Privacy policy

Companies and their team members who sign up for or are invited to Craft Operator. The company that invites you controls its workspace and decides who on its team can see what.

A company's customers (the homeowners and businesses it serves). We store their details on the company's behalf and only use them to run that company's work. Questions about that data are best sent to the company first; we'll help them answer.

• Account details: your name, email address, phone number, role, password (stored as a one-way hash, or handled by our sign-in provider), profile photo, and your company's name, address, logo and settings.
• Work records your company enters: customers' names, addresses, phone numbers and emails; jobs, estimates, invoices, line items, notes, photos and the customer signatures captured on site.
• Location: when you use the phone app while on shift (clocked in, or travelling to or working on a job), it records your device's precise location, including in the background, so your office can see the crew on the live map and plan routes. Off shift the app does not send your location. You can turn location sharing off in the app or in your phone's Settings.
• Hours: clock-in and clock-out times, breaks, and the location where you clocked in or out.
• Payments: when a customer pays an invoice online, the card or bank details go directly to Stripe; we never see or store full card numbers. We keep the amount, date, method and a Stripe reference. Cash and check payments your team records are stored the same way.
• Device and usage data: a push notification token for your phone, your device type and app version, sign-in times, IP address, and error logs, used to keep the service working and secure.

• To run the service: schedule and dispatch work, send estimates, invoices, reminders and notifications, record hours and payments.
• To show your company's admins and office staff where the crew is while they're working.
• To keep accounts secure, prevent abuse, fix bugs and answer support requests.
• To bill your company for its subscription.

We don't sell personal information, we don't use it for advertising, and the phone app does not track you across other companies' apps or websites.

• Your company: admins and office staff see the company's records, the crew's live location and everyone's hours. Technicians see the work assigned to them, not the company's costs or other people's hours.
• Customers: see only the estimates and invoices sent to them, through a private link.
• Service providers that run parts of Craft Operator for us, under contract and only for that purpose: Stripe (online payments), Polar (subscription billing), WorkOS and Google (sign-in), Resend (email), Twilio (text messages), UploadThing (photo storage), Mapbox (maps, addresses and routes), Neon (database), Render and Vercel (hosting), Apple (push notifications), and Intuit QuickBooks if your company connects it.
• When the law requires it, for example a valid court order, or to protect people's safety.

We keep a company's records while its account is open, so its job, invoice and payment history stays complete. Location history is kept with those records. When a person or a company is deleted we remove their personal details right away and delete the remaining data within 30 days, except records we must keep for tax, accounting or legal reasons.

• Your own account: in the phone app go to Account → Delete my account, or on the web go to Settings → Account → Delete my account. Your login, name, email and phone are removed; the work you did stays with your company.
• A whole company: an admin can delete it from Settings → Account → Delete company.
• Anything else, including a copy of your data or a correction: email support@craftoperator.com. We answer within 30 days.

Depending on where you live (for example California or the EU) you may have extra rights to access, correct, delete or move your data, and to object to how it's used. Email us and we'll help, without charging you or treating you differently.

Data is encrypted in transit (HTTPS), passwords are never stored in readable form, each company's data is kept separate, and access inside a company follows each person's role. No system is perfectly secure; if we learn of a breach affecting your data we'll tell you promptly.

Craft Operator is for businesses and isn't meant for anyone under 16. We don't knowingly collect children's data.

If we change this policy in a way that matters, we'll update the date above and tell account admins by email before it takes effect. Questions or requests: support@craftoperator.com, or see the support page.