Privacy Policy

This distinction matters throughout this policy, because your obligations and ours are not the same.

• Your information. Information about you and your business as a CrewLedger customer — your account, your business details, your subscription. We decide how this is handled, and this policy describes that.
• Information you enter about other people. Your customers, your workers, and anyone who sends an enquiry through your website. We store and process this on your behalf so the service works. It stays yours. You decide what to collect and why, you are responsible for handling it lawfully, and your own privacy obligations to those people are yours, not ours.

Your account. To create an account we collect your email address and a password. Passwords are hashed by our authentication provider — we never see or store the password itself.

Your business profile. Whatever you enter in your business settings: business name, ABN, phone, email, address, website, trade or industry and a description of what you do, your logo, quote and invoice preferences, payment details you want shown on invoices, email templates, tax settings, and your region, timezone and financial year.

Business records you create. If you use Business Management: customers (name, email, phone, address, notes), jobs, quotes, invoices, payment status, expenses, tasks, notes, and files or photos you upload. If you add workers, their name, mobile number, email, trade and any notes you record.

Worker sign-in. Workers sign in with their mobile number and a one-time code sent by SMS. We store the mobile number so we can recognise them and show them the jobs assigned to them.

Your website. If you use Website: the content you write, images and logos you upload, services and pricing, reviews you enter, your writing preferences, your custom domain if you connect one, and the published version of your site.

Enquiries from your website. When someone uses your website’s contact form, we collect the name, email, phone, message and any photos they send. We store the enquiry in your account and email it to you.

Subscription information. Your plan, subscription status, trial end date, billing period dates, and the identifiers our payment provider uses for your customer and subscription records.

Technical information. We use your IP address to apply rate limits on forms and sign-in, which protects the service from abuse. We store it only as a one-way hash, not in a readable form, and those records are discarded once the rate-limit window passes. We do not log browser user-agent strings.

Almost everything above you give us directly, by creating an account, filling in your settings, or using the product. Enquiry information comes from the person who submits your website’s contact form. Subscription status comes back to us from our payment provider when something changes — for example when a payment succeeds or you cancel.

• To provide the product — your account, your records, your website and your enquiries.
• To publish your website when you choose to publish it.
• To send transactional email: enquiry notifications to you, and quotes and invoices to the recipients you choose.
• To take subscription payments and manage trials, renewals and cancellations.
• To protect the service against spam, abuse and automated attacks.
• To provide support when you contact us.
• To meet our legal and record-keeping obligations.

We do not sell personal information. We do not use it for advertising, and we do not send marketing email from the product.

We use a small number of service providers to run CrewLedger. They only handle what they need for their part of the service.

• Supabase — database, accounts and sign-in, including verification and password-reset emails.
• Vercel — hosting for the application and published websites, and custom domain setup.
• Stripe — subscription payments and the billing portal.
• Resend — sending email such as enquiry notifications, quotes and invoices.
• Cloudflare R2 — storage for images, logos, receipts and attachments.
• Cloudflare Turnstile — bot checks on sign-in, signup and our contact form.
• Twilio — delivering the SMS codes workers use to sign in, arranged through Supabase.
• Anthropic — optional writing suggestions for website content (see below).
• Pexels — searching for stock photos, if you use that feature. Only your search wording is sent.
• Google Maps Places — address suggestions while you type an address.

We may also disclose information where the law requires it, or to protect our rights or someone’s safety.

We do not currently connect CrewLedger to accounting software, calendars or any advertising network.

Subscription payments are handled by Stripe. Card details are entered on Stripe’s own payment pages. CrewLedger never receives or stores your card number. What we keep is your plan, your subscription status and the identifiers Stripe uses for your records. When we set you up with Stripe we pass your account email and an internal reference for your account.

Enquiries sent through your website are stored in your account and emailed to the address on your account, with any photos attached. Photos are re-processed on our servers before they are stored, which removes embedded camera data such as GPS location.

The enquiry form is protected by a proof-of-work check that runs in the visitor’s browser and is verified by us. It does not use a third-party service and does not set a cookie. Because your website collects personal information from your visitors, you are responsible for telling them how you will use it.

Website content includes an optional writing helper. When you choose to use it, the text of the field you are editing is sent to Anthropic, along with limited context: your business name, service area, your services, your trade description, your saved writing preferences, and the existing text on your site.

• It only runs when you ask for a suggestion. Nothing is sent in the background.
• Suggestions are shown for you to accept or discard. Nothing is saved automatically.
• Only website content is sent. Your customers, jobs, quotes, invoices and expenses are never sent.
• If you never use the feature, nothing is sent at all.

CrewLedger sets only the cookies it needs to work: the cookies that keep you signed in, and for workers, a cookie remembering which business they are viewing.

We do not use analytics, advertising pixels, session replay or third-party tracking on CrewLedger. Our bot-protection provider may set its own cookie or read limited browser signals when it runs on a sign-in or contact form.

Websites you publish with CrewLedger do not carry analytics or advertising trackers either.

CrewLedger is built for Australian businesses, and our SMS provider is configured to deliver only to Australian and New Zealand numbers.

However, the providers listed above are global services, and some of them store or process data outside Australia — including in the United States and Europe. We have not verified a single storage location for every provider, so we do not claim that all data stays in Australia. If the storage location of a particular provider matters to you, contact us before signing up and we will tell you what we know.

Measures we actually have in place include:

• Database rules that restrict every record to the account that owns it.
• Passwords hashed by our authentication provider; we never store them ourselves.
• Uploaded files kept in private storage and served through short-lived links, not public URLs.
• Encrypted connections (HTTPS) across the application.
• Signature verification on payment webhooks, and rate limiting and bot protection on public forms.
• Enquiry photos re-encoded on our servers, which strips embedded camera data.
• Administrative access restricted to a named list of addresses, with actions recorded.

No online service can be completely secure, and we do not claim otherwise. If we become aware of a data breach that is likely to cause you serious harm, we will act on it and notify affected people where it is appropriate or required.

We keep your information for as long as your account exists, so your records stay available to you.

Cancelling a subscription does not delete anything. Your data stays in your account, and access to parts of the product stops. We do not currently run an automatic deletion schedule, so if you want your data removed you need to ask us — see below.

Some information is kept longer where we need it, such as records of payments and correspondence. Copies may also persist in backups for a period after deletion.

You can view and correct most of your information directly in the product at any time. For anything else, email us at support@crewledger.com.au and we can help you:

• access a copy of the personal information we hold about you
• correct information that is wrong or out of date
• delete your account and the data in it

Account deletion is handled manually by us at the moment rather than by a button in the product. We will ask you to confirm the request from the email address on the account, and we will confirm when it is done. The product can export invoices and expenses as a spreadsheet, and quotes and invoices as PDFs; for anything broader, ask us and we will work out the best way to get it to you.

We have written this policy to follow good Australian privacy practice, including the structure of the Australian Privacy Principles.

If you have a question or a complaint about how we have handled personal information, email support@crewledger.com.au and tell us what happened. We will look into it and respond as soon as we reasonably can. If you are not satisfied with our response, you can raise the matter with the Office of the Australian Information Commissioner at oaic.gov.au.

We may update this policy as CrewLedger changes. The date at the top shows when it was last revised. If a change materially affects how we handle your information, we will tell you in the product or by email.

For any privacy question, request or complaint, email support@crewledger.com.au. This is the fastest way to reach us, and it is where privacy correspondence should be sent. If you need to write to us another way, email us and we will arrange it.

See also our Terms of Service.