Start Free Trial

Privacy Policy

Last updated: October 4, 2026

Crew Rivet ("we," "us," or "our") is operated by Avion LLC, a California limited liability company. This Privacy Policy describes how we collect, use, and share information when you use our platform at crewrivet.com and related services (the "Service").

1. Information We Collect

Information You Provide

  • Account Information: Name, email address, phone number, business name, and trade when you create an account.
  • Customer Data: Contact information (names, phone numbers, email addresses, addresses) for your customers that you add to the Service.
  • Financial Information: Invoice amounts, payment records, line item descriptions, expense records, and receipt photos. Payment processing is handled by Stripe; we do not store credit card numbers. If you enable instant payouts via Stripe Connect, Stripe collects your banking information directly — we never access or store your bank account details.
  • Communications: Text messages sent and received through the Service, voice notes uploaded for quote and invoice drafting.

Information Collected Automatically

  • Usage Data: Pages visited, features used, and actions taken within the Service. Our self-hosted, cookieless Plausible analytics counts page visits on this website and in the app (page, referring site or campaign, browser, country) as aggregate totals with no personal identifiers.
  • Device Information: Browser type, operating system, and IP address.
  • Message Delivery Data: Delivery status, timestamps, and carrier information for SMS messages sent through the Service.

2. How We Use Your Information

  • To provide, maintain, and improve the Service.
  • To send SMS messages, invoices, quotes, reminders, and review requests on your behalf to your customers.
  • To process payments through our payment processor (Stripe).
  • To classify inbound messages using AI to route them appropriately.
  • To draft quotes, invoices and summaries with AI, and — when you turn these features on — to answer your customers' calls (AI receptionist) and website chats with AI.
  • To transcribe voice notes for quote and invoice drafting.
  • To send you account notifications and support communications.
  • To send account owners product emails — getting-started tips, trial reminders, milestones, payment-setup reminders and the weekly Business Report (you can turn these off in Settings or with the unsubscribe link).
  • To monitor service health and prevent fraud or abuse.

3. How We Share Your Information

We do not sell or share (as those terms are defined by the California Consumer Privacy Act) your personal information. We share information only with:

  • Service Providers (Subprocessors): providers that process information solely to perform services on our behalf, under contracts imposing data-protection obligations at least as protective as ours. These include: Stripe (payments and payouts), Telnyx (SMS and voice, including the AI receptionist), Resend (transactional and notification email), Chatwoot (website support chat, self-hosted by us), browser push services (Google, Apple, Mozilla) for push notifications, map geocoding, map and weather services for dispatch, routing and the customer tracking page (OpenStreetMap Nominatim and map tiles, unpkg, Open-Meteo), Hetzner (cloud hosting and infrastructure), and Backblaze B2 (encrypted off-site backup storage). Errors are reported to GlitchTip, an error monitor we host ourselves. If you connect an integration, the data you sync is shared with that provider: QuickBooks Online (new connections are paused for maintenance) or Xero for customers and invoices, Google Calendar for your jobs (title, time, customer name, address and notes). Xero and Google Calendar sync one way, from Crew Rivet to them. A full, current list is on our Subprocessors page.
  • AI Providers: most AI features use Anthropic (Claude) first — drafting quotes and invoices from voice notes or typed notes, voicemail summaries (the transcript and the caller's phone number), neighborhood marketing suggestions (the job's address), the in-app help chat. If Claude is unavailable, our own self-hosted models take over; these features never fall back to Groq. Groq is the first choice for reading text from document photos, review-reply drafts (which include the customer's name) and forecast summaries, and reads photos our own model can't; Claude reads a photo quote only when neither can. Redacted receptionist call transcripts go to Anthropic for quality review. Speech-to-text runs on our own Whisper server first, with Groq as the backup. Message classification and the website chat widget run only on our own self-hosted models. We use Anthropic and Groq under their commercial terms, under which your data is not used to train their models. The live phone receptionist is powered by Telnyx's voice-AI platform (including Deepgram speech-to-text), which processes the call audio and transcript in real time to understand and respond to callers.
  • Independent Third Parties: our payment processor (Stripe) and consumer-financing partners (Wisetack or Hearth, if you enable financing) act as independent controllers of information you or your customers provide directly to them, and their use of that data is governed by their own privacy policies. Financing is a link only: it carries the amount (and, for Wisetack, an invoice or quote reference), and we do not receive or store your customer's application.
  • Your Customers: When you use the Service to send invoices, quotes, reminders, or review requests, your business information is shared with the recipients.
  • Legal Requirements: When required by law, subpoena, or to protect our rights.

