PRIVACY POLICY

Your information. Handled responsibly.

Effective date: October 14, 2026 • Version: 2026-10-14

1. Who we are

CrewCred is a business software service operated by Arlo Dost and any successor entity identified on this website or an invoice (“CrewCred,” “we,” “us” or “our”). CrewCred helps organizations manage worker credentials, safety forms, inspections, vehicles, equipment, service requests and related records.

2. Scope and roles

This Privacy Policy explains how CrewCred collects, uses, discloses, protects, retains and provides access to personal information through our website, applications and services. A subscribing employer or other organization (“Customer”) generally decides what worker information is entered and why. The Customer is responsible for giving workers required notices and having lawful authority to provide that information. CrewCred processes that information to provide the service and may also have direct legal obligations as an organization handling personal information.

3. Information we may collect

• Account and contact information: name, email address, telephone number, company, job title, account identifiers and sign-in information.
• Worker credential information: training and safety certificates, certificate numbers, issue and expiry dates, qualification status, driver’s-licence images and details, and uploaded supporting documents.
• Operational records: safety forms, job safety analyses, inspections, service requests, vehicle and equipment details, registration and insurance information, notes, approvals and read-receipt status.
• Location information: precise employee GPS is not collected by the current production build. If a Customer later enables a tested GPS feature, workers will receive clear notice of when collection starts and stops, who can view it and the configured retention period.
• Signatures and agreements: signatures drawn by mouse or finger, signer identity, company name, acceptance choices, timestamps and subscription contract records.
• Notification information: email addresses, mobile numbers, notification preferences and message-delivery status.
• Technical and usage information: device and browser information, IP address, timestamps, security events, audit activity, pages or features used, and diagnostic information.
• Billing information: subscription plan, billing cycle, discounts, invoices and payment status. Full payment-card details should be processed by an authorized payment provider and are not intended to be stored by CrewCred.
• Support communications: information supplied when requesting help, booking a demonstration or contacting CrewCred.

Signup requests and optional demo follow-up: When you request a walkthrough and agree to be contacted, we save your name, company, email, optional phone number, selected industry and the wording and time of your consent. These details are real, separate from fictional demo data and anonymous traffic statistics, and accessible only through CrewCred’s private owner controls. We use them to respond to your request and record follow-up status and notes. Signup and demo requests, including any message or plan interest you provide, are emailed to sales@crewcred.ca using our transactional email provider. New company accounts are arranged after a personal conversation. This does not subscribe you to a general marketing mailing list. To withdraw your request or ask for deletion, email sales@crewcred.ca.

Private live demonstrations: A presenter may create a temporary demo company and worker name and share an expiring private worker link. The worker and presenter exchange sample jobs, messages, time records, safety assessments and fictional credentials within that demo only. Demo actions are visible to the presenter, and access ends when the session expires or is ended. These sessions do not create a paid customer account or collect GPS. Demo records remain available to the owner until the owner deletes the session; participants may request deletion at sales@crewcred.ca.

4. Why we use information

We use personal information only for reasonable purposes connected with operating CrewCred, including to create and administer accounts; provide company workspaces and worker wallets; store, display and organize Customer records; identify expiring credentials and documents; send requested operational alerts; process signed forms and agreements; provide support; secure, troubleshoot and improve the service; maintain audit and contract records; process subscriptions; prevent misuse; and meet legal, regulatory, insurance, accounting or dispute-resolution requirements.

5. Consent and employee information

Where consent is required, it may be obtained electronically or by another lawful method. In some employment situations, a Customer may be permitted to collect, use or disclose personal employee information without consent for reasonable employment-management purposes, but the Customer may still be required to give reasonable notice. Customers must not upload information that is unnecessary, excessive, unlawfully obtained or unrelated to a reasonable business purpose.

6. When information may be shared

We may disclose information only as reasonably necessary to:

• authorized administrators, workers and representatives within the applicable Customer workspace;
• service providers that support hosting, storage, authentication, communications, payments, security, analytics or customer support, subject to appropriate safeguards;
• a regulator, law-enforcement body, court or other person where required or authorized by law;
• protect users, CrewCred or others from fraud, security threats, harm or unlawful activity; or
• complete a financing, reorganization, sale or transfer of all or part of the business, subject to applicable privacy requirements.

