Privacy Policy

Last updated Jul 29, 2026

This Privacy Policy describes how Pacific Dev Labs LLC, d/b/a CrewMix ("CrewMix", "We", "Us", "Our") collects, uses, and discloses Your information when You use crewmix.app (the "Service"), and tells You about Your privacy rights and how the law protects You.

The short version: we collect what the product needs to work, we do not sell personal data, and your rate and estimate data is shared with third parties only as described below. By using the Service, You agree to the collection and use of information in accordance with this Privacy Policy.

1. Interpretation and Definitions

The words of which the initial letter is capitalized have meanings defined under the following conditions. For the purposes of this Privacy Policy:

• Account means a unique account created for You or Your organization to access the Service.
• Business, for the purpose of the CCPA/CPRA, refers to the Company as the legal entity that collects Consumers' personal information and determines the purposes and means of the processing of that information.
• CCPA/CPRA refers to the California Consumer Privacy Act (the "CCPA") as amended by the California Privacy Rights Act of 2020 (the "CPRA").
• Company ("We", "Us", "Our") refers to Pacific Dev Labs LLC, d/b/a CrewMix, 522 W Riverside Ave Ste N, Spokane, WA 99201-0581.
• Consumer, for the purpose of the CCPA/CPRA, means a natural person who is a California resident.
• Cookies are small files placed on Your Device by a website, containing details of Your browsing activity on that website among their many uses.
• Device means any device that can access the Service, such as a computer, a cellphone, or a digital tablet.
• Do Not Track (DNT) is a concept promoted by U.S. regulatory authorities for allowing internet users to control the tracking of their online activities across websites.
• Personal Data is any information that relates to an identified or identifiable individual. For the purposes of the CCPA/CPRA, Personal Data means any information that identifies, relates to, describes, or is capable of being associated with, or could reasonably be linked, directly or indirectly, with You.
• Service refers to CrewMix, accessible from https://crewmix.app.
• Subprocessor / Service Provider means a third party that processes data on behalf of the Company to help provide the Service, in accordance with a written contract that limits its use of the data to performing the services.
• Third-Party Sign-In Service means an identity provider (such as Google or Microsoft) through which You may create an account or log in to the Service.
• Usage Data refers to data collected automatically, generated by use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).
• You means the individual using the Service, or the organization on behalf of which the individual is using the Service.

2. Collecting and Using Your Personal Data

What We Collect

Account data. Your name, email address, company/organization name, and password (stored only as a strong, industry-standard one-way hash — We never store Your password in readable form). If You sign in through a Third-Party Sign-In Service (Google or Microsoft), We receive the identity information that provider shares, such as Your name and email address, and, where applicable, an identifier associating Your Account with that provider.

Business data (Your Content). The labor agreements, uploaded documents, wage rates, rate build-ups, schedules, and estimates Your organization enters or imports. This is Your data; We host and process it solely to run the product for You.

Payment data. Handled entirely by Our third-party payment processor. Card numbers never touch CrewMix servers. That information is provided directly to the processor, whose handling of it is governed by its own privacy policy and by the PCI-DSS standards managed by the PCI Security Standards Council. We store only the processor's identifiers, Your billing contact details, and Your subscription status.

Usage and audit logs. Sign-ins and changes to Your organization's data (who changed what, and when), plus standard technical logs. Usage Data may include Your Device's Internet Protocol (IP) address, browser type and version, the pages of the Service You visit, the time and date of Your visit, the time spent on those pages, unique device identifiers, and other diagnostic data. When You access the Service through a mobile device, We may collect similar information automatically, including the type of device, the IP address, and the mobile operating system and browser type.

Product analytics and session replay. We use first-party product analytics and session-replay tooling to operate, secure, debug, and improve the Service. Rate and estimate fields are masked in session replay, and passwords are never captured, so no estimate or rate data leaves the Service through analytics.

