Draft for legal review
Privacy policy
Last updated 25 October 2026
1. Who we are
Crewzy is run by Crewzy Pty Ltd (ABN [ABN]) of [registered address]. In this policy, "we" and "us" mean Crewzy Pty Ltd.
This policy explains how we handle personal information on the Crewzy website, the help centre and the Crewzy app. We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. For New Zealand businesses and people, the Privacy Act 2020 (NZ) also applies: see New Zealand.
2. If a business you deal with uses Crewzy
Businesses use Crewzy to keep records about their own customers and workers. For that information, the business decides what it collects and why, and is responsible for it. We hold it and work on it for the business, under our data processing terms.
If you are a customer of a business that uses Crewzy, or you work for one, contact that business first about your information: to see it, correct it or ask a question. The business can see and change its records, and we will help it answer you. You can still contact us at any time, and we will pass your request on to the business.
For the information about the people who hold Crewzy accounts, and for our own billing, support and website, we are responsible.
3. What we collect
Accounts and sign-in
Your name, email address and, if you give it, your phone number. Sign-in is run by Clerk, which holds your password and two-step sign-in settings; we never see your password. Clerk and we also record when you sign in and from what device and browser.
Your business
The business's name, ABN, NZBN or GST number, address, phone, email, logo, the bank details you choose to show on invoices, and your settings.
A business's customers
Names, phone numbers, email addresses and site addresses, notes about the site, and the quotes, jobs, invoices, payments, messages and documents that go with them. Customers can also give information themselves: questions on a quote link, changes asked for in the customer portal, and the details and photos sent through a business's website enquiry form.
A business's workers
Name, email address, phone number and role, a cost rate if the business enters one, bookings, clock on and off times, job sheets, notes, photos, signatures, form answers, and documents such as licences. A photo taken on a phone can carry the time and place it was taken inside the file, if the phone adds them.
Clock on locations
Only if a business turns this on. It is off until the owner turns it on. When it is on, the worker's phone takes one rough location reading when they clock on to a job and one when they clock off, and only if the worker allows it on their phone. Nothing is recorded in between, in the background or after the app is closed. Saying no never stops anyone clocking on.
The readings are kept with the time record. The business's owners and office staff can see them; other workers and customers cannot. They are kept for as long as the business keeps its records in Crewzy, and deleted with everything else 90 days after a business closes its account. Businesses are told to give their workers written notice before turning this on, and we offer a notice they can use.
Spoken job sheets
A worker can speak a job sheet. Where the phone can turn speech into words itself, the phone's own speech service handles the sound and we receive only the words. Otherwise the phone sends us a recording, which our transcription service turns into words. We do not keep the recording. The words are kept as a draft until someone adds the job sheet to the job or throws the draft away; once it is added, the words are cleared and the job sheet is kept.
Payments
Card details are entered on the payment provider's own page (Stripe) and are never seen or stored by us. We keep the provider's references, the amounts and dates, and, where a customer chooses to save a card for repeat invoices, the provider's reference to that card, not the card number. This applies to our own subscription billing and to payments a business's customers make on the business's own Stripe account.
Texts and emails
The texts and emails a business sends through Crewzy, who they went to and whether they were delivered. When a customer replies to a text, we keep the words, the number and which job, quote or invoice it relates to, so the business can see it. A reply of STOP opts that customer out of the business's texts and its words are not kept.
AI
What you ask the assistant and the records it needs to answer. We record the size and cost of each AI request, not what was typed. See AI features.
Support
Messages you send us. When our support staff look at a business, we record who looked, when, at which business and why.
Leaving
If an owner closes a business, they can tell us why. That answer is kept after the business is deleted, without the business's name or anyone's details.
Technical information
Our server records each request: the time, the address it came from (IP address), what was asked for and the browser. Errors are recorded with the business and person they happened to, with passwords, keys and card-like numbers removed first.
The website
The website collects nothing about you unless you email us. It has no analytics, no advertising and no tracking. See Cookies and analytics.