CrewCred does not sell or rent personal information and does not use worker documents for unrelated advertising.

7. Company separation and access

CrewCred is designed so authenticated users are associated with a company workspace and access is limited according to their role. Customers are responsible for choosing their administrators, controlling user permissions, protecting sign-in credentials and promptly removing people who should no longer have access. Users must not share accounts or attempt to access another organization’s information.

8. Storage and service providers

Information may be processed or stored by CrewCred and its service providers in Canada or other countries. When information is outside Canada, it may be subject to the laws and lawful-access requirements of that country. CrewCred will use reasonable contractual, administrative and technical measures appropriate to the sensitivity of the information and the services involved.

9. Safeguards

We use reasonable safeguards intended to protect personal information against loss, theft and unauthorized access, collection, use, disclosure, alteration or destruction. Current safeguards include identity-provider authentication, server-side role and company checks, encrypted network connections, private company-scoped document storage, restricted administrative access, upload validation, rate limiting, security headers and audit logging. Backup and restoration capabilities depend in part on hosting-provider features and are tracked separately in CrewCred’s internal production-readiness process. No internet service or storage system can guarantee absolute security.

10. Retention and deletion

We retain personal information only for as long as reasonably required to provide the service and meet business, contractual, safety-record, accounting, dispute-resolution and legal obligations. During an active subscription, Customer administrators may request an export and offboarding assistance. After termination, Customer Data may be retained for up to 30 days to permit a reasonable export request and may then be deleted or anonymized, subject to verified backup behaviour, legal holds and applicable law. CrewCred does not promise an exact backup-deletion date until the applicable hosting retention settings have been confirmed.

11. Access and correction

Subject to applicable law, an individual may request access to personal information CrewCred holds about them or ask for inaccurate information to be corrected. Because Customers control many employment and operational records, we may direct a worker to their employer or Customer administrator. We may need to verify identity before responding. Certain information may be withheld where permitted or required by law, including information that would reveal another person’s personal information.

12. Withdrawal of consent

Where processing is based on consent, an individual may withdraw that consent subject to legal or contractual restrictions and reasonable notice. Withdrawal may prevent CrewCred or the Customer from providing a feature or maintaining a credential record. Some information may still be retained or used where permitted or required by law.

13. Email, text and push notifications

CrewCred may send service-related messages requested by a Customer, such as credential expiry reminders, safety-form requests, service-request updates, security notices and account messages. Customers are responsible for supplying accurate contact information and obtaining any notices or consents required for their personnel. Marketing messages will be handled separately and will include required sender information and an unsubscribe method where applicable. Carrier or data charges may apply.

14. Cookies and similar technologies

CrewCred uses essential technologies to keep users signed in, maintain security, remember necessary settings and operate the service. With a visitor’s permission, CrewCred also collects anonymous first-party traffic statistics such as pages visited, referral source, general device type, country and selected signup or contact actions. CrewCred does not include names, emails, full IP addresses, search terms or document contents in these traffic reports. Visitors may decline analytics without losing access to the public website.

15. Children

CrewCred is a business service intended for authorized workers and company representatives, not children. Customers must not knowingly create accounts for or upload personal information about children unless it is lawful, necessary for a legitimate business purpose and supported by all required authority and consent.

16. Privacy incidents

If CrewCred becomes aware of a privacy or security incident, we will investigate, take reasonable containment and remediation steps, and notify affected Customers, individuals, regulators or others when required by applicable law. Customers must promptly report suspected unauthorized access or disclosure.

17. Changes to this policy

We may update this Privacy Policy as CrewCred, our service providers or legal requirements change. The effective date and version will be updated, and material changes will be communicated through the service, website, account email or another reasonable method before or when they take effect, as appropriate.

18. Contact and privacy questions

Questions, access or correction requests, complaints and suspected privacy incidents may be directed to the CrewCred Privacy Officer: