Crewtide Privacy Policy

The short version. We don't sell personal information and we don't use it for advertising. If you book with a business, that business decides how your information is used, and we look after it for them. We collect what Crewtide needs to work, keep it only as long as needed, and honor privacy requests from everyone in the US. Error reports identify people only by an internal id.

1. Who's in charge of your information

Kinetic Coast Studios LLC ("Kinetic Coast", "we", "us") is a Florida limited liability company at 7901 4th St N, Ste 300, St. Petersburg, FL 33702. Crewtide is our booking and customer-management service for local service businesses. Crewtide handles two kinds of information, and different people are in charge of each:

If you booked with a business, that business has its own privacy notice, linked from its booking pages, and it's the best place to start with questions or requests about your records. You can also email us at contact@crewtide.app and we'll help or pass your request on.

2. What we collect

About customers (from you, the business, or its staff)

• name, phone, email, and the service address for services at your location;
• vehicle details (make, model, year, and VIN if entered) or property details, where the business needs them;
• bookings, quotes, services, prices, notes, cancellations, reschedules and waitlist entries;
• photos, such as before-and-after photos or photos sent with a quote request;
• messages sent through Crewtide (email today, and texts once available), whether they were delivered, and records of text consent and opt-outs;
• payment references (amount, status, Square's transaction id; never full card numbers), tips, gift cards, loyalty points, referrals and memberships;
• if you create a Crewtide login: your email, a password (held by Google Firebase Authentication, never by us in readable form) or your Google or Apple sign-in id, and the businesses your login is linked to;
• your notification preferences and, if you allow notifications, a push-notification token.

About businesses and their staff

Business name, branding, address, hours, services and prices; staff names, emails, phone numbers, roles, working hours and time off; plan, billing contact and payment status (cards are held by Stripe); which integrations are connected (such as Square); Help & Support requests and their attachments; terms acceptance records; and audit log entries (such as support sessions and exports). Once texting is available: the details carriers require to register a business's number (legal name, EIN or sole-proprietor details, address and website).

Automatically

Device and browser details, IP address, server logs, app-integrity checks, and error reports (where in the code an error happened, device and browser details, and internal user and business ids).

We don't collect precise location from your device, biometric data or government ID numbers. Please don't put Social Security numbers, card or bank numbers, or health records in notes or messages.

3. How we use it

We use personal information to:

1. provide Crewtide: bookings, reminders, quotes, payments through the business's Square account, accounts and sign-in;
2. send the emails (and, once available, texts) that a business sets up, such as confirmations, reminders and review requests;
3. communicate with businesses about their account, billing, security, changes and support requests;
4. keep Crewtide secure: prevent fraud, abuse and spam, enforce limits and our terms, and check app integrity;
5. fix and improve Crewtide, using error reports and de-identified, aggregated information;
6. bill businesses for Crewtide and keep financial records; and
7. comply with law and protect the rights, safety and property of people and of Kinetic Coast.

We don't use personal information for targeted advertising, we don't sell it, and we don't make decisions with legal or similarly significant effects about anyone based only on automated processing. We don't use it to train AI models. Where we de-identify information, we keep it that way and require anyone we share it with to do the same.

4. Who we share it with

We never sell personal information. We share it only:

• with the business you book with or work for, which sees its own records (never your records at other businesses);
• with our service providers (section 5), under contracts that limit them to providing their service;
• with payment providers you pay through: Square for a business's own card payments, and Stripe for Crewtide plans. They act under their own privacy policies;
• for legal and safety reasons: when we believe in good faith the law, a subpoena or a court order requires it; to protect someone from imminent harm; or to protect our rights and Crewtide's security. Where the law allows, we'll tell the business or person concerned before we disclose their data; and
• in a business transfer (a merger, acquisition, reorganization or sale of assets), under this policy, with notice before it becomes subject to a different one.

Text messaging. Mobile numbers and text-messaging opt-in data and consent are never shared with third parties or affiliates for their marketing or promotional purposes. Text opt-in data and consent are shared only with the messaging providers that deliver the messages.

5. Our service providers

These companies process personal information for us. For businesses, this is also the list of subprocessors under our Data Processing Addendum; we'll update it and email businesses at least 30 days before a new provider receives customer data.

Coming later, with notice first: Twilio Inc. for texts (phone numbers, message content, and business registration details), and the Google Calendar API so staff can put their jobs on their own Google Calendar.

Not our provider: Square (Block, Inc.) processes each business's own card payments under that business's agreement with Square. What you type in Square's card form goes to Square directly.

6. Google user data

If you sign in with Google, we receive your name, email and Google account id, and use them only to sign you in.

