Privacy Policy

1. Introduction

Stepping Stone Systems LLC, doing business as CrewPather (referred to herein as ‘Company,’ ‘we,’ ‘us,’ or ‘our’), operates the CrewPather workforce management platform, accessible at crewpather.com and associated mobile applications (collectively, the ‘Service’).

This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and what rights you have regarding your data. By accessing or using the Service, you agree to the practices described in this Policy.

The Service is a B2B SaaS platform intended solely for use by businesses and their authorized personnel. All users must be at least 18 years of age.

2. Information We Collect

2.1 Client Onboarding Information

When a business (‘Client’) is onboarded onto the Service, we collect:

• Company name, business address, and primary contact information
• CEO / primary contact full name and email address
• Billing information (processed securely via Stripe — we do not store full card details)

2.2 Web Platform User Accounts (CEO, HR Admin, Operations Admin)

For users accessing the web dashboard, we collect:

• Full name and email address (mandatory)
• Phone number (optional)
• Role within the organization
• Password (encrypted — never stored in plain text)

2.3 Field Crew Mobile App Users

For field crew members using the mobile application, we collect:

• Full name (mandatory)
• Mobile phone number (mandatory)
• Email address (optional)
• Role or category (e.g., Crew Leader, Flagger)

2.4 Operational & Platform Data

In the ordinary course of using the Service, we collect and store:

• Job site names, project names, and map coordinates (used internally for scheduling and operations only — not shared externally)
• Work schedules, shift assignments, and crew availability
• Daily work logs including tasks performed and hours worked
• Expense records including mileage, food, equipment, and related costs
• Crew Stability Index (CSI) scores — internal worker reliability ratings
• GPS location data when field crew members are on an active job session via the mobile app

2.5 Automatically Collected Technical Data

• Device type, operating system, and app version
• IP address and approximate location
• Login timestamps and session activity logs

3. How We Use Your Information

We use collected information solely to operate, maintain, and improve the Service. Specific uses include:

• Authenticating users and managing account access
• Enabling scheduling, crew management, daily logs, expense tracking, and notification workflows
• Sending transactional communications — schedule updates, account alerts, OTP verification via Twilio
• Processing subscription payments via Stripe
• Displaying map-based crew and site views via Mapbox
• Sending system emails via Nodemailer / Google Workspace
• Providing customer support and responding to account inquiries
• Detecting and preventing unauthorized access or misuse of the Service
• Complying with applicable legal obligations

4. Third-Party Service Providers

We share data with the following trusted third-party providers solely to operate the Service. All providers are contractually bound to protect your data and use it only for services rendered to us:

We do not sell, rent, or trade your personal information to any other third parties beyond those listed above.

5. Authentication & Security

CrewPather employs the following authentication methods to protect user accounts:

• Email and password login for web platform users (CEO, HR Admin, Operations Admin)
• Phone number and password login for field crew mobile app users
• Email OTP for password resets and identity verification
• Google Authenticator (TOTP) as an optional two-factor authentication method

All passwords are stored using industry-standard hashing. We implement reasonable technical and organizational security measures to protect your data against unauthorized access, alteration, disclosure, or destruction.

6. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service.

Inactive Accounts: Accounts set to ‘Inactive’ status retain historical operational data for record continuity. Personal identifiers associated with inactive accounts are retained but not used for any active processing.

Data Deletion Requests: Users or Client administrators may request deletion of personal data by contacting us at support@crewpather.com. Because operational records (schedules, logs, expense entries, CSI history) are linked to historical data, deletion of personal identifiers may affect the completeness of these records. We will inform you of this impact before proceeding. We process deletion requests within 30 days of receipt.

7. Data Storage & Location

All data is stored on Amazon Web Services (AWS) infrastructure located in the United States (us-east-1 region). By using the Service, you consent to the storage and processing of your data in the United States.

8. Cookies & Tracking

The CrewPather web platform uses essential session cookies for authentication and security purposes only. We do not use advertising cookies, third-party tracking pixels, or behavioral analytics cookies. You may disable cookies in your browser settings; however, this may prevent access to the web dashboard.

9. Children's Privacy

The Service is a B2B platform intended exclusively for use by businesses and individuals who are at least 18 years of age. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal data, contact us immediately at support@crewpather.com and we will delete such information promptly.

10. Your Privacy Rights

Depending on your location, you may have the following rights with respect to your personal data:

• Right to Access — Request a copy of the personal data we hold about you
• Right to Correction — Request correction of inaccurate or incomplete data
• Right to Deletion — Request deletion of your personal data, subject to operational record requirements
• Right to Object — Object to certain processing activities
• Right to Data Portability — Request your data in a portable, machine-readable format

California residents may have additional rights under the California Consumer Privacy Act (CPRA). We do not sell personal data. We have not sold or disclosed consumer personal information for a business purpose in the preceding 12 months.

To exercise any of these rights, contact us at: support@crewpather.com. We will respond within 30 days of receiving a verifiable request.

11. Changes to This Policy

We reserve the right to update this Privacy Policy at any time. We will notify affected users of material changes via email or in-platform notification at least 14 days before changes take effect. The updated Policy will be posted at crewpather.com/privacy-policy with a revised effective date. Continued use of the Service after the effective date constitutes acceptance of the updated Policy.

12. Contact Us

For questions, concerns, or data requests regarding this Privacy Policy: