records the vehicle, not your phone (see 4.1). Location points are kept for 90 days. The approximate street address of a punch is looked up with an address-lookup service (Section 8). Spoken job notes are turned into text on your phone or by its operating system’s speech service; we receive only the text.
• Cookies and similar technologies: see the Cookies section below.

4.3 Information from third parties

• Calendar integration (Google OAuth): if your Customer Organization connects a Google Calendar account, we receive an OAuth access token that lets us read and write calendar events for that account only. We do not read any other Google data. See the "Google user data (Limited Use)" section — Google requires that disclosure by name for its API-services review.
• Payments processor: subscription status, invoice metadata, and event webhooks. We do not receive full payment card numbers.
• Accounting integration (QuickBooks Online): if your Customer Organization connects a QuickBooks Online company, we receive an OAuth access token scoped to that company. We use it to create expense and purchase records from receipts you submit, and to read the account, vendor, and class lists needed to categorize them. We do not read payroll records, banking credentials, or customer data unrelated to the records we create. See the "Accounting data" section — Intuit, like Google, requires that disclosure by name for its review.
• Team-messaging integration: if enabled, we exchange messages and channel metadata with the Customer Organization’s chosen team-messaging workspace.
• Push-notification services: we send device push tokens to the operating-system push-notification service (for example, on iOS) to deliver notifications. We do not receive personal data back from that service.

4.4 Sensitive information we do NOT want

Crewnyx is not designed for and should not be used to store Social Security numbers, government-issued ID numbers, full payment card numbers, biometric identifiers, protected health information under HIPAA, or information about children under 16. Do not put this kind of information into free-text fields (job notes, messages, or site notes). Location recorded while a person is clocked in is described in Section 4.2 — it is collected by the Services by design, and this paragraph is about what you should not type in yourself.

Unlocking the app with Face ID, Touch ID or a fingerprint happens entirely on your device: Crewnyx never receives biometric data.

• To provide, operate, and improve the Services.
• To authenticate users, enforce role-based access, and prevent unauthorized access to Customer Organizations' data.
• To process subscriptions, billing, and refunds through a PCI DSS Level 1 payment processor.
• To send transactional email (invitations, password resets, receipts, approvals, nightly summaries) through a reputable email delivery provider.
• To deliver push notifications and in-app notifications about work assignments, approvals, and account activity.
• To detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms of Service.
• To respond to your support requests and communicate with you about the Services.
• To comply with legal obligations, respond to lawful requests, and enforce our agreements.
• To generate aggregated and de-identified analytics about how the Services are used. We do not sell this data.

We do not use Customer Content to train generative AI or machine-learning models, and we do not sell personal information.

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases under Article 6 of the GDPR (or its UK equivalent):

• Contract (Art. 6(1)(b)): to provide the Services you or your employer signed up for.
• Legitimate interests (Art. 6(1)(f)): to secure the Services, prevent fraud, and improve our product. Our balancing tests are documented and available on request to support@crewnyx.com.
• Legal obligation (Art. 6(1)(c)): to keep tax and accounting records, respond to lawful requests, and defend legal claims.
• Consent (Art. 6(1)(a)): for anything we ask you to opt into explicitly (e.g., optional marketing email). You can withdraw consent at any time without affecting past processing.

We share information only in the following circumstances:

• With your Customer Organization. Admins in your Customer Organization can see time entries, job notes, messages, receipts, and other Customer Content that belongs to that organization. This is the entire point of the product.
• With our subprocessors. We use vetted third-party providers to run the Services in the following categories: cloud hosting and content delivery, managed database and authentication, transactional email delivery, push-notification delivery, subscription billing and payment processing, calendar integration, team-messaging integration, and (only when a Customer explicitly enables an AI feature) AI-model inference. Each provider receives only the minimum information it needs and is contractually bound by confidentiality and data-protection obligations at least as protective as this policy. The current specific list of subprocessors is available to Customer Organizations on written request to support@crewnyx.com under a customary confidentiality obligation.
• For legal reasons. We may disclose information if required by subpoena, court order, or applicable law; to enforce our agreements; or to protect the rights, property, or safety of Sparky Venture Labs LLC, our users, or the public. We push back on overbroad requests and, where legally permitted, will notify you.
• Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction. The successor will remain bound by this policy (or provide notice of any material change).
• With your consent. Any other sharing requires your explicit consent.

We do not sell personal information for money, and we do not "share" personal information for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA.

