Privacy Policy

1. Information We Collect

We collect information you provide and information generated as you use Crewmatic on the web, in the mobile app, and through the optional browser extension:

  • Account information from Sign in with Apple, Google, or email sign-up (name, email address, and a profile photo where provided). Sign in with Apple may relay a private, Apple-generated email address instead of your real one.
  • Company information you enter (company name, address, phone number)
  • Job and customer information you enter: property addresses, loss and damage details, insurance carrier and claim information, and the names and contact details of the property owners and customers you serve
  • Assignment information imported from Alacrity's AlacNet portal through the Crewmatic for Alacrity browser extension, on your click or, if you switch on Auto-sync, on a schedule — described in section 5
  • Photos and scanned documents you capture or upload for documentation and AI scoping. Photos may include embedded location (GPS) metadata identifying where they were taken.
  • Precise location (GPS) and compass direction: when you grant permission, we stamp job photos and readings with your device's location, and photos with the compass bearing the camera faced, so adjusters can verify they were captured at the loss site and see which wall or room a photo shows. Your location is also compared, on your device, against your own jobs to suggest the one you are standing at; that comparison is never sent to us
  • Location at clock-in and clock-out: when you grant location permission and use the time clock, we record your device's location at the moment you clock in, clock out, or switch jobs, and we show your company's owners and admins that location on a map alongside how far it was from the job address. We record only those moments — never your location between them, and never in the background. If location is off or unavailable, the clock still works and the entry simply has no location. Clock-in and clock-out locations are kept as part of your company's time records.
  • Voice and audio: when you use voice notes, dictation or voice messages we access your microphone. Some recordings are kept as audio, such as a voice message in a chat or a voice note on a photo you share with a subcontractor, and the people you send them to can play them. Speech is converted to text to create job documentation. On the web, OpenAI does this (see Data Sharing), and the live preview and some dictation use your browser's built-in speech recognition, which in some browsers, such as Chrome, sends the audio to the browser's maker. In the mobile app, this happens on your device on iPhone; on Android, your phone's speech recognizer is used, which may send the audio to Google.
  • Moisture readings, equipment logs, floor plans, and notes you record on a job
  • Device and usage data (device type, app version, session activity, and diagnostic data needed to operate and secure the service)

2. How We Use Your Information

  • To provide the Crewmatic service and generate AI-powered scope data
  • To transcribe voice notes and dictation into job documentation
  • To stamp and verify the capture location of photos and readings
  • To record where a shift was clocked in and out, and its distance from the job, for your company's time records
  • To test and improve the Service. We may build internal test cases (saved examples we run our AI against to check its results) from job photos and records, with names and contact details removed from the records
  • To send service-related communications
  • To detect and prevent fraud or abuse

We do not use your data to train or fine-tune AI models.

3. Data Storage and Security

Your data is stored in Supabase (PostgreSQL) with row-level security policies enforcing company-level isolation. In our storage, job photos sit in private buckets and open only through time-limited signed URLs; copies held by the services in Data Sharing are described there. All data is encrypted in transit (TLS) and at rest (AES-256). We never see or store the password behind Sign in with Apple or Google; email/password credentials are hashed and managed by our authentication provider.

4. Data Sharing

We do not sell your personal data. We share data only with:

  • Infrastructure providers (Supabase, Vercel, Railway) as necessary to operate the Service, including Vercel's page-view analytics in the web app, with the query string removed from each address; GitHub, which hosts the repository with our code and the internal test cases described above; and the AI code-review tools that read that repository, internal test cases included: Greptile, OpenAI's Codex, Anthropic's Claude Code and GitHub Copilot
  • Authentication providers (Apple, Google, Supabase) to sign you in and secure your account
  • AI providers: Anthropic, for features such as photo scope, estimates, reports, documents, floor-plan sketches and voice-note summaries; OpenAI, to transcribe voice and to let you talk to Crewmatic on the web. Anthropic or OpenAI also runs our internal data assistant, which answers our team's questions from our database, our Linear tickets, our code and our system status, and can search the web. In database results, it hides email, phone and address columns and any value that looks like an email address or phone number. Names and other text, such as a customer's or a teammate's name or an address written in a note, are not hidden, and ticket text, such as a bug report or a deletion request, can include email addresses and phone numbers
  • AI-tracing providers (Braintrust), when tracing is on. Braintrust keeps a copy of each AI request and its response, which can include photos, voice recordings and job details, so we can look into AI results
  • Accounting providers (Intuit QuickBooks), when your contractor connects their QuickBooks account. Finalized invoices are sent to their QuickBooks company, which includes the customer name, the property address, the invoice line totals and — where provided — the customer's email address, so QuickBooks can email the invoice. This happens only for companies that have connected QuickBooks, and only for invoices finalized after that connection
  • Email providers (Resend) to send invites, signing links, invoices, job notices to subcontractors and other email from Crewmatic. Each email carries what it needs, such as names, job addresses and links
  • E-signature providers (DocuSeal) to prepare contracts, collect signatures and keep the signed copies
  • Push-notification and app-update services (Expo, which delivers notifications through Apple and Google) to send notifications to your phone, which can show, for example, the sender's name, a preview of a message, a job address or a voice-note summary, and to deliver app updates
  • Mapping providers (Google Maps and Places, and Apple Maps on iPhone) to suggest addresses as you type or say them, show maps and place job addresses on the map. The address text is sent to Google or Apple to find matches
  • The US National Weather Service, which receives a location near your company's recent jobs, rounded to about 1 km, to show local weather
  • Bug-report and feedback tools (Linear). A bug report sends what you write, record or attach, a screenshot, your company and your name or email, the page or screen you were on, your device and app version, and recent error messages. From the mobile app it also sends recent app logs, your network type and battery level (on Android, also Wi-Fi signal strength). A thumbs-down on an AI result sends the job number, the customer's name, up to 12 of the job's photos, the estimate's line items and prices, your note, and your name and email. We also track account-deletion requests in Linear, with the requester's name and email, the company name and, when one person deletes their account, the owner's name
  • Our internal team chat (Telegram and, when enabled, Slack), where we receive copies of bug reports; AI-feedback alerts with the job number, the customer's name, the room, the rated line item and its price, your note, and your name and email; error alerts; a daily report of failed photo uploads, with company names, the names of the teammates whose uploads failed and job numbers; operations reports with company names, usage counts, upload and error messages, the titles of recently closed tickets, teammates' names with the actions they recorded and when, and which teammates opened the app during the report period; new-company alerts with the company name and when it was created; daily activity summaries with company and teammate names and the actions each teammate recorded, how many and when; and the internal data assistant's answers. Telegram may receive bug-report screenshots. Slack receives alert text and links to the issue, not screenshot attachments. In the configured private Slack ops channel, the assistant processes messages addressed to it and keeps limited thread context for follow-up questions
  • Payment providers (Stripe) to bill companies that subscribe to Crewmatic
  • Geocoding providers (Geocodio) to convert a job's street address into map coordinates, so the app can show jobs on a map and recognize when you are on site. Only the address is sent, never a customer's name or contact details, and never your device's location
  • Error-monitoring providers (Sentry) to find and fix crashes, errors and slowdowns. Sentry receives technical reports: the error and where in our code it happened, the page or screen in use, your device, browser and app version, timing data, and warning and error messages from our servers. Reports from our servers and the mobile app are tagged with our internal ID numbers for you and your company. No report is tagged with your name or email address. When an error happens, the web and mobile apps also send a short recording of the screen leading up to it, with text and images hidden. Sentry does not receive the photos themselves
  • Product-analytics providers (PostHog) to understand how the app is used and where it is hard to use. PostHog receives which actions are taken and which screens are used (the text of buttons and links is hidden), technical data such as your device, browser, app version and IP address, our internal ID numbers for you and your company, and your company name so we can tell accounts apart. It does not receive your name or email address, customer names, property addresses or photos, and PostHog does not record the screen. It runs only for signed-in users of the production apps
  • Other Crewmatic companies you work with. When you hand a job to a partner or take one on from a partner, each company sees the other's job, along with that company's other jobs on the same claim. A subcontractor sees the work you assign them, your company's name, the names of teammates who write notes to them or share voice notes with them, and a phone number to reach you: the assigning teammate's or, if they have none, the job creator's or your company's. In a chat you add them to, they see the messages sent while they are in it, and can still read those after they are removed, along with the names, profile photos and roles of everyone who is or was in it. A contractor sees what their subcontractor shares with them and, once connected, the phone model, operating system and app version the subcontractor last used, and when
  • Speech recognition built into your phone or browser: on Android it may send audio to Google, and in some browsers, such as Chrome, to the browser's maker
  • Carriers and adjusters you choose, when you export or send a report at your direction
  • Your customers, when you share with them through the homeowner portal or send them a link, such as a signing link or an invoice. A portal link covers a whole property: it shows the sections you choose for each of your jobs there that is open to the homeowner
  • Law enforcement when required by valid legal process

AI providers receive photos and job details to process each request. Copies kept by our AI-tracing provider and in our internal test cases are described above.

