Privacy Policy

Businesses use Crmb to run their operations. When your business adds its own records to Crmb, such as clients, jobs, materials, invoices, and team members, your business is the controller of that information, and Crmb processes it on your business’s behalf under your business’s instructions. If you are an employee or a client of a business that uses Crmb, please direct privacy questions to that business.

Account information. When you create an account or sign in, we collect your email address and, depending on how you sign in, your name. You can sign in with email and password, Sign in with Apple, or Google. If you use Sign in with Apple’s private relay, we receive only the relay address.

Profile information. Your display name, phone number, and an optional profile photo.

Your business’s operating records. The information your business enters to run its work, including clients and their contacts (names, emails, phone numbers, addresses, and notes), job sites, jobs and projects (scope, value, schedule, and assigned crew), inventory items and stock, suppliers and purchase orders, quotes and invoices, payments recorded, and team members with their pay configuration.

Time and shift information. Because Crmb shares a workspace with Punch, your business’s punch records flow into Crmb’s job costs, capacity, and reports. This can include the times a worker punched in and out, the job a shift was tied to, and, where the business has turned on geofencing, the location at the moment of a punch.

Subscription information. When you subscribe, the purchase is processed by Apple on iPhone and iPad, by Google Play on Android, or by Stripe on the web and Mac. We receive confirmation of the plan and its status. We do not receive or store your full card number.

Online invoice payments. If your business turns on online payments, your clients can pay your invoices by card or bank transfer. These payments are processed by Stripe through your business’s own Stripe account (Stripe Connect), and funds are paid out directly to your business. Crmb never holds or transfers the money. We receive the payment’s status, amount, date, and processing fee, and how it was paid (for a card, its brand and last four digits), so the invoice can be marked paid. We do not receive or store your clients’ full card or bank account numbers.

Bank account connections. If you choose to connect a bank account for bookkeeping, the connection is made through Plaid. You sign in to your bank through Plaid, and we never see or store your bank login. We receive the connected account’s name, the last four digits of the account number, its balances, and its transactions (date, description, merchant, category, and amount), which Crmb uses only to keep your books. This is read-only: Crmb cannot move money. You can disconnect a bank account at any time in the app, which stops further imports.

Device and usage information. Basic technical information needed to run the app and keep it reliable, such as device type, app version, and diagnostic and crash data. Our apps (Android, iPhone, iPad, and Mac) and the web app also record a small set of product-usage events — for example, that the app was opened, which screen was viewed, or that a subscription was started — so we can see which features people use and where sign-up gets stuck. These events carry your account ID, your role, the app version and platform, and counts and yes/no values only. They never carry your name, email, phone number, dollar amounts, or any of your business’s records. On Android you can turn this off at Settings → Privacy → Share usage analytics.

Support information. If you contact support, we collect what you send us.

To provide and operate Crmb, including authentication, syncing your workspace across devices, computing job costs and reports from real punched hours, processing subscriptions, recording your clients’ online invoice payments, and importing bank transactions you choose to connect for bookkeeping. To keep the service secure and reliable, including diagnosing crashes and preventing abuse. To understand how the app is used so we can improve it, using the product-usage events described above. To communicate with you about your account, including confirmations and password resets. To comply with the law.

We do not sell your personal information. We do not use your business’s records or your activity inside the app for advertising. The only advertising measurement we do is on our public website, where the Meta pixel reports that a sign-up happened (see “Analytics on our public website” below).

Crmb lets you optionally connect your Google account so you can send quotes, invoices, and purchase orders to your clients and suppliers from your own Gmail address, and mirror the shifts Crmb schedules for you into your Google Calendar. This connection is optional. You can disconnect it at any time from Settings, which revokes Crmb’s access.

• Sending email (Gmail). With your permission, Crmb requests the gmail.send scope. We use it only to send the specific messages you compose and choose to send from within Crmb, such as a quote or invoice to your client. We never read, search, or store the contents of your mailbox.
• Calendar sync (Google Calendar). With your permission, Crmb requests the calendar.events scope. We use it only to create and update calendar events for the shifts Crmb schedules for you. We only ever touch events that Crmb created; we do not read or change any of your other calendar entries.

We store only a secure connection token so these features keep working. Crmb’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not sell this data, use it for advertising, share it with third parties, or use it to develop, improve, or train generalized artificial-intelligence or machine-learning models.