4. How we collect it
- From you, when you sign up, set up your business or use the app.
- From the business, when it adds its customers, workers and records.
- From a business's customers, through quote links, pay links, the customer portal and website enquiry forms.
- From services a business connects, such as its accounting software or a head contractor's system, and from files it imports from another app.
- From the phone, for location, photos and voice, only with the phone's permission.
- From the Australian Business Register or the New Zealand Business Number register, when you look up your business at sign-up.
- From Clerk and Stripe, about your sign-in and payments.
If you do not give us the information we ask for, we may not be able to set up your account or provide part of the service.
5. Why we use it
- To provide Crewzy: to store, show, send and sync your records as you ask.
- To bill for your subscription and keep our tax records.
- To help you when you ask for support, and to find and fix problems.
- To keep the service and your account secure and to prevent misuse.
- To send you emails about your account, such as trial, billing and security notices.
- To understand how Crewzy is used, from counts that do not name any business, so we can improve it.
- To meet our legal obligations.
We do not sell personal information. We do not use a business's records for advertising. We do not send marketing emails today; if we start, each one will have a way to unsubscribe, and we will update this policy first.
6. Who we share it with
- Our service providers, who handle information for us to run Crewzy: hosting, sign-in, billing, texts, email, AI and transcription. Each is named on AI and data processors.
- Services a business connects, such as its accounting software, its own Stripe account or a head contractor's system. These receive data because the business asked us to send it.
- A business's customers, when the business sends them a quote, invoice, receipt, text or portal link.
- People in the same business, according to their role. Workers see only what they need for their own jobs.
- Our support staff. See Support access.
- Professional advisers, such as our lawyers and accountants, under a duty of confidence.
- Police, courts and regulators, where the law requires or authorises it.
- A buyer of Crewzy, if the business is sold, who would be bound by this policy. We would tell account owners first.
7. Information held outside Australia
Our database and the files you upload are held by [hosting provider and server location]. Some of our service providers store or handle information outside Australia, so some personal information is disclosed overseas. As far as we know today:
- Clerk: United States (to confirm)
- Stripe: Australia, the United States and other countries (to confirm)
- Anthropic: United States (to confirm)
- ClickSend: Australia, and possibly other countries (to confirm)
- The email sending service, [email service]: [location] (to confirm)
- The transcription service, [transcription service]: [location] (to confirm)
- Xero: United States (to confirm)
- Stripe (your own account): Australia, the United States and other countries (to confirm)
- Head contractor systems such as Simpro: Wherever that system's provider holds it
We take reasonable steps, including contracts with privacy and security terms, so that these providers handle the information in a way that is consistent with the Australian Privacy Principles. Under the Privacy Act we remain accountable for how they handle it. The current list is on AI and data processors.
8. AI features
Crewzy uses AI to draft invoices, quotes, job sheets and replies, to read supplier bills, to answer questions about a business's records and to answer help questions. These run on Anthropic's models. Only what a feature needs is sent: for example, the help assistant sends the question and the help articles, and an invoice draft sends the job's notes, time and parts. Prices and costs are left out where a feature does not need them.
- The AI only drafts. It never sends, saves, posts or pays anything by itself: a person checks the draft and presses the button.
- An owner can switch AI off for the whole business. The help centre's assistant answers from the public help articles only.
- We do not use your records to train AI models. Under Anthropic's commercial terms, data sent through its API is not used to train its models by default.
- We keep the size and cost of each AI request, not what was typed. Answers to help questions are kept for 14 days so the same question gets the same answer; they are not linked to any business, though an answer can repeat words from the question.
9. Support access
To help a business, our support staff can view its records in Crewzy, read only. Each look needs a reason, is recorded with who looked and when, ends after 30 minutes, and is shown to the business's owners, who are notified when it happens. Support staff cannot change a business's records while they look. Where a business asks us to fix something, a senior staff member makes that one change, with the reason recorded. Our staff need two-step sign-in to reach any business's records.