A current list of our subprocessors is available on our Subprocessors page, or on request at privacy@crewrivet.com.

4. SMS/Messaging Consent

When you use Crew Rivet to send messages to your customers:

  • You are responsible for obtaining proper consent from your customers before sending them messages through the Service.
  • Recipients can opt out at any time by replying STOP to any message. We automatically process opt-outs and cease all messaging to that number.
  • We comply with TCPA, CTIA, and carrier guidelines for SMS messaging.
  • Mobile information is never sold or shared for marketing. Crew Rivet (Avion LLC) does not sell, share, or transfer mobile phone numbers, SMS opt-in, or consent — whether collected by us for our own messages or by a business using the Service — to any third party or affiliate for their own marketing or promotional purposes. Mobile opt-in information is used solely to deliver the messages the recipient agreed to receive.
  • Message frequency varies based on the sequences you configure (e.g., invoice reminders, review requests).
  • Standard message and data rates may apply to recipients.

5. Data Retention

  • Account data is retained while your account is active. If you cancel or your free trial ends, your account data is kept until you request deletion; items with their own schedule (such as recordings, transcripts and GPS pings) keep expiring on that schedule. A deletion request locks the account right away and erases it within 30 days; backups age out within about 30 days after that. Invoices you send your customers are your own business records: export them first, because they are erased with the account. Crew Rivet's own billing records for your subscription are kept for 7 years for tax purposes. Proof of messaging and recording consent and monthly audit-log archives are kept for up to 7 years to comply with law and defend legal claims.
  • Backups: encrypted offsite copies of the database and stored files (recordings, photos, e-signatures) are kept about 30 days in Backblaze (US-East); local copies on our app server about 28 days, protected like the live data.
  • Message records are retained for the life of your account and are deleted when you delete your account.
  • Call recordings, call and voicemail transcripts, and the caller's name and address captured by the AI receptionist are retained for up to 90 days — per your recording-retention setting of 30, 60, or 90 days — then automatically deleted, including the copies in your conversation thread, owner summary texts and in-app notifications. What the caller asked for (the service, timing and job details) stays with the lead record, and the caller's name and number on their contact record and any job booked are kept as part of your customer records. Copies already delivered to your phone or email are outside our control. Basic call-log entries (caller number, date, and duration) are kept as part of your account records until you delete your account.
  • Audit logs are kept for 90 days in the live system; an encrypted monthly archive that cannot be altered is kept offsite for 7 years.
  • Business phone numbers we provision for you are kept while your plan or free trial is active. If it ends, they are released at least 30 days later, after two email warnings to the account owner, unless you choose a plan before then; a released number cannot be recovered.
  • If you are an account holder (a contractor), the account owner can export the account's data or permanently delete the account at any time from Settings in the app, or by contacting us. The export is a ZIP with your data and files: a spreadsheet for each part of your account with every record (no limit), plus the files stored with it (call recordings, voicemails, voice notes, photos, e-signatures and receipts). A README inside lists what is left out on purpose (passwords and other sign-in or connection secrets, private link codes, payment and phone-carrier reference numbers, and our internal logs); for anything else, email privacy@crewrivet.com and we will provide it within 30 days. If you are a homeowner or customer of a contractor who uses CrewRivet, see “Your Rights” below.

6. Cookies

We use cookies and similar technologies to:

  • Essential Cookies: Maintain your login session and remember your preferences (theme, language). These are required for the Service to function.
  • Support Chat (Functional): Our live-chat widget — self-hosted Chatwoot at chat.aviontechs.com — sets a first-party cookie so a support conversation stays continuous as you move between pages or come back later. It is used only to run the chat you start, never for advertising or cross-site tracking.
  • Analytics: Within the app, we use privacy-respecting product analytics (PostHog, which stores a ph_* identifier that is removed if you opt out) and error monitoring to understand how the Service is used and to fix problems. On this website and in the app we count page visits and sign-ups by the campaign they came from with our self-hosted, cookieless Plausible analytics (aggregate totals only, for every visitor — it collects nothing that identifies you, so it is not affected by the opt-out); we do not use Google Analytics. Product analytics in the app is optional — we honor a Global Privacy Control (GPC) signal and ask for your consent where required, and you can decline it without affecting your ability to use the Service.
  • Customer portal: when your customers sign in to their portal, a cr_portal cookie keeps them signed in for 7 days (used only on the portal).
  • No advertising trackers: Our marketing website (crewrivet.com) ships no advertising or third-party ad-tracking cookies — no Meta (Facebook) pixel, and no Google Analytics (its traffic analytics are self-hosted and cookieless). We do not sell your data, and we do not run cross-site behavioral advertising or profile you across unrelated websites.

Browser storage on this website: we remember your theme (cr_theme) and which version of the homepage you were shown (cr_ab_hero) in your browser's local storage, and — for the current visit only — the campaign link you arrived from and whether you have already seen our sign-up pop-up. None of it identifies you. The campaign tags, any referral code and the homepage version are added to our sign-up links; if you create an account, the campaign you came from is saved with it, while the homepage version is only counted in Plausible.

Disabling essential cookies may affect your ability to use the Service.

7. Data Security

We implement industry-standard security measures including:

  • Encryption in transit (TLS/HTTPS).
  • The database runs on the same server as the app, is not exposed to the internet, and its connections never leave that machine.
  • Row-level security for multi-tenant data isolation.
  • Bcrypt password hashing (cost factor 12) with per-user salts.
  • Webhook signature verification for all inbound events.
  • Daily backups, plus continuous database archiving, encrypted before they leave the server and stored in Backblaze B2 (US-East).

8. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access the personal information we hold about you.
  • Request correction of inaccurate information.
  • Request deletion of your information.
  • Export your data in a portable format.
  • Opt out of certain data processing activities.

9. Location Data

For users of the crew tracking feature, we collect GPS location data:

  • Location is collected only during active work sessions when tracking is enabled by the account owner.
  • Location data is used for dispatch, route optimization, and customer-facing technician tracking: a tracking link shows your customer the job and the assigned team member's name, and — only after that team member taps "On my way", until they arrive — their live location (positions sent after "On my way" only). The link expires 12 hours after "On my way", or at the end of the scheduled day if "On my way" is never sent. The tracking page loads map images from OpenStreetMap and its map library from unpkg, which see the viewer's IP address and the map area shown.
  • Continuous location-tracking data (the real-time position updates recorded while a worker is clocked in) is retained for 30 days, then automatically deleted. A single location captured at a clock-in or clock-out is kept as part of that timesheet and job record, for as long as the job record is retained, so it can be used to verify the visit later.
  • Employees and contractors can see when tracking is active via the Service interface.
  • Account owners are responsible for informing their workers about location tracking and obtaining any required consent.

10. Voice & Call Recording

Crew Rivet includes optional voice features — voice notes for AI quote generation and, where you enable it, an AI voice receptionist and call recording.

  • When the AI receptionist talks with a caller, the call begins by telling them they are speaking with a virtual assistant, followed by a notice that the call may be recorded (if you record calls) or may be monitored or transcribed; every such caller hears it, wherever they are calling from. Before a voicemail is recorded (in voicemail mode, when your plan's receptionist minutes run out, or from the call menu), callers hear that the call may be recorded, and calls forwarded to you are recorded only after a recording notice plays.
  • Call recordings are stored securely and retained for up to 90 days — per your recording-retention setting of 30, 60, or 90 days — then automatically deleted along with the call transcript and the caller's name and address the AI receptionist captured (Section 5 lists exactly what is kept).
  • Voice notes for AI quotes and invoices are transcribed; a quote's transcript is removed on the same schedule as call recordings, and the audio recordings are kept until you delete your account.
  • The AI receptionist and the website chat widget talk with your customers without approving each message; AI drafts (quotes, invoices, review replies) are presented to you for review before anything is sent. Missed-call text-backs and new-lead auto-replies (the latter only to callers who agreed to texts) are fixed template texts (not AI-written) sent automatically by default; for returning callers you can switch the text-back to review-first or off. If auto-booking is on, the receptionist books the job and sends the confirmation.
  • We do not extract voiceprints or use voice data for biometric identification. We comply with the Illinois Biometric Information Privacy Act (BIPA).

Two-party consent states (all parties must consent to recording): California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Oregon, Pennsylvania, and Washington — and any other state that requires all-party consent. If your business operates in — or places or receives calls to or from customers in — these states, you must enable recording disclosures. Crew Rivet provides configurable pre-call announcements for compliance, but you are responsible for determining which state's laws apply based on the location of both parties.

11. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

Categories of Personal Information We Collect

  • Identifiers: Name, email, phone number, IP address.
  • Customer Records (Cal. Civ. Code 1798.80(e)): Name, address, phone number.
  • Commercial Information: Transaction records, subscription data, invoice history.
  • Internet/Electronic Activity: Pages visited, features used, interactions with the Service.
  • Geolocation Data: GPS coordinates (crew tracking feature only, when enabled).
  • Professional/Employment Information: Job title, business name, trade.

Your CCPA Rights

  • Right to Know: Request what personal information we collect, use, disclose, and the sources and purposes of collection.
  • Right to Delete: Request deletion of your personal information, subject to certain legal exceptions.
  • Right to Correct: Request correction of inaccurate personal information.
  • Right to Opt Out: Opt out of the sale or sharing of personal information. We never sell or share your personal information for advertising. Our marketing site runs no advertising pixels or ad-tracking cookies, so there is nothing to opt out of.
  • Right to Limit: Limit use of sensitive personal information (such as precise geolocation) to what is necessary to provide the Service.
  • Right to Non-Discrimination: We will not deny you the Service, charge different prices, or provide a different quality of service for exercising your rights.

How to Exercise Your Rights

Submit a request by emailing privacy@crewrivet.com with the subject line "CCPA Request." We will verify your identity and respond within 45 days (with a possible 45-day extension if needed).

For homeowners and customers of a contractor: If you are a customer of a contractor who uses CrewRivet and want to exercise rights over data a contractor stored about you, please contact that contractor directly. The contractor is the data controller for that information; CrewRivet acts as their service provider (processor) and will assist the contractor in fulfilling your request.

12. Do Not Sell or Share My Personal Information

Avion LLC does not sell your personal information to third parties. We run no advertising cookies or tracking pixels (no Meta/Facebook pixel, no Google Analytics) on our marketing site, and we do not share your personal information for cross-context behavioral advertising. Our third-party service providers (such as Stripe, Telnyx, and Resend) receive information only as necessary to provide their services under contractual obligations.

13. Data Processing Responsibilities

When you use the Service to collect and manage information about your customers, employees, and contractors:

  • You are the data controller for that information. CrewRivet processes it on your behalf.
  • You are responsible for providing privacy notices to your end users about how their data is used.
  • You are responsible for obtaining any required consents for data collection through the Service.
  • We will cooperate with you in responding to data subject requests from your end users.

14. Children's Privacy

The Service is not directed to individuals under 13. We do not knowingly collect information from children under 13. If we learn we have collected such information, we will delete it promptly. Contact us at privacy@crewrivet.com if you believe a child has provided us with personal information.

15. International Users & Data Location

Our app and database are hosted by Hetzner in Hillsboro, Oregon (United States), and our encrypted backups are stored in the United States by Backblaze B2. A second server we run in Nuremberg, Germany handles error monitoring, website analytics, website support chat, speech-to-text and document text recognition, so error reports, page-visit counts, support chats, and audio and document images being transcribed or read are transferred to Germany. Our subprocessors (for example Stripe, Telnyx, Resend, Anthropic and Groq) process data in the United States or wherever they operate. By using the Service, you consent to such transfers.

16. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide at least 30 days' notice via email or in-app notification. The "Last updated" date at the top indicates when changes were last made.

17. Contact Us

If you have questions about this Privacy Policy or your data, contact us at:

Avion LLC
Email: privacy@crewrivet.com
For CCPA requests: email privacy@crewrivet.com with subject "CCPA Request"
Website: crewrivet.com