Privacy Policy

1. Who we are and what this covers
2. Information we collect
3. The mobile app
4. How we use information
5. AI features
6. How we share information
7. Where information is stored
8. How long we keep it
9. Security
10. Your rights and choices
11. U.S. state privacy rights
12. Children
13. Privacy Officer and complaints
14. Changes to this policy

1. Who we are and what this policy covers

crewduo is field service management software operated by Doable Link Inc. ("Doable Link", "we", "us"), a Canadian corporation. Businesses ("Businesses") use crewduo to manage their clients, schedule and dispatch work, send quotes and invoices, message clients and take payments.

This policy explains how we handle personal information in two different roles.

• When we decide how information is used. This covers people who visit our websites, create an account, use crewduo as a User of a Business (owners, office staff, technicians), are billing contacts, or contact us. This policy applies directly to that information.
• When we act on a Business's behalf. A Business's information about its own clients ("Clients") is "Customer Data", and the Business controls it. This includes client names and contact details, service addresses, job history, photos, messages and payments. We process it only to provide crewduo to that Business, under our Terms of Service and Data Processing Addendum. The Business's own privacy policy explains how it uses Client information. The booking pages, client portals, texts and payment links we operate for a Business (for example yourbusiness.crewduo.com) are provided on that Business's behalf.

If you are a Client and have a question or request about your information, please contact the Business you deal with. If you contact us instead, we will pass your request to that Business and help it respond.

2. Information we collect

Information you give us

• Account and profile: name, email address, phone number, password (stored only as a salted hash), profile photo, language and notification preferences, and your role in the Business.
• Business details: business name, address, logo, service areas, tax registration numbers, locations, teams, services and prices.
• Work information about Users: schedules, working hours, time-off requests, skills, assigned visits, time on site, commission plans and earnings, depending on the features the Business uses.
• Billing: billing contact, plan and invoices. Card details are collected and stored by our payment processor, Stripe. We receive only limited details, such as card brand, last four digits and expiry date.
• Communications: messages to our support team, feedback you send from the app, and survey responses.
• Payment and identity checks for Businesses that accept payments: Stripe collects the information it needs to verify a Business and its representatives. We receive the verification status and payout details needed to show them in crewduo.

Information collected automatically

• Log and device information: IP address, browser and operating system, device model, app version, pages and features used, date and time, and error details. We use it to run, secure and fix crewduo.
• Cookies and similar storage: in the crewduo web app, mobile app, booking pages and client portals, only those needed to sign you in, keep you secure and remember preferences. See our Cookie Policy. We do not use advertising or cross-site tracking cookies in the Service.
• Approximate location derived from IP address, used for security, such as spotting unusual sign-ins.

On our marketing website only

This applies to crewduo.com and crewduo.ca, the public website that describes crewduo. It does not apply to the crewduo web app, mobile app, booking pages or client portals, which have no analytics or advertising tags.

• If you accept cookies in the banner, Google Analytics and Google Ads (Google LLC) record the pages you view, the buttons you use (for example "Start free", choosing a plan or booking a walkthrough), the ad, search or link that brought you, your browser and device type, and your approximate location (city or region). Google Analytics does not store your IP address.
• If you decline, or make no choice, no analytics or advertising cookies are set. Google receives only basic signals without cookies or identifiers, such as that a page was viewed, which it may use to estimate totals.
• We do not let Google use your visit for ad personalization or remarketing, and we do not send Google your name, email address or anything you type into a form.
• If you sign up, the link into the crewduo app carries where your visit came from: the campaign tags on the link you arrived by (for example "google / cpc / hvac"), the website that referred you, and the first page you saw. We save that with your new account, so we know which of our marketing brings businesses that stay. If you accepted cookies, the Google Ads click identifier from the ad you clicked is passed and saved too, and we may later report to Google Ads that the click led to a sign-up, to the business starting to use crewduo (for example creating its first job) or to a paid subscription, with the amount paid. We send Google only the click identifier, the step reached, its date and the amount, never your name, email address or business records. If you declined cookies, or your browser sends a Global Privacy Control signal, no click identifier is passed or reported.
• You can change your choice at any time with Cookie settings at the bottom of every page. See our Cookie Policy for the cookies involved.

Information from others

• The Business you work for may create your User account and give us your name, email, phone number and role.
• Sign in with Google or Apple: if you choose one, Google gives us your name, email address and profile picture, and Apple gives us your name and email address (or a private relay address if you choose to hide it).
• Stripe: payment, subscription and account verification status.
• Integrations a Business connects, such as QuickBooks Online, Zapier, its own API keys or outbound webhooks: the records exchanged for the connection the Business turned on.
• Telephony and email providers: delivery status, opt-outs, and call and message records.
• Referrals: if someone refers you to crewduo, we record the referral so we can credit them.