We use these service providers to run Crewnyx:

• Supabase — database, sign-in and file storage (United States).
• Vercel — application hosting (United States).
• GitHub (Microsoft) — off-site backup copies, encrypted before they leave our systems; GitHub cannot read them (United States).
• Cloudflare — hosting for crewnyx.com (global edge network).
• Stripe — subscription payments (United States).
• Resend — email delivery (United States).
• Apple Push Notification service and Google Firebase Cloud Messaging — notifications to phones.
• Photon (Komoot) and BigDataCloud — turning a punch’s coordinates into an approximate street address (European Union and Australia).
• Bouncie — vehicle positions, only for organizations that connect it.

Integrations an organization chooses to connect (for example, Slack, Google Calendar, QuickBooks Online, Jobber, Alarm.com or UniFi) receive the data that integration needs, at the organization’s direction. We will provide reasonable advance notice of new subprocessors to Customer Organizations that have subscribed to notices, and Customer Organizations may object to a new subprocessor as described in our Data Processing Addendum.

To subscribe to subprocessor-change notices, email support@crewnyx.com with the subject line "Subprocessor Notice — Subscribe".

Crewnyx’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We access Google Calendar data only to read and write scheduling events for the account you connected, at your explicit request.
• We do not use Google user data for advertising, and we do not sell or share it with third parties for advertising or unrelated purposes.
• We do not use Google user data to train generalized artificial-intelligence or machine-learning models.
• Human beings do not read Google user data except (a) with your express permission, (b) as necessary for security investigations or to comply with law, or (c) in aggregated, de-identified form for product operations.

You can disconnect the Google integration at any time from Settings → Integrations, or revoke access directly from your Google Account at myaccount.google.com/permissions.

Where a Customer Organization connects a QuickBooks Online company, we act as a processor for that data on the Customer’s instructions. Specifically:

• We access the connected company’s data only to create and reconcile the expense and purchase records that correspond to receipts submitted in Crewnyx, and to read the account, vendor, and class lists required to categorize them correctly.
• We do not access payroll records, banking credentials, or customer records that are unrelated to the entries we create.
• We do not sell accounting data, use it for advertising, or use it to train generalized artificial-intelligence or machine-learning models.
• Human beings do not read accounting data except (a) with your express permission, (b) as necessary for security investigations or to comply with law, or (c) in aggregated, de-identified form for product operations.
• Access tokens are stored encrypted, are scoped to the single connected company, and are revoked when the integration is disconnected.

You can disconnect the integration at any time from Settings → Integrations, or revoke access from within your Intuit account. Disconnecting stops all further access; records already written to your accounting system remain yours and are unaffected.

QuickBooks and Intuit are trademarks of Intuit Inc., used here only to identify the service you may choose to connect. Crewnyx is not affiliated with, endorsed by, or sponsored by Intuit Inc.

We use a small set of first-party cookies and equivalent technologies (likelocalStorage) that are strictly necessary to make the Services work — mostly session and authentication cookies issued by our managed authentication provider. We also use short-lived cookies to remember theme, tab order, and similar preferences.

We do not use advertising cookies, cross-site tracking pixels, or third-party analytics that fingerprint you. Because our cookies are strictly necessary or functional, we do not display a cookie banner in most jurisdictions. If you block cookies entirely, the Services will not work.

We retain information for as long as it is needed for the purposes above:

• Customer Content: for the life of the Customer Organization’s account. After termination we return or delete it as detailed in the Data Processing Addendum; any backups containing it are deleted within 90 days after that.
• Location points recorded while clocked in: 90 days. Vehicle positions: 30 days. Clock photos: the organization’s chosen period (90 days unless it sets another).
• Your account, if you ask for it to be deleted (from the app’s settings, as described at crewnyx.com/data-deletion): if you work for an organization that uses Crewnyx, the request goes to that organization, because it controls your work records — its owner and, where it has one, its accountant approve it. When it is approved, your sign-in is closed and your phone number, photo, authenticator and devices are removed; your time, receipt and pay records stay with the organization for as long as the law requires it to keep them, and it can restore your account if you return. If you own an organization, or belong to none, we complete the request within 30 days, except records the law requires to be kept.
• Account and billing data: for the life of the account plus up to seven (7) years afterward to meet tax, accounting, and audit obligations under U.S. and Florida law.
• Logs and security events: up to 12 months in rolling storage.
• Support tickets: up to three (3) years.

We take security seriously and apply defense-in-depth controls, including:

• TLS 1.2+ for all data in transit; encryption at rest by our hosting and database providers; integration credentials additionally encrypted.
• Each Customer Organization’s records are separated inside the database itself, and an automated test checks every night that one organization cannot read another’s.
• Two-factor authentication on every account, with lockouts after repeated failed sign-in and code attempts.
• Role-based access within each organization, and least-privilege access and audit logging for our own administrative actions.
• Independent third-party attestation via our infrastructure providers, which maintain SOC 2 Type II and equivalent certifications.

No system is impenetrable. If we become aware of a personal-data breach affecting you, we will notify affected Customer Organizations without undue delay and, where required by law, notify individuals directly and file with the appropriate authority within the applicable statutory deadline (72 hours under GDPR).

Crewnyx is operated from the United States. If you access the Services from outside the United States, your information will be transferred to, stored, and processed in the United States. Where the GDPR or UK GDPR applies, we rely on the European Commission’s Standard Contractual Clauses (2021) and the UK International Data Transfer Addendum as the transfer mechanism, together with supplementary technical measures (encryption in transit and at rest, strict access controls).

Subject to applicable law, you have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate or incomplete.
• Delete personal information, subject to legal retention obligations.
• Object to or restrict certain processing.
• Data portability — receive your data in a structured, machine-readable format.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with your local data-protection authority.

To exercise any of these rights, email support@crewnyx.com. If you are an employee or field tech using Crewnyx via your employer, we will route your request to that Customer Organization, which is the controller of your work-related data, and support it in responding. We respond within 30 days for GDPR/UK GDPR requests (extendable by 60 days for complex cases) and within 45 days for U.S. state privacy-law requests (extendable by 45 days), unless a longer statutory period applies.

As of July 2026, twenty U.S. states have comprehensive consumer privacy laws in effect (including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Jersey, New Hampshire, Tennessee, Minnesota, Maryland, Indiana, Nebraska, Kentucky, Rhode Island, and Florida). Depending on your state of residency, you may have some or all of the rights listed in Section 15. To exercise them, email support@crewnyx.com.

We do not use "sensitive personal information" for purposes other than those permitted by law, and we do not sell personal information or share it for cross-context behavioral advertising in any state.

This section supplements the rest of this policy and applies to California residents whose personal information we collect as a business (not as a service provider on behalf of a Customer Organization).

Categories collected in the last 12 months:

• Identifiers (name, email, IP address).
• Customer records under Cal. Civ. Code § 1798.80(e) (billing information, phone number).
• Commercial information (subscription plan, transaction history).
• Internet or network activity (device and log data).
• Geolocation data (approximate, from IP; plus precise latitude/longitude recorded while clocked in, if enabled — see Section 4.2).
• Professional or employment-related information (role, team, employer).
• Inferences drawn from the above solely to operate the Services.

Sources:

Directly from you, from your Customer Organization, from your device automatically, and from third-party services you connect (for example, calendar, payment, and messaging integrations).

Purposes:

See Section 5 above.

Disclosures for a business purpose:

We disclose identifiers, customer records, commercial information, internet or network activity, and professional information to our subprocessors and to legal recipients as described in Section 7. We do not sell personal information and do not share it for cross-context behavioral advertising.

Sensitive personal information:

We collect log-in credentials (hashed passwords) and, if you enable it, precise geolocation while you are clocked in. We use these only for the purpose for which they were collected — authenticating you, and time tracking (the audit trail on a punch, the organization’s live view of its crew during working hours, and geofenced clock-in/out where the organization has enabled it) respectively — and never for inferring characteristics about you.

Retention:

See Section 12 above.

Your rights:

Right to know, right to delete, right to correct, right to limit use of sensitive personal information, right to opt out of sale/sharing (not applicable — we do neither), and right to non-discrimination. To exercise them, email support@crewnyx.com. You may also designate an authorized agent in writing. We will verify your identity using information already associated with your account before releasing data.

Shine the Light:

California Civil Code § 1798.83 permits users who are California residents to request certain information regarding our disclosure of personal information to third parties for their direct-marketing purposes. We do not disclose personal information to third parties for their direct marketing.

Crewnyx is a workforce product intended for use by businesses and their adult employees. We do not knowingly collect personal information from anyone under 16, and no part of the Services is directed to children. If you believe we have collected information from a child under 16, contact us at support@crewnyx.com and we will delete it.

Our Services do not respond to Do Not Track browser signals because there is no common industry standard. Where required by state law, we treat a valid Global Privacy Control (GPC) signal from a browser as an opt-out of sale and sharing — although, again, we do neither.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top and, where appropriate, notify Customer Organization admins by email or in-product notice at least 15 days before the change takes effect. Continued use of the Services after a change constitutes acceptance of the revised policy.

Sparky Venture Labs LLC
Attn: Privacy
206 South Grove Street
Eustis, FL 32726
United States

Email: support@crewnyx.com

For EU/UK residents: if you cannot resolve a concern with us directly, you may lodge a complaint with your local data-protection authority. We do not currently have an EU representative appointed under Article 27 because our processing does not trigger that requirement; if that changes, we will list the representative here.