How We Use It

The Company may use Personal Data for the following purposes:

• To provide, maintain, and secure the Service and to manage Your Account and monitor its usage.
• For the performance of Our contract with You, including billing, processing payments through Our payment processor, and adding applicable sales tax.
• To perform AI-assisted agreement imports that You initiate (see "What AI Providers See").
• To contact You with transactional communications by email — such as verification, password-reset, and billing notices — and to respond to Your support requests and manage Your requests to Us.
• To understand and improve product usage through first-party analytics and session-replay tooling, and to identify usage trends and evaluate and improve the Service.
• To detect, prevent, and investigate security incidents, fraud, and misuse, and to protect the rights, property, and safety of the Company, Our users, and the public.
• To comply with legal obligations and to establish, exercise, or defend legal claims.
• For business transfers — to evaluate or conduct a merger, acquisition, financing, reorganization, or sale of some or all of Our assets, in which Personal Data may be among the assets transferred.

We may share Your personal information in the following situations:

• With Subprocessors / Service Providers, to perform the functions described in "How Third Parties Are Involved" below, under contracts that require them to keep the information confidential and use it only to provide their services to Us.
• For business transfers, in connection with, or during negotiations of, any merger, sale of Company assets, financing, or acquisition of all or a portion of Our business.
• With Affiliates, in which case We will require them to honor this Privacy Policy.
• For legal reasons and law enforcement, as described in "Disclosure of Your Personal Data" below.
• With Your consent, for any other purpose disclosed to You at the time.

We do not sell personal data, We do not share personal data for cross-context behavioral advertising, and We do not use Your business data for advertising.

3. What AI Providers See

When Your organization runs an AI agreement import, the uploaded document and its extracted text are sent to third-party AI document-processing providers to perform the extraction. This happens only when You run an import — never in the background. Under the API terms We use, these providers do not use Your data to train their models. Organizations that supply their own API key send imports directly under their own provider agreement, and that provider's handling of the data is governed by the organization's agreement with it.

4. How Third Parties Are Involved (Categories of Subprocessors)

We rely on a limited set of third-party service providers to operate the Service. Each processes data only on Our behalf, only to provide its service to Us, and under a contract that requires it to keep the data confidential. We disclose these providers by category of service rather than by name; the categories, their purpose, and the data involved are:

We will update these categories if the way We use service providers changes; the "Last updated" date above reflects the current version. On request to [email protected], We can provide more detail about the specific providers within a category.

5. Cookies and Tracking

CrewMix sets a signed session cookie that keeps You logged in — a session-type cookie administered by Us and essential to authenticate users and prevent fraudulent use of Accounts; without it, the Service cannot be provided. The public marketing pages set no cookies. The sign-in and signup pages use a bot-protection service (Cloudflare Turnstile) that processes Your IP address and browser metadata. Our first-party analytics and session-replay tooling runs inside the authenticated app, proxied through crewmix.app; it does not place advertising or cross-site tracking cookies.

You can instruct Your browser to refuse cookies or to indicate when a cookie is being sent; if You do not accept the session cookie, however, You will not be able to log in to or use the Service.

"Do Not Track"

Our Service does not respond to "Do Not Track" (DNT) browser signals. Some third-party websites do keep track of Your browsing activities; if You are visiting such websites, You can set Your browser preferences to signal that You do not want to be tracked.

6. Retention of Your Personal Data

The Company will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We keep Your data while Your organization has an Account. After a Subscription ends, the Account becomes read-only and data is retained for a reasonable export window before deletion. You can request deletion of Your organization's data at any time by emailing [email protected]; deleted data ages out of encrypted backups on the backup retention schedule. We will also retain and use Your Personal Data to the extent necessary to comply with Our legal obligations, resolve disputes, and enforce Our legal agreements and policies. Usage Data is generally retained for a shorter period, except where it is used to strengthen security or improve the functionality of the Service, or where We are legally obligated to retain it longer.

