Privacy Policy

Businesses use Crmb to run their operations. When your business adds its own records to Crmb, such as clients, jobs, materials, invoices, and team members, your business is the controller of that information, and Crmb processes it on your business’s behalf under your business’s instructions. If you are an employee or a client of a business that uses Crmb, please direct privacy questions to that business.

Account information. When you create an account or sign in, we collect your email address and, depending on how you sign in, your name. You can sign in with email and password, Sign in with Apple, or Google. If you use Sign in with Apple’s private relay, we receive only the relay address.

Profile information. Your display name, phone number, and an optional profile photo.

Your business’s operating records. The information your business enters to run its work, including clients and their contacts (names, emails, phone numbers, addresses, and notes), job sites, jobs and projects (scope, value, schedule, and assigned crew), inventory items and stock, suppliers and purchase orders, quotes and invoices, payments recorded, and team members with their pay configuration.

Time and shift information. Because Crmb shares a workspace with Punch, your business’s punch records flow into Crmb’s job costs, capacity, and reports. This can include the times a worker punched in and out, the job a shift was tied to, and, where the business has turned on geofencing, the location at the moment of a punch.

Subscription information. When you subscribe, the purchase is processed by Apple on iPhone and iPad, or by Stripe on the web and Mac. We receive confirmation of the plan and its status. We do not receive or store your full card number.

Device and usage information. Basic technical information needed to run the app and keep it reliable, such as device type, app version, and diagnostic and crash data.

Support information. If you contact support, we collect what you send us.

To provide and operate Crmb, including authentication, syncing your workspace across devices, computing job costs and reports from real punched hours, and processing subscriptions. To keep the service secure and reliable, including diagnosing crashes and preventing abuse. To communicate with you about your account, including confirmations and password resets. To comply with the law.

We do not sell your personal information, and we do not use it for advertising.

Crmb lets you optionally connect your Google account so you can send quotes, invoices, and purchase orders to your clients and suppliers from your own Gmail address, and mirror the shifts Crmb schedules for you into your Google Calendar. This connection is optional. You can disconnect it at any time from Settings, which revokes Crmb’s access.

• Sending email (Gmail). With your permission, Crmb requests the gmail.send scope. We use it only to send the specific messages you compose and choose to send from within Crmb, such as a quote or invoice to your client. We never read, search, or store the contents of your mailbox.
• Calendar sync (Google Calendar). With your permission, Crmb requests the calendar.events scope. We use it only to create and update calendar events for the shifts Crmb schedules for you. We only ever touch events that Crmb created; we do not read or change any of your other calendar entries.

We store only a secure connection token so these features keep working. Crmb’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not sell this data, use it for advertising, share it with third parties, or use it to develop, improve, or train generalized artificial-intelligence or machine-learning models.

We share information only with the service providers that make Crmb work, and only as needed:

• Supabase hosts our database and authentication.
• Apple processes in-app subscriptions on iPhone and iPad.
• Stripe processes subscriptions on the web and Mac.
• Resend delivers our transactional email.
• Sentry receives diagnostic and crash data so we can fix problems.

We may disclose information if required by law, to protect rights and safety, or in connection with a business transfer. We do not otherwise share your information.

Access to each business’s data is enforced at the database level by row-level security, so members of one business cannot see another business’s records. Data is encrypted in transit. We rely on the access controls and security practices of the providers listed above.

You can view and edit your profile and your business’s records in the app. You can delete your account from within the app, which removes your personal profile and the access tied to it. Depending on where you live, you may have rights to access, correct, or delete personal information. To exercise them, contact us at the address below. If your information was entered by a business that uses Crmb, contact that business, and we will support their response.

We keep information for as long as your account or your business’s workspace is active, and as needed to provide the service, comply with the law, resolve disputes, and enforce our agreements. When an account is deleted, we remove the associated personal profile and access.

Crmb does not run location tracking of its own. The only location data that appears in Crmb comes from Punch, and only at the moment of a punch on a job site where the business has turned on geofencing. There is no continuous or background location tracking, no photo taken at a punch, and no facial recognition.

Crmb is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 16.

Crmb is operated from the United States, and information is processed and stored in the United States. If you use Crmb from outside the United States, you understand that your information is processed in the United States.

We may update this policy. When we do, we will revise the effective date above, and significant changes will be communicated in the app or by email.

Questions about this policy or your information: crmbapp.support@gmail.com. Justyn Gomez