Privacy Notice

What we collect and why

• Account data — name, work email, company name, phone, trade, and login credentials. Used to create and secure your account and provide the Service. Legal basis: performance of our contract with you.
• Business and bid content — tender documents, labour rates, signatory details, exclusions and compliance certificates (WCB, COR, CGL). Used to produce your proposals. Legal basis: contract performance.
• Enquiry data — details you submit when booking a discovery call or contacting support. Used to respond to you. Legal basis: legitimate interests / steps prior to a contract.
• Usage and technical data — pages viewed, actions in the portal, device and browser information, IP address. Used for security, fraud prevention, troubleshooting and improving the product. Legal basis: legitimate interests.

Payment card details are collected and processed by Stripe, not by us — we never see or store your full card number.

Who we share it with

• Payment processor — Stripe, for payments, subscription management, invoicing and tax compliance.
• Service providers — our hosting, database, file storage, scheduling and AI-drafting providers, acting on our instructions.
• Professional advisers — legal and accounting, where necessary.
• Authorities — where required by law.

We do not sell your personal data.

International transfers

Some of our providers process data outside Canada, including in the United States and the European Union. Where data leaves Canada we rely on contractual safeguards with those providers requiring a comparable level of protection.

Retention

We keep account and bid data for as long as your account is active and for up to 24 months afterwards, so you can retrieve past proposals. Billing and tax records are kept for as long as Canadian law requires. When data is no longer needed we delete or anonymise it. You can ask us to delete your account data sooner.

Security

We use appropriate technical and organisational measures, including encryption in transit, access controls, row-level database permissions so accounts can only reach their own records, and private storage buckets accessed through short-lived signed links.

Cookies

We use essential cookies and local storage to keep you signed in and remember portal preferences. We record basic page-view analytics to understand how the site is used. We do not run third-party advertising cookies. You can clear or block cookies in your browser, though the portal will not stay signed in without the essential ones.

Your rights

Under Canadian privacy law (PIPEDA and provincial equivalents) you can ask for access to the personal data we hold about you, ask us to correct inaccurate data, withdraw consent where we rely on it, and complain to the Office of the Privacy Commissioner of Canada. If you are in the UK or EEA, you additionally have rights of erasure, restriction, portability and objection, and may complain to your local supervisory authority. We respond to requests within 30 days.

To exercise any of these rights, email lucas@thecrewhq.ca.