3. The crewduo mobile app

You can change these permissions at any time in your phone's settings. Some features, such as check-in, may not work without them. The app contains no advertising, and we do not use third-party analytics or tracking SDKs in it.

4. How we use information

• To provide and operate crewduo: create accounts, sign you in (including two-factor authentication), sync your work, send notifications, and run the features a Business uses.
• To process subscription payments, send invoices and receipts, and manage trials, plan changes and refunds.
• To send service communications, such as security alerts, sign-in codes, account notices, changes to our terms, and schedule or job notifications.
• To provide support and respond to requests.
• To keep crewduo and its users safe: prevent fraud, spam and abuse, enforce our Acceptable Use Policy, and investigate security incidents.
• To maintain and improve crewduo, using aggregated or de-identified usage information where possible.
• On our marketing website only, and only if you accept cookies there: to understand how visitors use the website and to measure which of our ads lead to sign-ups and walkthrough bookings, using Google Analytics and Google Ads. We do not use it to target ads to you or build advertising profiles.
• To send news and offers about crewduo to account holders. Where the law requires it, we ask for consent first. Every marketing email includes an unsubscribe link.
• To meet legal obligations, such as tax and accounting rules and lawful requests from authorities.

We rely on your consent, which may be express or implied depending on how sensitive the information is and what you would reasonably expect, and on other grounds the law permits. You may withdraw consent, subject to legal or contractual limits. Some features may then stop working.

5. AI features

Some features use AI models: the setup assistant, the in-app copilot, form generation, structuring technicians' recommendations, and suggesting a caption for a visit photo in the mobile app. When you use one, we send the content needed to answer to Microsoft Azure OpenAI, running in Microsoft's Canada East region in Canada. That content includes your request and the relevant business records, such as services, prices, job notes or the photo you asked about. The mobile app asks for your permission the first time before it sends a photo. Under Microsoft's terms it is not used to train models, and it is kept only for limited periods for safety and abuse monitoring. We do not use AI to make decisions that produce legal or similarly significant effects about individuals.

6. How we share information

We do not sell personal information, and we do not share it for targeted advertising. We share personal information only as follows.

• Service providers that host, secure and deliver crewduo for us, such as cloud hosting, email and text delivery, payments and AI. They may use the information only to provide services to us. See the Subprocessors list. On our marketing website, and only with your consent, Google LLC provides analytics and ad measurement.
• Within a Business. Your name, role, schedule, activity and work records are visible to the Business you work for, according to the permissions it sets.
• With Clients of a Business. Limited User details appear on client-facing messages and pages, for example a technician's name on an appointment reminder.
• At a Business's direction. When a Business connects an integration, such as QuickBooks Online, Stripe or Zapier, creates API keys, sets up outbound webhooks, or publishes a calendar feed, we send the data that integration needs to the destination the Business chose.
• Carriers and messaging registries. To register a Business's texting and keep it running, we give carriers and registries its business details, sample messages, and opt-in and opt-out records. Mobile numbers and texting consent are never shared with third parties for their own marketing.
• Legal and safety. When required by law or legal process, or when needed to protect the rights, property or safety of users, the public or Doable Link.
• Business transfers. As part of a merger, acquisition, financing or sale of assets, subject to this policy. We will give notice of any change in ownership that affects your information.
• With your consent or at your direction.

7. Where information is stored

crewduo is hosted on Microsoft Azure in Canada (the Canada Central region in Toronto). Our AI features run in Microsoft Azure's Canada East region in Canada. Some of our service providers process information in the United States or other countries, including Resend (email), Twilio (texts, calls and recordings), Azure Maps (address lookup and travel times), Stripe (payments) and Expo, Apple and Google (push notifications), and Google (analytics and ad measurement on our marketing website, if you accept its cookies). Information held outside Canada is subject to the laws of that country and may be accessible to its courts, law enforcement and national security authorities. We use contracts and safeguards to protect information wherever it is processed. For residents of Quebec, we assess the protection information will receive before transferring it outside Quebec.

When you enter an address, crewduo sends it to Azure Maps (processed in the United States) to turn it into map coordinates and estimate travel times. The address is sent for that purpose only. The maps shown in your browser load their images from OpenStreetMap and Esri, which receive your IP address and the map area viewed.