7. Deleting Your Personal Data

You have the right to delete, or to request that We assist in deleting, the Personal Data We have collected about You. You may update, amend, or delete Your account data at any time by signing in to Your Account and visiting the relevant settings, and You may export Your estimates as Excel workbooks at any time. You may also contact Us at [email protected] to request access to, correction of, or deletion of Personal Data You have provided. Please note that We may need to retain certain information where We have a legal obligation or lawful basis to do so.

8. Disclosure of Your Personal Data

Business transactions

If the Company is involved in a merger, acquisition, or asset sale, Your Personal Data may be transferred. We will provide notice before Your Personal Data is transferred and becomes subject to a different privacy policy.

Law enforcement

Under certain circumstances, the Company may be required to disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (for example, a court or a government agency).

Other legal requirements

The Company may disclose Your Personal Data in the good-faith belief that such action is necessary to: (i) comply with a legal obligation; (ii) protect and defend the rights or property of the Company; (iii) prevent or investigate possible wrongdoing in connection with the Service; (iv) protect the personal safety of users of the Service or the public; and (v) protect against legal liability.

9. Security and Breach Notification

The security of Your data is important to Us, and We use commercially reasonable technical and organizational measures to protect it in transit and at rest. See Our Security page for how data is protected and how to report a suspected vulnerability. No method of transmission over the Internet or method of electronic storage is 100% secure, and We cannot guarantee absolute security. If We become aware of a personal-data breach affecting You, We will notify affected account owners and any regulators as required by applicable law and without undue delay.

10. California Privacy Rights (CCPA/CPRA)

This section supplements the information in this Privacy Policy and applies solely to visitors, users, and others who reside in the State of California. Under the CCPA/CPRA, California residents have specific rights regarding their personal information.

Categories of personal information collected

The categories below are those defined in the CCPA/CPRA. Listing a category does not mean every example within it is collected; it reflects Our good-faith belief that some information in that category may be collected. In the preceding twelve (12) months, We have collected the following categories:

• Category A — Identifiers (e.g., real name, email address, account name, IP address, unique identifiers): Collected.
• Category B — California Customer Records information (e.g., name, billing address, and payment/financial information for billing): Collected.
• Category D — Commercial information (e.g., records of the subscription and services purchased or considered): Collected.
• Category F — Internet or other electronic network activity (e.g., usage events and interaction with the Service): Collected.
• Category L — Sensitive personal information (limited to Account login and password credentials — the password is stored only as a one-way hash): Collected.
• Categories C (protected classifications), E (biometric information), G (geolocation beyond IP-derived approximation), H (sensory data), I (professional/employment information about the individual as a consumer), J (non-public education information), and K (inferences/profiling): Not collected.

Personal information under the CCPA/CPRA does not include publicly available information from government records, deidentified or aggregated information, or information covered by certain sector-specific laws (such as HIPAA, the FCRA, or the GLBA).

Sources of personal information

We obtain personal information: directly from You (for example, the forms You complete and the Content You enter or import); indirectly and automatically from You (for example, by observing Your activity on the Service and through the session cookie); and from Service Providers (for example, the Third-Party Sign-In and payment providers acting on Your instruction).

Use and disclosure for business purposes

We use and disclose the personal information We collect for the "business purposes" described in the "How We Use It" and "How Third Parties Are Involved" sections above — including operating and securing the Service, billing, providing support, detecting and preventing security incidents and fraud, and complying with law. When We disclose personal information to a Service Provider for a business purpose, We do so under a contract that requires the recipient to keep the information confidential and to use it only to perform that service for Us. In the preceding twelve (12) months, We have disclosed Categories A, B, D, F, and L to Service Providers for these business purposes.