10. How we protect it
Everything travels over encrypted connections. Each business's records are kept apart and every request is checked against the business and role of the person making it. Keys for connected services are stored encrypted. Two-step sign-in is available to everyone and owners are asked to turn it on. We keep backups, limit how fast requests can be made, and reviewed the app's security before launch. The data processing terms list these measures in more detail.
No system is perfectly secure. Keep your sign-in details to yourself, turn on two-step sign-in, and tell us straight away at hello@getcrewzy.com if you think your account has been misused.
11. Data breaches
If there is a data breach that is likely to cause serious harm to the people whose information is involved, we will notify them and the Office of the Australian Information Commissioner, as the notifiable data breaches scheme in the Privacy Act requires. For a New Zealand breach that has caused or is likely to cause serious harm, we will notify the New Zealand Privacy Commissioner and the people affected.
Where a breach involves a business's records about its customers or workers, we will tell the business promptly and work with it on who needs to be told.
12. How long we keep it
- While you use Crewzy, we keep your records for as long as your business keeps them. The owner can download everything at any time from Settings, Export, even if the plan has ended.
- A business whose plan has ended is locked but not deleted, so it can come back. [Retention for a locked business that is never closed: to decide.]
- When an owner closes a business, it is kept for 90 days so it can be reopened, then its records and files are deleted. The owner can ask in writing for this to happen sooner. A person's login is deleted too, unless they belong to another business. Their Clerk account is theirs; ask us if you want it deleted.
- What we keep after that: our own billing records, which tax law requires us to keep; a record that the business existed and when it closed, with the reason given for leaving but no name or people; and the record of what our support staff did, which can name the business.
- Error records and server logs are deleted after 30 days.
- Backups are kept for [backup retention: 30 days?] and then replaced, so deleted information can stay in a backup until then.
A business may have its own legal duty to keep records, such as tax records, for longer. It should download its records before it closes.
13. Seeing and correcting your information
You can ask us for the personal information we hold about you, and ask us to correct it. Most of it you can see and change yourself under My details in the app. Email hello@getcrewzy.com. We may need to check who you are first. We will answer within 30 days and will not charge you to ask. If we cannot give you access or make a correction, we will tell you why and how to complain.
If the information is a business's record about you as its customer or worker, ask that business. If you ask us, we will pass the request on and help the business answer it.
15. Texts and emails from a business
Texts and emails a business sends through Crewzy come from that business, and the business is responsible for having your permission to send them. To stop texts from a business, reply STOP. To stop emails, ask the business.
16. Children
Crewzy is for running a business and is not meant for children. Apprentices and young workers may use the crew app through the business they work for, which is responsible for their information. If you think a child has given us personal information, contact us.
17. Questions and complaints
Contact our privacy officer, [privacy officer: name or role], at hello@getcrewzy.com. Tell us what happened and what you would like us to do. We will reply within 30 days.
If you are not satisfied with our answer, you can complain to the regulator:
- In Australia, the Office of the Australian Information Commissioner: www.oaic.gov.au, 1300 363 992.
- In New Zealand, the Office of the Privacy Commissioner: www.privacy.org.nz, 0800 803 909.
18. New Zealand
For New Zealand businesses and people, we handle personal information under the Privacy Act 2020 and its Information Privacy Principles as well. In particular:
- You can ask for your personal information and ask for it to be corrected, as set out above. If we do not correct it, you can ask us to attach a statement of the correction you asked for.
- Information sent to providers outside New Zealand, including to Australia, is sent only where the provider is required to protect it in ways that, overall, give comparable safeguards to the Privacy Act 2020.
- Notifiable privacy breaches are reported to the Privacy Commissioner and the people affected as soon as practicable.
- You can complain to the Privacy Commissioner, as above.
19. Changes to this policy
We will update this page when how we handle personal information changes, and change the date at the top. For a significant change, we will email account owners at least 30 days before it takes effect.
20. Contact
Crewzy Pty Ltd, [registered address]. hello@getcrewzy.com
Questions: hello@getcrewzy.com