5. Crewmatic browser extension

Crewmatic publishes an optional Chrome extension for contractors who work assignments in Alacrity's AlacNet portal and Cotality Mitigate. It adds a card inside your own signed-in portal session. The automatic Crewmatic checks are described for each portal below; other actions require your click, except Alacrity Auto-sync and Send My Comments, which run only after you switch them on.

What it sends to your Crewmatic account. When you click Add to Crewmatic, it sends the assignment you are viewing. That assignment describes a third party — the property owner — so it includes their name, street address, phone numbers and email address, together with the insurance carrier, claim number, policy number, deductible, trade, assignment status and dates, the loss description and kind of loss, and any homeowner instructions. When you use Add to Crewmatic, Update Crewmatic, or Comments only, it reads and sends the comment thread from the chosen assignment's Comments page, including when that page is not on screen: each comment's author name and company (adjusters, carrier and network staff), timestamp, type and text. The assignment export also carries the adjuster's and the carrier's managed-repair contact's name, phone and email, any alternative contact named on it, and policy details — policy number, policy limit, mortgagee, the carrier's estimate and potential-loss amounts and whether additional living expenses are involved — together with the assignment's own identifiers and flags (assignment, Xactware and XactNet ids, the emergency flag) and, for comments, their request-for and response-by fields; those are sent too. It also sends your Crewmatic account identity so the job lands in the right company. Add and Update may fetch the chosen assignment's Comments and Documents pages and download selected files even when those pages or files are not currently on screen. Add and Update also copy selected property photos and documents: lien waivers, receipts and invoices, estimates, work authorizations, photo sheets, progress documents and sketches. These files are downloaded in your Alacrity session and uploaded to your company’s Crewmatic storage. The newest estimate document is designated on the job; parsing it is a separate action.

What it changes in Alacrity. On your Add, Update, Comments only, or List files action, the extension may open unread comments so their text can be filed and click the document grid's own page links so all rows can be read. On your Add all action it clicks the Active list's own page links so every row can be read. Apart from the comments you send with Send My Comments (described below), it never submits or saves anything in Alacrity, never approves, withdraws or suspends an assignment, and never fabricates a workflow postback. On Alacrity, it reads only the chosen assignment's pages and files (and, with Add all, those of each assignment you choose on your Active list; with Auto-sync or Send My Comments on, the pages described next), alongside the Crewmatic app page where you sign in. It does not track your browsing. Automatic Alacrity check: when you open an assignment while signed in, the card asks Crewmatic whether that assignment has changes Alacrity has not seen. That sends only the assignment number, and Crewmatic's server log records the request as it does any other; if your Crewmatic sign-in is about to expire, the extension renews it at that moment with Crewmatic's own sign-in service. When there are such changes, the extension shows them; only when you press Copy update does it put that text on your clipboard, and you paste and save in Alacrity yourself.

Add all (on your click). On your Alacrity Active Work Order list, Add all to Crewmatic brings the assignments you choose into your Crewmatic account, one at a time, exactly as Add to Crewmatic would. When you press it, it reads the list, then asks your Crewmatic account which of the listed assignments it already has, sending their assignment numbers, so the confirm can show what is new. Then, for each one you start, it reads the assignment export, the assignment page and the comment thread, and its documents and photos only if you tick them. It counts unread comments but never opens them. To read every row it clicks the Active list's own page links, then tries to return the list to its first page. It waits between assignments, pauses if Alacrity signs you out, and stops if you sign out of the extension.

Auto-sync (optional). Auto-sync is off until you switch it on in the extension, for that one computer. While it is on, on weekdays from 8 to 5, the extension loads your Alacrity Active list every 20 minutes, which keeps your Alacrity session from timing out and shows which assignments have unread comments. For assignments already in your Crewmatic account, it reads their comment threads, opens unread comments (Alacrity then shows them as read) and sends them to your account as described above. It does this whenever the Active list marks new comments, and for every such assignment at 8:30, 11:30, 2:00 and 4:30. To know which assignments to check, it asks your Crewmatic account for its Alacrity assignment numbers. If Alacrity signs you out, it shows a desktop notification and waits for you to sign in; it never signs in for you. Its progress is stored on your device and cleared when you sign out of the extension.

Send My Comments (optional). Send My Comments is off until you switch it on in the extension and confirm, while signed in to Alacrity, that the name Alacrity shows is yours; that name is stored on your device. Only owners and Office Managers can write these comments in Crewmatic. While it is on, the extension asks your Crewmatic account for the comments you wrote for Alacrity, only your own, never a colleague's, and loads your Alacrity Active list to see who is signed in and find each assignment's page: whenever one of your comments is waiting, and on weekdays from 8 to 5 every 20 minutes, which keeps your Alacrity session from timing out. Outside those hours it sends only while you have been working in Alacrity in the last 25 minutes. For each comment it opens that assignment's page in a background tab, chooses the comment type, types your exact text into Alacrity's own Add Comment box and clicks its Save Comment button, under your own Alacrity login and only while you are signed in. It leaves every email, response-request and reminder field empty, so no one is emailed or asked to respond. It then reads the assignment's comment thread to confirm your comment is there and tells your Crewmatic account whether it was sent, with Alacrity's comment number, or that it could not confirm it; it never posts a comment again on its own. These comments become part of the carrier's Alacrity record, which adjusters and carrier staff can read.

Cotality Mitigate. On a Mitigate loss page at micaexchange.com or www.micaexchange.com, Find this job in Crewmatic sends only the displayed claim number to your Crewmatic account to identify its mitigation job. The extension stores that match locally on your device; signing out or connecting another company clears it. Automatic Mitigate checks: when you open a loss page, the card checks your Crewmatic sign-in and may renew it with Crewmatic's own sign-in service. When a cached match is shown, the card automatically asks Crewmatic for that job's rooms and Category/Class, sending the job identifier and displayed claim number to verify the match is still unique and current. Selecting a room checks that match and fetches the room again under your current sign-in before filling the open Define Room dialog: room name, type, level, dimensions, floor area and affected percentage, plus the job's Category/Class for affected rooms. It clears values carried from the previous room, including hazards, and leaves the two S500 determinants unticked. For an affected room with a floor area but no smaller affected portion recorded, it chooses 100% and says so. You review the fields and save in Mitigate yourself. The extension never submits, saves, transfers or deletes a Mitigate loss, and Crewmatic never receives your Mitigate password or connects to Mitigate from our servers. The ordinary Crewmatic request log records these lookups.

Alacrity status sheets (on your click). On an assignment's Recap By Category or Trade Worksheet page, Fill From Crewmatic sends only that assignment's number to your Crewmatic account. Crewmatic answers with what your account holds for that job: each phase's percent done and scheduled dates, and the business name, contact name, phone number and license number of the subcontractors on its phases. The extension raises a category's percent done but never lowers it, fills subcontractor boxes only where they are empty, and lists the dates for you to type; it never changes Notes or lien waivers. On the Trade Worksheet it also reads that assignment's Recap By Category page on your computer to see which categories are on the job. Nothing from either page is sent to Crewmatic. You review the page and press Save in Alacrity yourself. Only owners and Office Managers can use it.

Credentials. Crewmatic never receives, stores or transmits your Alacrity username or password, and never connects to Alacrity from our servers. The extension holds a Crewmatic sign-in token on your device so it can send to your account; signing out of the extension erases it.

Data imported this way is handled exactly like job and customer information you enter yourself, under the same storage, sharing, retention and multi-tenancy terms in this policy. It is never sold and never used for advertising. If these practices change we will say so here and in the extension before the change takes effect.

6. Multi-Tenancy

Each company workspace is isolated. Users in one company cannot access another company's jobs, photos, or scope data unless that company shares them, as described in Data Sharing. Row-level security policies are enforced at the database level.

7. Your Rights

  • Access your data in the app and export it, depending on your role: customer lists, payroll and job costing as CSV files, job photos as a zip download, and reports and documents as PDFs. For a copy of anything else, email privacy@crewmatic.ai
  • Delete your own account in the Crewmatic mobile app (Settings, Delete Account; subcontractors use Account), or ask us. The company owner deletes the whole company instead (Settings, Delete Organization; a subcontractor company's owner uses Account), which also ends every teammate's access. Data Retention below explains what happens next
  • Correct inaccurate personal information

8. Data Retention

Active account data is kept while your company uses Crewmatic. When you request deletion, it is scheduled 30 days out so you can cancel. After that, we remove your sign-in and clear the name, email and phone number on your profile. When a whole company is deleted, we do this for every teammate and delete the company's job photos and reports in our storage; its job records are marked deleted and can no longer be opened in the Service. When one person deletes their account, the company keeps its job records. Copies another Crewmatic company keeps, such as a job a partner created from your handoff or photos a subcontractor sent to a contractor, stay in that company's records, and copies you sent outside Crewmatic, such as invoices in QuickBooks, reports sent to carriers and emails to your customers, are not affected. We keep a record of each deletion request, with the requester's name and email. Copies held by our service providers, such as error reports, analytics events, bug and feedback tickets, alert messages, AI request traces, signed contracts and billing records, are deleted on each provider's own schedule or when we delete them. Internal test cases built from job photos and records, with names and contact details removed from the records, may be kept after an account or company is deleted.

9. Contact

For privacy inquiries, contact us at privacy@crewmatic.ai.