Crewzon Privacy Policy

Crewzon is operated by NOT ANOTHER APP BUILDER PTY. LTD. (ACN 699 954 071, ABN 92 699 954 071) trading as Crewzon ("Crewzon", "we", "us" or "our").

This Privacy Policy explains how we collect, hold, use and disclose personal information when people use the Crewzon website, web application, mobile applications, support services and related products. It is intended to address the Australian Privacy Principles where they apply.

This policy applies to website visitors; businesses that create or administer a Crewzon workspace; employees, contractors and technicians invited into a workspace; customers and site contacts whose details are entered by a Business Account; and people who contact us for support, sales, privacy or billing matters.

A Business Account controls the customer, worker and job records it enters into Crewzon. Crewzon generally handles those records as a service provider for the Business Account. Crewzon separately controls information used to operate and secure Crewzon, administer subscriptions, communicate with users and meet our own legal obligations.

This policy does not apply to third-party websites, apps or services that Crewzon does not operate.

The information we collect depends on how Crewzon is used and may include:

• names, business names, ABNs or ACNs, contact details and business addresses;
• account roles, permissions, workspace membership and preferences;
• subscription status, billing contacts and payment metadata;
• customer, site, job, schedule, quote, invoice, work-history and asset records;
• time entries, attendance details, assigned work, operational statistics and location snapshots captured for enabled time-entry or geofence workflows;
• photos, documents, certificates, forms, messages, signatures and other attachments;
• IP address, device type, operating system, browser, app version, time zone and authentication or session events;
• pages, screens and features used, web performance measurements, crash reports, logs and diagnostics; and
• support, privacy, security, sales and billing communications.

We do not collect card numbers through Crewzon's own forms when payment details are entered directly into a payment provider's hosted interface. The payment provider may give us transaction identifiers, payment status, plan and limited billing metadata.

Authentication and Passkeys

Passwords are stored using secure hashing and are not stored in plain text. We may hold session records, one-time-code events, two-factor authentication settings, backup-code records and security audit events needed to protect accounts.

On supported devices, a passkey may be unlocked using a device biometric, device passcode or security key. Crewzon does not receive or store the user's fingerprint, face image, biometric template, device passcode or passkey private key. Crewzon may store public passkey credential material, credential identifiers, device-type metadata and authentication results needed to verify the passkey.

Location Information

The mobile app may request foreground location permission when a worker submits an enabled time-entry or geofence action. If permission is granted, Crewzon may capture a point-in-time latitude and longitude, accuracy, capture time, a reverse-geocoded address and the result of a comparison with the configured job-site geofence. Crewzon does not use this workflow for continuous background location tracking.

Device permissions can be refused or withdrawn. A Business Account may configure a workflow so that a location refusal, unavailable location or out-of-geofence result requires a reason or affects whether that time entry can be submitted.

Business Accounts must tell workers how monitoring features are used and comply with workplace surveillance, employment, privacy and consultation requirements in each relevant state or territory. Crewzon must not be used for covert surveillance.

Sensitive Information

Crewzon is not designed to require sensitive information as a general condition of use. A Business Account may nevertheless upload records such as safety material, certificates or notes containing health or other sensitive information. The Business Account must have authority and any consent required by law before doing so.

We collect personal information:

• directly when a person creates or uses an account, completes a form, uploads a file, contacts us or uses a feature;
• from Business Account owners or administrators who invite users or enter customer, worker and job information;
• automatically from browsers, devices, applications, cookies, local storage, logs and diagnostics;
• from hosting, database, storage, authentication, payment, communications and diagnostics providers; and
• from public or third-party sources where lawful and reasonably necessary.

Where reasonable and practicable, we collect personal information directly from the individual. Our Collection Notice gives more detail for common collection points.

Where we receive personal information indirectly, including from a Business Account, an integration or a public source, we take reasonable steps in the circumstances to ensure the person is aware of the matters required by law. Those steps may include requiring the Business Account to give its own notice, providing this policy and our Collection Notice through invitation and sign-in flows, or giving a notice at the relevant collection point.

People may deal with Crewzon anonymously or using a pseudonym where lawful and practicable, for example when making a general enquiry that does not require us to identify an account or person. Identification is ordinarily required to create or secure an account, grant workspace access, process billing, investigate an account-specific issue or exercise a privacy right where identity must be verified.

We collect, hold and use personal information to:

• provide and administer Crewzon accounts, workspaces and subscriptions;
• authenticate users and protect accounts, systems and data;
• schedule, dispatch, perform and record field-service work;
• support customer, site, quote, invoice, timesheet and payroll-input workflows;
• store job evidence and make it available to authorised workspace users;
• send service, security, support and billing communications;
• process subscriptions and payments;
• provide support and investigate incidents, complaints or disputes;
• measure reliability and product usage and improve Crewzon;
• prevent fraud, misuse and unauthorised access;
• comply with legal, tax, accounting and record-keeping obligations; and
• enforce our agreements and protect legal rights.

If required account, contact, workspace or job information is not provided, we may be unable to create an account, provide the requested feature, secure the service, process billing or respond to a request. Refusing optional device permissions may prevent the related mobile feature from operating.

We do not sell Customer Data and do not use Customer Data for third-party advertising. We may use aggregated or de-identified information to understand and improve Crewzon where we take reasonable steps to prevent re-identification.

Crewzon does not currently use personal information for solely automated decisions expected to significantly affect an individual's rights or interests. We will update this policy before enabling such processing.

Crewzon may use rules to support security, permissions, rate limiting, geofence results and workflow validation. These rules support product operation and do not replace an employer's responsibility to review relevant records before making employment or disciplinary decisions.

We may send marketing communications where permitted by law, using contact details collected directly, supplied by a Business Account, or obtained from a lawful public or third-party source. Commercial electronic messages will identify the sender, include current contact details and provide a functional, free unsubscribe method where required. We will honour an unsubscribe request within 5 working days. Service, security, account and billing messages may still be sent after a person opts out of marketing.

Crewzon uses essential cookies or similar storage for authentication, sessions, security and preferences. The website also uses privacy-preserving Vercel Web Analytics and Speed Insights to understand aggregate usage and performance. Crewzon does not currently activate third-party marketing or cross-site advertising cookies.

More detail is available in the Cookie Policy.

Depending on the feature used, we may disclose personal information to:

• the Business Account and its authorised owners, administrators and users;
• customers or recipients chosen by the Business Account, such as when a quote or invoice is emailed;
• hosting, database, storage, email, payment, notification, app-platform, geocoding and diagnostics providers;
• professional advisers such as lawyers, accountants, auditors and insurers;
• regulators, courts, law-enforcement bodies or other parties where required or permitted by law;
• a buyer or adviser involved in a proposed sale, merger, financing or restructure, subject to appropriate confidentiality arrangements; and
• another party with consent or at the direction of the person or relevant Business Account.

The provider list, feature status and likely processing locations are in Subprocessors. Crewzon's core Better Auth library is self-hosted. Where the separate managed Better Auth Infrastructure service is enabled, it receives authentication-event metadata for dashboard and audit functions as described in the subprocessor list.

Some providers may process or allow authorised support access to personal information outside Australia. Depending on the feature and provider, likely countries or regions include the United States, Japan, the United Kingdom, countries in the European Economic Area and other locations used by global app-platform, payment, network or support operations. Core production database records are hosted in Sydney, Australia; individual providers and feature-dependent processing are described more specifically in the Subprocessors list.

Where Australian Privacy Principle 8 applies to an overseas disclosure, we take reasonable steps in the circumstances to require appropriate handling, unless an exception applies. Provider locations and infrastructure can change, so the subprocessor list identifies likely locations where practicable rather than guaranteeing that every processing event occurs only there.

Crewzon takes reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Current measures include TLS in transit, secure password hashing, role-based and tenant-scoped access controls, authentication safeguards, audit and security logging, error monitoring and provider-managed backups.

No online service can guarantee absolute security. Security concerns can be sent to security@crewzon.com.

We retain information for as long as reasonably necessary to provide Crewzon, maintain security, meet legal, tax and accounting obligations, resolve disputes, enforce agreements and protect legitimate business interests. When information is no longer required, we take reasonable steps to delete or de-identify it where practicable.

Deletion of a personal login does not necessarily delete jobs, timesheets, messages, invoices, signatures, location snapshots, audit records or other records controlled by a Business Account. More detail, including request channels and existing exports, is in Account Deletion and Data Retention.

We take reasonable steps in the circumstances to keep personal information we use or disclose accurate, up to date, complete and relevant. An individual may ask for access to, or correction of, personal information we hold about them by contacting the Privacy Officer at privacy@crewzon.com. No particular wording is required. We may need to verify identity and may refuse or limit a request where permitted by law.

We will respond within a reasonable period. We do not charge an individual for making a correction request or for correcting personal information. If we refuse access or correction, we will give written reasons and available complaint steps where required. If a correction is refused, the individual may ask us to associate a statement with the information recording that they say it is inaccurate, out of date, incomplete, irrelevant or misleading. Where required and reasonably practicable, we will notify relevant prior recipients of a correction.

If the information is Customer Data controlled by a Business Account, we may refer the request to that Business Account or assist it to respond. Users can also update some account information through available profile settings.

Privacy complaints should describe the issue, relevant dates and the outcome sought and be sent to the Privacy Officer using the contact details below.

We aim to acknowledge privacy complaints promptly and ordinarily provide a substantive response within 30 days where practicable. We may contact the complainant for further information and will provide the outcome or next steps in writing where appropriate.

If a person is not satisfied with our response, they may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au, subject to the OAIC's processes.

We assess suspected eligible data breaches under the Notifiable Data Breaches scheme where it applies and take reasonable steps to complete an assessment within 30 calendar days. We will notify affected individuals and the OAIC as soon as practicable when required by law.

Crewzon does not adopt an Australian government-related identifier as its own identifier for a person. If a Business Account enters an identifier required for a lawful business record, Crewzon will use or disclose it only where authorised by law or reasonably necessary for the purpose for which it was provided.

Crewzon is intended for business use and is not directed to children. Business Accounts must ensure they have authority to enter personal information relating to a minor.

• Privacy Officer, NOT ANOTHER APP BUILDER PTY. LTD. trading as Crewzon
• ACN 699 954 071 / ABN 92 699 954 071
• Postal address: 1A Lara Way, Campbellfield VIC 3061, Australia
• Email: privacy@crewzon.com
• Website: crewzon.com

We may update this policy as Crewzon, our providers or legal requirements change. If a change is material, we will take reasonable steps to notify affected users, for example by email, in-app notice or website notice. The effective date above identifies the current version.