Legal

Privacy Policy

What CrewSafety collects, why, and the two different roles it plays depending on whose data it is.

1. The two roles we play

CrewSafety ("we," "us" — operated as a sole proprietorship based in Benton County, Washington, USA) is a business tool that employers use to track their workforce's training, certifications, and compliance records. That means we handle personal data in two distinct roles, and it matters which one applies:

• Processor / service provider — "Workforce Data." The records a customer organization enters about its employees and workers. The employer is responsible for this data and decides what to collect; we process it only on the employer's instructions. If you're an employee whose records live in a customer's CrewSafety account, your employer is the right place to direct questions and requests — we support them in responding.
• Controller — account and billing data. The comparatively small set of data we collect directly from the people who sign up for and administer accounts.

2. Workforce Data we process for employers

Depending on what a customer chooses to use, Workforce Data can include: identity and contact details of workforce members; employment details (job title, department, location, hire date); training and certification records; incident and injury reports, including body-part-level injury detail; medical documents (e.g., medical release forms, fit-for-duty documentation); drug- and alcohol-screening records, including chain-of-custody stages; emergency contacts; documents the employer uploads; and activity logs within the employer's account.

3. Data we collect directly

• Account data: the name, work email, and password hash of account holders; company name; plan selection. If you sign up or sign in with Google or LinkedIn instead, we receive your name and email address from that provider (verified by them) and never receive or store your Google or LinkedIn password.
• Billing data: handled by Stripe, our payment processor. We receive subscription status and billing metadata; we never store card numbers.
• Support and communications: what you send us when you contact us.
• Server logs and optional website analytics: standard technical logs (IP address, timestamps, requested pages) kept for security and reliability. If you choose optional analytics on the public marketing site, we use Google Analytics 4 to measure visits and interactions and Microsoft Clarity to understand page layout, scrolling, clicks, and session behavior. These tools are not loaded until you choose to accept them, and they are not used to measure authenticated product usage. The single sign-up or email-verification conversion event also honors that same choice. We do not use personal data for advertising.

4. How we use data

We use data to provide, secure, and improve the Service; to authenticate users and enforce access levels; to send transactional email (signup verification, billing and dunning notices, security alerts) through a third-party transactional email provider; to respond to support requests; and to meet legal obligations. We do not sell personal data. We do not use personal data for advertising. Ever.

5. Medical & drug-screening records get heightened protection

The Service is built so that the most sensitive Workforce Data is treated differently from ordinary records:

• Medical and drug-screening files are encrypted at rest (AES-256-GCM) in a separate vault, distinct from general employee records.
• Access is role-gated: viewing medical or screening data requires access explicitly granted for that category, independent of a user's other permissions.
• These records are never surfaced in general employee lists, dashboards, or exports that don't carry the required access level.
• Access to vault records is logged.

6. Consumer-health-data laws, including Washington's My Health My Data Act

Some Workforce Data — medical documents and drug-screening records — is health-related. Washington's My Health My Data Act (MHMD, RCW 19.373) and the analogous consumer-health-data laws it inspired in other states are built around protecting a "consumer's" health data collected outside of an employment relationship — MHMD's own definition of "consumer" expressly excludes an individual acting in an employment context. Because Workforce Data is collected by an employer about its own workforce, for employment purposes (fitness-for-duty, drug and alcohol screening programs, incident and injury recordkeeping), we treat it as falling outside the consumer-health-data scope these laws are aimed at. That said, we apply MHMD-equivalent protections to this data as a matter of practice regardless: we do not sell it, we do not use it for advertising, and it receives the technical and access safeguards described in Section 5. We process this data solely as a service provider/processor acting on a customer employer's instructions. Individuals whose health-related records are held in an employer's account should direct access, correction, or deletion requests to that employer; we assist employers in fulfilling them.

7. Subprocessors

We use a small set of service providers to run CrewSafety and understand use of the public marketing site, each processing data only as needed to provide its service to us:

• Cloudflare — application hosting, network/tunnel infrastructure, and encrypted off-site backup storage (R2).
• Stripe — payment processing. We never receive or store your card number; Stripe returns only subscription status and billing metadata.
• Resend — delivery of transactional email (signup verification, billing notices, security alerts).
• Sentry — error monitoring, so we learn about and fix problems quickly.
• Google Analytics — measurement of visits and interactions on public marketing pages.
• Microsoft Clarity — optional behavioral analytics on public marketing pages after a visitor accepts optional analytics.

We'll update this list if the set of providers changes.

8. Data retention

• Active accounts: Workforce Data is retained for as long as the customer's account is active — compliance records are the product, so nothing is auto-purged without the employer's instruction.
• After termination: customers may request a full export for 30 days; after that window we may delete Customer Data from active systems.
• Backups: deleted data ages out of encrypted backups on a rolling cycle of approximately 30 days.
• Account/billing records: retained as needed for legal, tax, and accounting obligations.

9. Security & breach notification

Security measures include tenant isolation with automatic per-company data scoping (verified by an automated test suite), encryption of medical and screening files at rest, role-based access controls, server-side session authentication, audit logging, and payments handled by Stripe so card data never touches our servers. No system is perfectly secure; if we learn of a breach affecting your data, we will notify affected customers without undue delay, consistent with applicable law, with the information we have about what happened and what we're doing about it.

10. Where data lives

CrewSafety is operated from the United States and data is hosted in the United States. If you use the Service from elsewhere, you understand your data will be processed in the U.S.

11. Children

The Service is a workplace tool for adults. It is not directed to children, and account holders must be 18 or older.

12. Your choices & rights

• Account holders can access and update their account information in the app, and can contact us to correct or delete their direct account data, subject to records we must keep.
• Workforce members (employees whose records an employer keeps in the Service): your employer controls those records — direct requests to them, and we'll assist your employer in responding as their processor.
• We honor applicable state privacy rights; requests can be sent to [email protected] and we'll route them appropriately (including to the responsible employer where we act as processor).

13. Changes to this policy

If we make material changes, we'll notify account administrators by email or an in-app notice before the changes take effect, and update the effective date above.

14. Contact

[email protected] · CrewSafety, Benton County, Washington, USA. For questions about these practices, contract terms, or to exercise rights described above.