8. How long we keep information

• Active accounts: for as long as the Business's account is open, and for as long as the Business chooses to keep its records.
• Closed accounts: when a Business's account closes, we keep its data for 30 days so it can be restored or exported, then delete it. Database backup copies are overwritten within a further 7 days, and deleted files (photos, documents and attachments) may remain in backups for up to 14 days. The account owner can ask us to delete the data sooner by contacting [email protected].
• Individual User accounts: if you delete your account in the app, your sign-in is disabled immediately and all your sessions are ended. Work records you created, such as visits, photos and forms, belong to the Business and are kept as long as it keeps them. See Delete Your Account & Data.
• Live crew tracking history: for the number of days the Business sets (30 by default, at most 365), then deleted automatically. Only the latest position is kept beyond that, and it is replaced by each new one. Location saved with a visit's check-in or check-out is part of the visit record and is kept as long as the Business keeps the visit.
• Where a business came from (the campaign, referring website and, with consent, Google Ads click identifier saved at sign-up): for as long as the account is kept.
• Marketing website analytics: if you accepted cookies, Google Analytics keeps visit data for 14 months and then deletes it; Google Ads cookies expire after 90 days.
• System and security logs: usually kept no longer than 30 days.
• Records we must keep by law: our own billing, tax and accounting records are kept for as long as tax and corporate laws require, typically six to seven years.

9. Security

We protect information with safeguards appropriate to its sensitivity. These include encryption in transit and at rest, a private database network, role-based permissions, two-factor authentication, rate limiting and activity logging. No system is perfectly secure. If a breach creates a real risk of significant harm, we will notify affected individuals, Businesses and regulators as the law requires. Read more in our Security Overview.

10. Your rights and choices

Depending on where you live, you may have the right to:

• know whether we hold personal information about you, and get access to it;
• ask us to correct inaccurate or incomplete information;
• withdraw consent, or ask us to stop using your information for a particular purpose;
• ask us to delete information, or de-index it where the law allows;
• receive your information in a structured, commonly used technological format (data portability), including in Quebec; and
• be told when a decision about you is made only by automated processing. We do not make such decisions.

To make a request, email [email protected]. We will verify your identity before acting, and reply within 30 days, or tell you if we need more time as the law allows. If a request concerns Customer Data, we will direct it to the Business that controls it.

Other choices: unsubscribe from marketing emails using the link in each email; accept or decline analytics and advertising cookies on our marketing website, and change that choice at any time, with Cookie settings; reply STOP to any text message; turn off push notifications, location or camera access in your phone's settings; and manage your notification preferences in your crewduo profile.

11. U.S. state privacy rights

Residents of some U.S. states, including California, Colorado, Connecticut, Virginia, Utah, Texas and Oregon, have rights under state privacy laws. These are the rights to know, access, correct and delete personal information; to obtain a portable copy; to opt out of the sale or sharing of personal information, targeted advertising and certain profiling; and not to be discriminated against for using these rights.

• Categories we collect (in the past 12 months): identifiers (name, email, phone, IP address, device identifiers); customer records (billing details); commercial information (subscriptions and transactions); internet and app activity; geolocation (approximate from IP; precise at check-in and check-out when permitted; and continuous precise location while a Business has live crew tracking turned on); audio and visual information (photos, videos with their sound, and call recordings if a Business turns them on); and professional information (role and work records). Sources, purposes and recipients are described in sections 2, 4 and 6.
• Sensitive information: account sign-in credentials and precise geolocation are used only to provide the features you use, and not to infer characteristics about you.
• No sale or sharing: we do not sell personal information or share it for cross-context behavioural advertising, and have not done so in the past 12 months. Our marketing website measures our own ads with Google Ads, but never for ad personalization or remarketing. We honour Global Privacy Control signals: when your browser sends one, the Google Ads cookies stay off on our marketing website.
• How to exercise rights: email [email protected]. You may use an authorized agent, and we may ask the agent for proof of authorization. If we deny your request, you may appeal by replying to our decision; we will respond within the time the law requires.

12. Children

crewduo is a business tool. It is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact [email protected] and we will delete it.

13. Privacy Officer and complaints

Doable Link Inc. has designated a Privacy Officer who is responsible for our compliance with privacy laws, including Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec's Act respecting the protection of personal information in the private sector. You can reach the Privacy Officer at [email protected].

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, the privacy commissioner of your province, or the relevant authority in your state.

14. Changes to this policy

We may update this policy. We will post the new version here with a new "last updated" date. For material changes, we will notify account holders by email or in crewduo before the change takes effect.