• The short version
• Who we are
• What goes into CrewBase
• If you are the one on the tools
• Why we hold it
• Where it is kept, and how it is protected
• Who can open it
• Location, and where it stops
• Who else touches it
• Cookies, and what is kept in your browser
• How long it is kept
• Seeing it, fixing it, complaining about it
• Changes to this policy

The short version

Your business owns what it puts in. We hold it so the software works, and for nothing else. We do not sell it, we do not use it for advertising, and we do not train anything on it.

The sensitive parts of a worker's record (tax file number, bank details, super, medical notes) are scrambled before they reach the database, with a key belonging to your business alone. The app cannot read them back in bulk. The rest of this page is the detail behind those two paragraphs, and the security page is the plain-English version of how it is built.

Who we are

CrewBase is workforce, plant and compliance software for businesses that build things. It runs at crewbase.com.au. This policy covers the whole service: the office app, the worker app, and this website.

CrewBase is operated by Adam Douglas Perry (ABN 27 550 932 338), based in Cairns, Queensland, Australia. That is who holds the information this policy covers.

What goes into CrewBase

The business account

The business name, the name and contact details of whoever opens the account, and billing details. Billing is always the business, never a worker.

Worker records

Put in by the business that employs you, not by us. Name and phone, the role, licences and tickets, and an emergency contact. If your employer uses CrewBase for onboarding, it also holds date of birth, email, address, tax file number, bank details, super fund details, and any work restrictions or medical notes your employer needs on file.

What happens on the job

Clock-ons and clock-offs, breaks, which job you clocked on to, signed pre-starts and safety forms, plant and machinery records, and photos attached to a docket or a certificate.

The technical basics

The standard things any web application records to stay working and stay secure: the kind of device and browser, and the IP address a request came from.

If you are the one on the tools

Your employer decides what goes in and why. We hold it for them so they can run timesheets, safety records and payroll properly. That means the first place to go about your own details is your employer. They can see them, change them and correct them, and we generally cannot do any of that on your behalf without them.

If that goes nowhere, come to us anyway. The bottom of this page says how.

Why we hold it

• To run the software: timesheets, pre-starts, plant records, and who is on which job.
• To give the business the records the law already requires it to keep.
• To bill the business.
• To answer support questions and to keep the service secure and working.

We do not sell it. We do not use it for advertising. We do not train anything on it.

Where it is kept, and how it is protected

The sensitive fields in a worker's record are encrypted before they are stored, one field at a time: tax file number, bank and super details, date of birth, address, emergency contact, and any medical or work-restriction notes.

Three things about that are worth saying plainly, because they are the parts that actually matter:

• It is scrambled on the way in. Readable text never reaches the database, so there is nothing in there to find.
• The key belongs to your business alone. One business's key opens one business's records and nothing else.
• The key is not kept with the lock. What unwraps your business's key is held outside the database entirely. A copy of the database on its own opens nothing.

Two fields are deliberately not encrypted at rest: a worker's name and phone number. They are read on nearly every screen in the office app, and they sit behind the same per-business fence as everything else. Certificates and docket photos are held in private storage with no public link to any of them.

Your records are stored in Australia. The database runs in Sydney, and that is where the records themselves stay. The pages and images that make up the app are delivered from servers around the world so it loads quickly wherever a crew is working, but that is delivery only. It is not where your data lives.

The database is backed up automatically every day, and the last 7 days are kept and can be restored from. Those backups are managed by our hosting provider, stored separately from the live system, and encrypted both on the way there and at rest.

One thing worth being straight about, because most people would assume otherwise. Those daily backups cover the records: your timesheets, pre-starts, plant records and paperwork. They do not yet cover the image files themselves, meaning certificates and docket photos. We are telling you that rather than letting "backed up daily" carry more than it should.

Who can open it

Your business's records are fenced off from every other business's, and the fence is in the database rather than in the screens, so a fault in a page cannot hand a row to the wrong company.

Inside a business, what someone can open is read off their membership as they ask for it, not taken from their login and not remembered from earlier in the day. Taking somebody's access away takes effect immediately. Bank and tax details sit behind their own separate permission: an admin without it gets the rest of a worker's record and not those fields, and a worker cannot be given that permission at all.

On our side, access to customer data is limited to what is needed to run the service and to answer a support request.

Location, and where it stops

CrewBase records where a worker clocked on. It does not follow him home.

While a bloke is on the clock the app takes a location fix. Sitting on a break it stops. Clocked off it stops. That is not a checkbox somebody in the office can quietly turn on either: the database itself refuses to record a location for anyone who is not on the clock at that moment. The live view page shows what the office actually sees during the day.

Who else touches it

Running the service means a handful of other companies hold parts of it on our behalf. Each one is here because the software needs it, and each is bound to use it only for that:

• Supabase runs the database and the sign-in system, in Sydney, Australia. This is where the records live.
• Vercel hosts this website and the app.
• Cloudflare sits in front of the service and runs the check that tells a person from a script.
• Resend delivers the emails the service sends: invitations, password resets, and replies to messages you send us.
• Stripe processes subscription payments. Stripe sees billing details. It never sees worker records.
• Xero, and only if you connect it yourself. When you send an approved week to Xero, the worker's name, the dates and the hours go with it. Pay rates do not: CrewBase does not hold them. Nothing is ever sent to Xero unless someone in your office presses the button, and nothing comes back from it.
• PostHog counts which features get used, so we build the right things. It is hosted in the United States, and it is deliberately set up so it should never receive a worker's personal details: automatic click capture is off, and only the events we choose are sent.
• jsDelivr delivers some of the app's code to your browser, the way a courier delivers a part. It serves files. It does not receive your records.
• OpenStreetMap's Nominatim service turns a job site's street address into a position on the map, so it receives job-site addresses. It never receives worker records.
• Nobody else, unless the law requires it of us.

Cookies, and what is kept in your browser

This website sets no cookies at all and loads nothing from anybody else: no fonts, no scripts, no trackers from another company. The app keeps what it needs in your browser to remember that you are signed in, and to remember the choices you have made in it.

There are no advertising cookies and no advertising trackers anywhere in CrewBase.

One more thing sits in the browser: the app's usage counting (PostHog, named above) stores an identifier so returning use counts as one person rather than a crowd. It is not an advertising tracker.

How long it is kept

While the account is running, and for as long after as the business needs it to meet its own record-keeping obligations. Timesheets and safety records are things an employer has to keep for years, so this is not a case where the shortest answer is the best one.

If payment stops, the account does not go dark. There is a grace period, and after it the account goes read-only: no new clock-ons or forms go in, and everything already in there can still be opened and read.

When your subscription ends, your records stay readable to you, read-only. Records the law requires your business to keep, like time and wage records which must be held for 7 years, are retained for that period. Where no legal obligation applies, we delete data on request, and we'll help you get your data out.

Seeing it, fixing it, complaining about it

You can ask what we hold about you and ask for it to be corrected. If you are a worker, start with your employer, because they control the record and they can fix it faster than we can. If that gets you nowhere, come to us.

If you are not happy with how we handle a complaint, you can take it to the Office of the Australian Information Commissioner at oaic.gov.au.

Privacy questions, requests to see what we hold, and corrections all go to support@crewbase.com.au.

Changes to this policy

If we change this in a way that matters, we will tell account holders before the change applies, rather than after. The date at the top says when it was last changed.

The terms of service cover the rest of the relationship: the trial, billing, and who owns what.