Your data, treated with care.

Who we are

Crewva provides workforce, compliance and site management software for the construction industry. This policy explains what personal data we process when you or your employer use the Crewva portal and the Crewva worker app.

What we collect

• Account details such as name, email, phone and employer.
• Employment and compliance records uploaded by your employer.
• Site attendance events (check in, check out, site assignment, signed documents).
• Device and diagnostic information needed to run the app securely.
• Approximate and precise location, only as described below.

Why we process your data, and our lawful basis

We process personal data only where we have a lawful basis to do so under the UK GDPR. In most cases Crewva acts as a processor on behalf of your employer, who decides what is recorded about you; where we act as a controller in our own right (for example, for account administration, billing and service security) the bases below apply.

• Crew and worker details — name, contact details, employer, role, emergency contact, right to work and induction records. Processed so your employer can run its workforce and meet its statutory duties. Lawful basis: performance of a contract and legitimate interests; legal obligation where health and safety law requires the record.
• Certifications and training records — card types, qualifications, issue and expiry dates, and uploaded certificate files. Processed so competence can be evidenced and expiry can be tracked. Lawful basis: legal obligation and legitimate interests.
• Site data — site assignments, attendance events, signed documents, site records, photographs and incident related entries. Processed to evidence who was on site, when, and under what instructions. Lawful basis: legitimate interests and legal obligation.
• Client and project information — client contacts, quotes, invoices and project records entered by the company. Processed to run the company's commercial workflow. Lawful basis: performance of a contract and legitimate interests.
• Location at check in and check out — processed on the basis of your explicit consent, as described in the section below.
• Account, billing and diagnostic data — processed to operate, secure and bill for the service. Lawful basis: contract, legal obligation (tax and accounting records) and legitimate interests.

Where processing relies on legitimate interests, we have balanced those interests against your rights. Where it relies on consent, you may withdraw that consent at any time. Data is stored on servers in the EU region, encrypted in transit and at rest, and separated by company so that one company can never see another's records. Retention periods and your rights of access, correction, export, restriction and deletion are set out in the sections below and on our Data deletion page; requests are answered within 30 days.

The Crewva worker app uses location to confirm that a worker is physically present on an assigned site at check in, and to automatically sign a worker out when they leave that site. This section explains exactly how it works.

Background location use

After a successful check in, the app may use background location to detect when you leave the site geofence. The app does this only while you are checked in to an active shift. Background location stops as soon as you are checked out, sign out of the app, or revoke the permission.

Geofence based automatic sign out

Each site has a small geofence around its registered address. If you leave that geofence while checked in, Crewva records an automatic check out at the time the boundary was crossed. This protects workers from being marked as on site when they are not, and gives accurate attendance records to the employer.

What we do not track

• We do not track your location when you are not checked in to a site.
• We do not build a movement history or location trail.
• We do not share live location with your employer, with other workers, or with any advertiser or third party.
• We do not use location for marketing, profiling, or behavioural advertising.

Consent is required

Location sharing is opt in. The app asks for your explicit consent before using location, and your decision is recorded against your account at the moment of check in. You can revoke location permission at any time in your device settings. If location permission is off, check in via geofence will not be available and your employer may require an alternative method.

Retention

Attendance records, including the check in and check out coordinates, are retained for 24 months for compliance, payroll and dispute resolution, then deleted or fully anonymised. Raw background location pings that do not correspond to a site boundary event are not stored.

Data is encrypted in transit and at rest. Access is restricted using row level security so that each company can only see its own records. Crewva staff access is logged and limited to support and maintenance.

If you are in the UK or EEA, you have the right to access, correct, export, restrict or delete your personal data, to withdraw consent at any time, and to lodge a complaint with your local supervisory authority (for UK residents, the Information Commissioner's Office). To exercise any of these rights, contact us at the email below and we will respond within 30 days.

We keep personal data only as long as needed for the purpose it was collected. Account data is kept while your employer's account is active and for up to 24 months after closure. Attendance and compliance records are kept for 24 months. You may request earlier deletion subject to legal obligations such as health and safety record keeping.

We use a small number of trusted subprocessors to run the service. Each is bound by a data processing agreement and only processes data on our instructions:

• Supabase (EU region) — database, authentication, file storage and serverless functions.
• Cloudflare — application hosting, edge delivery and DDoS protection.
• Stripe — subscription billing and payment processing for company accounts. Card details are handled directly by Stripe; we never see or store them.
• Resend — transactional and authentication email delivery (sign-in links, invites, notifications).
• Google — Google Places and Google Maps APIs for site address search and geocoding. Anthropic and Google AI models are used via server-side gateways to generate compliance documents; no personal worker data is sent to model providers for training.
• Apple and Google — the App Store and Google Play distribute the Crewva worker app and provide device push notification delivery.

A current subprocessor list is available on request from privacy@crewva.ai.

AI processing. Crewva uses AI models, accessed through server-side gateways, to generate documents and summaries and to read information from uploaded certificates and receipts. Content you submit for those features is sent to the model provider solely to return a result to your company. It is not used by Crewva or by the model providers to train or improve their models, it is not used to build profiles of individuals, and it is not shared with other customers. We keep the amount of personal data included in those requests to what is necessary for the feature to work, and AI output is always returned to your own company's account only.

Crewva does not use advertising cookies, and we do not run any analytics, marketing or ad tracking on this website. The only cookies and similar browser storage we set fall into two categories:

• Strictly necessary — the sign-in session that keeps you logged in to the Crewva portal and protects your account. The site cannot work without these, so they do not require consent.
• Functional — small preferences stored in your own browser, such as whether the portal sidebar is expanded, information you have part-entered during sign-up, and one-off notices you have already seen. These are set by us, are not used to track you, and are not shared with anyone.

Calendly. Our Book a Demo page can display a booking calendar provided by Calendly, which sets its own cookies, including analytics cookies. The calendar is not loaded automatically: it only loads if you choose to load it on that page, and no Calendly cookies are set unless you do. Calendly's own privacy notice explains how it uses that data. You can book a demo without loading the calendar by emailing us instead.

You can clear or block cookies at any time in your browser settings. Blocking strictly necessary cookies will prevent you from signing in.

You can request deletion of your account and personal data at any time. See our Data deletion page for the exact steps, retention rules and contact route.

For any privacy question, data request, or to report a concern, contact our team at privacy@crewva.ai.

See also our homepage for more about Crewva.