Privacy Policy
This policy explains what Pacific Dev Labs LLC, d/b/a CrewMix ("CrewMix", "we") collects when you use crewmix.app, why, and who else touches it. The short version: we collect what the product needs to work, we sell nothing, and your rate and estimate data is shared with third parties only as described below.
1. What we collect
- Account data — your name, email address, company name, and password (stored only as a strong, industry-standard one-way hash).
- Business data — the labor agreements, wage rates, rate build-ups, schedules, and estimates your organization enters or imports. This is your data; we host and process it to run the product.
- Payment data — handled entirely by Stripe. Card numbers never touch CrewMix servers. We store only Stripe's identifiers and your subscription status.
- Usage and audit logs — sign-ins and changes to your organization's data (who changed what, when), plus standard technical logs (IP address, browser type) for security and debugging.
2. How we use it
To provide and secure the Service, to bill you, to send transactional email (verification, password resets, billing notices), to respond to support requests, and to understand product usage in aggregate. We do not sell personal data and we do not use your business data for advertising.
3. What AI providers see
When your organization runs an AI agreement import, the uploaded agreement PDF and its extracted text are sent to our AI subprocessor (Anthropic, or Google as an alternative provider) to perform the extraction. This happens only when you run an import — never in the background. Under the API terms we use, these providers do not use your data to train their models. Organizations that supply their own API key send imports directly under their own provider agreement.
4. Cookies
CrewMix sets one cookie: the signed session cookie that keeps you logged in. There are no advertising or cross-site tracking cookies. The public marketing pages set no cookies at all. The sign-in and signup pages use Cloudflare Turnstile for bot protection, which processes your IP address and browser metadata.
5. Subprocessors
These vendors process data on our behalf:
| Vendor | Purpose | Data involved |
|---|---|---|
| Stripe | Payment processing, subscription billing, and sales tax | Name, email, billing address, payment card (never touches CrewMix servers) |
| Resend | Transactional email (verification, password reset, billing notices) | Name, email address, email content |
| Anthropic | AI agreement extraction (platform-key imports) | Uploaded agreement PDFs and extracted text, only when your organization runs an AI import; not used to train models per API terms |
| AI agreement extraction (alternative provider) | Uploaded agreement PDFs and extracted text, only when your organization runs an AI import; not used to train models per API terms | |
| Railway | Application hosting, database, and file storage | All application data, encrypted at rest |
| Cloudflare | DNS, TLS proxy, and bot protection (Turnstile) on the sign-in and signup pages | IP address, browser metadata |
| PostHog | Product analytics (first-party, proxied through crewmix.app) | Usage events, user id, organization id — no estimate or rate data |
We will update this list when subprocessors change; the "Last updated" date above reflects the current version.
6. Retention and deletion
We keep your data while your organization has an account. After a subscription ends, the account becomes read-only and data is retained for a reasonable export window before deletion. You can request deletion of your organization's data at any time by emailing [email protected]; deleted data ages out of encrypted backups on the backup retention schedule.
7. Your rights
You can access and correct your account data in the app, export your estimates as Excel workbooks at any time, and request a copy, correction, or deletion of your personal data by email. Depending on where you live, you may have additional statutory rights; we honor verified requests to the extent the law provides them.
8. Security
See our Security page for how data is protected in transit and at rest, and how to report a vulnerability.
9. Changes and contact
We may update this policy; material changes will be announced to account owners by email. Questions and requests: [email protected] — Pacific Dev Labs LLC, d/b/a CrewMix, Spokane, Washington, USA.