No sale or sharing of personal information

Under the CCPA/CPRA, "sell" and "share" cover disclosing personal information to a third party for monetary or other valuable consideration, or for cross-context behavioral advertising. We do not sell personal information, and We do not share personal information for cross-context behavioral advertising. We run no advertising, We serve no advertising cookies, and We do not disclose personal information to third parties for their own marketing. Because We do not sell or share, no "Do Not Sell or Share My Personal Information" opt-out link is required; You may nevertheless direct any question about Our practices to [email protected]. We do not knowingly sell or share the personal information of consumers under 16 years of age.

Your CCPA/CPRA rights

If You are a California resident, You have the right to:

• Notice — to be informed which categories of personal information are collected and the purposes for which they are used, at or before the point of collection.
• Know and access — to request that We disclose the categories and specific pieces of personal information We have collected about You, the categories of sources, Our business purposes for collecting it, and the categories of third parties to whom We disclose it.
• Correct — to request that We correct inaccurate personal information We maintain about You.
• Delete — to request that We delete personal information We have collected from You, subject to the exceptions permitted by law (for example, completing the transaction, detecting security incidents, debugging, or complying with a legal obligation).
• Limit the use of sensitive personal information — We use the limited sensitive information We collect (login credentials) only as necessary to provide the Service, which is within the permitted uses, so no separate limitation request is required; You may still contact Us with any question.
• Opt out of sale or sharing — as stated above, We do not sell or share personal information.
• Non-discrimination — You have the right not to receive discriminatory treatment for exercising any of these rights; We will not deny You service, charge different prices, or provide a different quality of service because You exercised Your rights.

Exercising Your CCPA/CPRA rights

To exercise these rights, contact Us at [email protected]. Only You, or a person registered with the California Secretary of State whom You authorize to act on Your behalf, may make a verifiable request. Your request must provide sufficient information to allow Us to reasonably verify that You are the person about whom We collected personal information (or an authorized representative), and describe Your request with enough detail to let Us properly evaluate and respond to it. We cannot respond to Your request or provide the required information if We cannot verify Your identity or authority and confirm that the personal information relates to You. We will respond within the time period required by law (generally within 45 days of a verifiable request, extendable once by an additional 45 days when reasonably necessary and with notice). Any disclosure We provide will cover only the 12-month period preceding Our receipt of the request. We do not charge a fee to process or respond to a verifiable request unless it is excessive, repetitive, or manifestly unfounded.

California "Shine the Light"

Under California Civil Code § 1798.83, California residents with an established business relationship with Us may request information once a year about Our disclosure of their personal information to third parties for those third parties' own direct-marketing purposes. We do not disclose personal information to third parties for their direct marketing. You may direct any Shine the Light request to [email protected].

11. Intended for the United States and Canada

The Service is offered to and intended for users in the United States and Canada. It is not directed to, or intended for, data subjects in the European Union, European Economic Area, or United Kingdom, and We do not knowingly offer the Service to them.

12. Data Location

Your information is processed and stored on servers located in the United States and in other jurisdictions where Our subprocessors operate, which may be outside Your state, province, or country. We take all steps reasonably necessary to ensure Your data is treated securely and in accordance with this Privacy Policy, and no transfer of Your Personal Data will take place to an organization or a country unless there are adequate controls in place, including the security of Your data. Your use of the Service and Your submission of information represent Your agreement to that processing and storage.

13. Children's Privacy

The Service is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 18, and the Service may not be used by anyone under 18. If We become aware that a person under 18 has provided Us personal information, We will delete it. If You believe a minor has provided Us personal information, please contact Us.

14. Links to Other Websites

The Service may contain links to other websites that are not operated by Us. If You click a third-party link, You will be directed to that third party's site. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party sites or services, and We strongly advise You to review the privacy policy of every site You visit.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify account owners of material changes by email and/or a prominent in-app notice before the change takes effect, and We will update the "Last updated" date above. You are advised to review this Privacy Policy periodically. Changes are effective when posted on this page.

16. Contact Us

Pacific Dev Labs LLC, d/b/a CrewMix — Spokane, Washington, USA.
[email protected]