PRIVACY POLICY

Your information. Handled responsibly.

Effective date: August 25, 2026 • Version: 2026-08-25

1. Who we are

CrewCred is a business software service operated by Arlo Dost and any successor entity identified on this website or an invoice (“CrewCred,” “we,” “us” or “our”). CrewCred helps organizations manage worker credentials, safety forms, inspections, vehicles, equipment, service requests and related records.

2. Scope and roles

This Privacy Policy explains how CrewCred collects, uses, discloses, protects, retains and provides access to personal information through our website, applications and services. A subscribing employer or other organization (“Customer”) generally decides what worker information is entered and why. The Customer is responsible for giving workers required notices and having lawful authority to provide that information. CrewCred processes that information to provide the service and may also have direct legal obligations as an organization handling personal information.

3. Information we may collect

• Account and contact information: name, email address, telephone number, company, job title, account identifiers and sign-in information.
• Worker credential information: training and safety certificates, certificate numbers, issue and expiry dates, qualification status, driver’s-licence images and details, and uploaded supporting documents.
• Operational records: safety forms, job safety analyses, inspections, service requests, vehicle and equipment details, registration and insurance information, notes, approvals and read-receipt status.
• Signatures and agreements: signatures drawn by mouse or finger, signer identity, company name, acceptance choices, timestamps and subscription contract records.
• Notification information: email addresses, mobile numbers, notification preferences and message-delivery status.
• Technical and usage information: device and browser information, IP address, timestamps, security events, audit activity, pages or features used, and diagnostic information.
• Billing information: subscription plan, billing cycle, discounts, invoices and payment status. Full payment-card details should be processed by an authorized payment provider and are not intended to be stored by CrewCred.
• Support communications: information supplied when requesting help, booking a demonstration or contacting CrewCred.

4. Why we use information

We use personal information only for reasonable purposes connected with operating CrewCred, including to create and administer accounts; provide company workspaces and worker wallets; store, display and organize Customer records; identify expiring credentials and documents; send requested operational alerts; process signed forms and agreements; provide support; secure, troubleshoot and improve the service; maintain audit and contract records; process subscriptions; prevent misuse; and meet legal, regulatory, insurance, accounting or dispute-resolution requirements.

5. Consent and employee information

Where consent is required, it may be obtained electronically or by another lawful method. In some employment situations, a Customer may be permitted to collect, use or disclose personal employee information without consent for reasonable employment-management purposes, but the Customer may still be required to give reasonable notice. Customers must not upload information that is unnecessary, excessive, unlawfully obtained or unrelated to a reasonable business purpose.

6. When information may be shared

We may disclose information only as reasonably necessary to:

• authorized administrators, workers and representatives within the applicable Customer workspace;
• service providers that support hosting, storage, authentication, communications, payments, security, analytics or customer support, subject to appropriate safeguards;
• a regulator, law-enforcement body, court or other person where required or authorized by law;
• protect users, CrewCred or others from fraud, security threats, harm or unlawful activity; or
• complete a financing, reorganization, sale or transfer of all or part of the business, subject to applicable privacy requirements.

CrewCred does not sell or rent personal information and does not use worker documents for unrelated advertising.

7. Company separation and access

CrewCred is designed so authenticated users are associated with a company workspace and access is limited according to their role. Customers are responsible for choosing their administrators, controlling user permissions, protecting sign-in credentials and promptly removing people who should no longer have access. Users must not share accounts or attempt to access another organization’s information.

8. Storage and service providers

Information may be processed or stored by CrewCred and its service providers in Canada or other countries. When information is outside Canada, it may be subject to the laws and lawful-access requirements of that country. CrewCred will use reasonable contractual, administrative and technical measures appropriate to the sensitivity of the information and the services involved.

9. Safeguards

We use reasonable safeguards intended to protect personal information against loss, theft and unauthorized access, collection, use, disclosure, alteration or destruction. Safeguards may include access controls, authenticated accounts, company-level separation, encrypted network connections, restricted administrative access, backups, logging and service-provider controls. No internet service or storage system can guarantee absolute security. Customers and users must use strong passwords, protect their devices and promptly report suspected unauthorized access.

10. Retention and deletion

We retain personal information only for as long as reasonably required to provide the service and meet business, contractual, safety-record, accounting, dispute-resolution and legal obligations. During an active subscription, Customer administrators may manage available records. After termination, Customer Data may be retained for up to 30 days to permit a reasonable export request and may then be securely deleted or anonymized, subject to backups, legal holds and applicable law. Backup copies may remain for a limited period until overwritten through normal backup cycles.

11. Access and correction

Subject to applicable law, an individual may request access to personal information CrewCred holds about them or ask for inaccurate information to be corrected. Because Customers control many employment and operational records, we may direct a worker to their employer or Customer administrator. We may need to verify identity before responding. Certain information may be withheld where permitted or required by law, including information that would reveal another person’s personal information.

12. Withdrawal of consent

Where processing is based on consent, an individual may withdraw that consent subject to legal or contractual restrictions and reasonable notice. Withdrawal may prevent CrewCred or the Customer from providing a feature or maintaining a credential record. Some information may still be retained or used where permitted or required by law.

13. Email, text and push notifications

CrewCred may send service-related messages requested by a Customer, such as credential expiry reminders, safety-form requests, service-request updates, security notices and account messages. Customers are responsible for supplying accurate contact information and obtaining any notices or consents required for their personnel. Marketing messages will be handled separately and will include required sender information and an unsubscribe method where applicable. Carrier or data charges may apply.

14. Cookies and similar technologies

CrewCred may use essential cookies or similar technologies to keep users signed in, maintain security, remember necessary settings and operate the service. If non-essential analytics or advertising technologies are introduced, this policy and any required consent choices will be updated before they are used.

15. Children

CrewCred is a business service intended for authorized workers and company representatives, not children. Customers must not knowingly create accounts for or upload personal information about children unless it is lawful, necessary for a legitimate business purpose and supported by all required authority and consent.

16. Privacy incidents

If CrewCred becomes aware of a privacy or security incident, we will investigate, take reasonable containment and remediation steps, and notify affected Customers, individuals, regulators or others when required by applicable law. Customers must promptly report suspected unauthorized access or disclosure.

17. Changes to this policy

We may update this Privacy Policy as CrewCred, our service providers or legal requirements change. The effective date and version will be updated, and material changes will be communicated through the service, website, account email or another reasonable method before or when they take effect, as appropriate.

18. Contact and privacy questions

Questions, access or correction requests, complaints and suspected privacy incidents may be directed to the CrewCred Privacy Officer: