Privacy Policy

1. Introduction

This Privacy Policy explains how Broad Arrow, Inc. (dba “CrewSheet,” “we,” “us,” or “our”) collects, uses, and protects information when you use the CrewSheet scheduling and communication platform (“Service”). By using our Service, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

We collect only the information strictly necessary to make the Service function properly:

• Account information — name, email address, and authentication credentials when you sign up or log in via Google or Microsoft OAuth.
• Organization data — company name, team members, and configuration settings you provide.
• Crew member data — names, phone numbers, email addresses, and role designations that you enter for your workforce.
• Schedule and communication data — job assignments, message templates, and communication history generated through use of the Service.
• Usage data — log data, browser type, and general usage patterns to maintain and improve the Service.

3. How We Use Your Information

We process personal data only under these legal grounds:

• To provide and maintain the Service, including sending SMS and email communications on your behalf.
• To fulfill our contractual obligations to you.
• To comply with legal requirements.
• For legitimate business purposes, such as improving the Service and providing customer support.

4. How We Store Your Data

Your data is stored securely using Supabase (PostgreSQL) hosted infrastructure with encryption at rest and in transit. We retain only the data essential for full Service functionality. If you request deletion of your data, please contact us at help@crewsheet.io.

5. How We Share Your Data

We will never sell your data. We share data with third parties only when strictly necessary to provide the Service:

• SMS delivery — phone numbers and message content are transmitted to our SMS provider to deliver messages you initiate.
• Email delivery — email addresses and message content are transmitted to our email provider (Resend) to deliver messages you initiate.
• Authentication — we use Supabase Auth with Google and Microsoft OAuth. Your authentication tokens are managed by these providers.

We do not share, transfer, or sell any other data to third-party services or companies.

6. Crew Member Privacy

Crew members whose contact information is entered into the Service do not create accounts or log in. Their phone numbers and email addresses are used solely for delivering schedule notifications and announcements initiated by authorized operators within your organization. We do not contact crew members independently or use their information for marketing purposes.

7. Data Security

We implement industry-standard security measures including encrypted connections (TLS), row-level security policies for multi-tenant data isolation, and secure authentication via OAuth providers. However, no method of electronic transmission or storage is 100% secure.

8. Your Rights

You have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data (note: this will close your account).
• Export your data in a standard format.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page with a revised “Last updated” date.

10. Contact Us

If you have questions about this Privacy Policy, contact us at help@crewsheet.io.