Today, staff can subscribe to a private calendar feed of their jobs, or add a single job to Google Calendar with a link; neither gives Crewtide access to their Google account. When direct Google Calendar connection becomes available, Crewtide will ask for access only when a staff member taps Connect, and will use it only to add, update and remove that person's Crewtide jobs in their calendar. It won't read their other events. Calendar access tokens will be stored encrypted on our servers, never in the browser, and Disconnect (or deleting the account) will revoke access and delete them.

Crewtide's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide or improve the features you can see; it isn't transferred to others except as needed to provide those features, for security, or to comply with law; it isn't sold, used for advertising, or used to train generalized AI or machine-learning models; and no person reads it except with your permission for a specific support request, for security purposes, to comply with law, or in aggregated, de-identified form for internal operations.

7. Cookies and browser storage

Crewtide uses browser storage (local storage, IndexedDB and cookies) only to make it work: to keep you signed in, remember settings, cache data for speed and offline use, and check that requests come from the real app (reCAPTCHA Enterprise may set its own cookies for this). This website, crewtide.app, uses no cookies.

We don't use advertising cookies, tracking pixels or third-party analytics. If that ever changes, we'll update this policy first and ask for consent where required. We treat a Global Privacy Control signal as a request to opt out of sale and sharing for that browser (although we don't sell or share).

8. How long we keep it

9. Security and staff access

We use encryption in transit and at rest, database security rules that keep each business's data separate (tested automatically on every change), app-integrity checks, multi-factor authentication on our administrative accounts, and least-privilege access. No system is perfectly secure. If a breach affects your personal information, we'll notify the business and you, and regulators, as the law requires (for Florida residents, within 30 days).

Kinetic Coast staff don't routinely look at customer data. We can see it only in a read-only support session for one business, with a written reason, lasting at most 2 hours, recorded in that business's audit log, and only if the business allows support access. Details are in Part 4 of our terms. We read Help & Support requests to answer them.

Private booking links. Booking emails include a private link to view, reschedule or cancel that booking without signing in. Anyone with the link can do the same, so please don't forward it.

10. Your choices and rights

• Change or cancel a booking: use the link in your booking emails, or My Account.
• Delete your Crewtide login: My Account → Preferences → Delete account. To have a business delete your records there, ask the business.
• Texts (once available): reply STOP to stop texts from that business, or HELP for help.
• Email: booking emails are part of your booking; any marketing email has an unsubscribe link.
• Notifications: turn push notifications off in your device or browser settings.

Privacy rights for everyone in the US. You can ask us to tell you what personal information we hold about you and give you a portable copy; correct it; delete it; opt out of sale, sharing for targeted advertising and profiling (we don't do these, but you can still ask); limit the use of sensitive information (we already limit it); and appeal if we say no. Residents of California, Colorado, Connecticut, Virginia, Texas, Oregon, Montana and other states have these rights by law; we honor them for everyone, and we won't treat you differently for using them.

How to ask. Use the tools in Crewtide, or email contact@crewtide.app with the subject "Privacy request". We'll confirm it's you, usually through the email on your account, and answer within 45 days (we may extend once by 45 days where allowed, and we'll tell you). An authorized agent can ask for you; we may ask for your signed permission and to verify your identity directly. If your request is about records a business holds about you, we may pass it to that business and help it respond, because the business is in charge of that data.

Appeals. If we turn down your request, reply to our answer with "Appeal" in the subject, and we'll respond within 60 days. If you're still not satisfied, you can contact your state attorney general.

California "Shine the Light". We don't disclose personal information to third parties for their direct marketing.

11. California notice

This is our notice under the California Consumer Privacy Act. In the last 12 months we collected identifiers; customer records; commercial information; internet or network activity; and account login details (sensitive personal information), from the sources in section 2, for the purposes in section 3. We disclosed each category for a business purpose to the service providers in section 5. We have not sold or shared personal information, including of consumers under 16, and we use sensitive personal information only for purposes the CCPA regulations permit. How long we keep each category is in section 8.

12. Children

Crewtide isn't directed to children under 13, and we don't knowingly collect their personal information. Businesses must not use Crewtide to collect it (a parent may book for a child, but the contact details are the parent's). If you believe a child has given us information, email contact@crewtide.app and we'll delete it.

13. US only, and changes to this policy

Crewtide is offered only in the United States, and data is stored and processed in the United States. We'll post changes to this policy here with a new "Last updated" date. For material changes, we'll tell businesses by email and users in Crewtide before they take effect, and ask for consent where the law requires.

14. Contact

Kinetic Coast Studios LLC
7901 4th St N, Ste 300, St. Petersburg, FL 33702
contact@crewtide.app