We share information only with the service providers that make Crmb work, and only as needed:

• Supabase hosts our database and authentication.
• Apple processes in-app subscriptions on iPhone and iPad.
• Google Play processes in-app subscriptions on Android.
• Stripe processes subscriptions on the web and Mac, and processes your clients’ online invoice payments through your business’s Stripe account.
• Plaid connects bank accounts you choose to link, for read-only bookkeeping.
• Resend delivers our transactional email.
• Sentry receives diagnostic and crash data so we can fix problems.
• PostHog receives the product-usage events from our apps and the web app described above, so we can understand how the app is used. It never receives your name, email, or your business’s records.
• Google Analytics and Meta receive visit data from our public website pages only, never from inside the app (see “Analytics on our public website”).

We may disclose information if required by law, to protect rights and safety, or in connection with a business transfer. We do not otherwise share your information.

On the public pages of crmb.io (the home page, feature pages, the blog, pricing, and sign-up) we use Google Analytics and the Meta pixel to understand how people find the site and which pages they read: pages viewed, the device and browser, how a visitor arrived, and whether a sign-up came from an ad. These tools set cookies and use identifiers of their own, and Google and Meta receive this information under their own privacy policies (Google, Meta).

Neither tool runs inside the signed-in Crmb app or on the sign-in page. Your business’s records, what you type into search boxes, the invoices and links you share, and your navigation inside the app are never sent to Google or Meta.

You can block these tools with your browser’s cookie settings, the Google Analytics opt-out add-on, and your Meta ad settings.

Access to each business’s data is enforced at the database level by row-level security, so members of one business cannot see another business’s records. Data is encrypted in transit. We rely on the access controls and security practices of the providers listed above.

Crmb and Punch share one account and one workspace, operated by the same company. No separate Punch account is created when you sign up for Crmb, and no information is shared with any other company by this design. Deleting your account — from either product — deletes the shared account and the personal data attached to it across both. Deleting your organization removes its business records and ends any subscriptions attached to it, in both products, in one step.

You can view and edit your profile and your business’s records in the app. You can delete your account from within the app, which removes your personal profile and the access tied to it. Depending on where you live, you may have rights to access, correct, or delete personal information. To exercise them, contact us at the address below. If your information was entered by a business that uses Crmb, contact that business, and we will support their response.

You can delete your Crmb account and its personal data at any time, from any version of Crmb:

1. Open Crmb (Android, iPhone, iPad, Mac, or crmb.io) and sign in.
2. Go to Settings.
3. Scroll to Danger zone and tap Delete account, then confirm.

If you are the only owner of a business that still has other members, Crmb asks you to make someone else an owner first (or leave that business), so the business is not left without an owner.

Can’t sign in? Email crmbapp.support@gmail.com from the address on your account with the subject “Delete my account,” and we will delete it within 30 days.

What is deleted: your login, your profile (name, email address, phone number, and profile photo), your notification and app settings, your push-notification registrations, any Google account connection, and your membership in every business. A business where you were the only member is deleted with you, including its records. Crmb and Punch share one account, so this deletes it in both.

What is kept: records that belong to a business with other members — such as clients, jobs, invoices, payments, and tasks — stay with that business, because the business owns them; where a record pointed at you (for example as its creator or assignee), that link is cleared. Your past shift and pay records in that business keep your name on them, so the business’s payroll history stays complete, as labor law requires. We keep a record that the account was deleted (your name, email address, the reason you gave, and the date) so we can answer questions about the deletion. Purchase records held by Apple, Google Play, or Stripe are kept by them under their own policies, and we may keep limited records where the law requires it (for example, tax or billing records), for as long as the law requires.

We keep information for as long as your account or your business’s workspace is active, and as needed to provide the service, comply with the law, resolve disputes, and enforce our agreements. When an account is deleted, we remove the associated personal profile and access.

Crmb does not run location tracking of its own. The only location data that appears in Crmb comes from Punch, and only at the moment of a punch on a job site where the business has turned on geofencing. There is no continuous or background location tracking, no photo taken at a punch, and no facial recognition.

Crmb is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 16.

Crmb is operated from the United States, and information is processed and stored in the United States. If you use Crmb from outside the United States, you understand that your information is processed in the United States.

We may update this policy. When we do, we will revise the effective date above, and significant changes will be communicated in the app or by email.

Questions about this policy or your information: crmbapp.support@gmail.com. CRMb Industries LLC