Privacy Policy

Last updated: July 4, 2026

This Privacy Policy describes how Groundcrew ("we," "us," or "our") collects, uses, and protects information when you use our platform ("Service"). We are committed to protecting your privacy and handling data transparently.

1. Information We Collect

Information you provide

  • Account data: email address and organization name when you sign up via magic link authentication
  • Uploaded content: Statements of Work (SOWs) and related project documents
  • Project data: client names, email addresses, project names, and onboarding details you enter
  • Integration credentials: OAuth tokens for connected services (Asana)

Information collected automatically

  • Usage data: pages visited, features used, timestamps
  • Device data: IP address, browser type, operating system
  • Error data: crash reports and performance metrics via Sentry

Information from third parties

  • Authentication providers: Supabase Auth provides your verified email
  • Connected tools: workspace and project metadata from Asana when you connect your account

2. How We Use Information

  • Provide, maintain, and improve the Service
  • Process uploaded SOWs using AI extraction (OpenAI)
  • Create and manage project plans in your connected tools
  • Send transactional emails: magic links, OTP codes, chase reminders
  • Monitor errors and performance
  • Enforce our Terms of Service and protect against abuse

3. AI Processing

We use OpenAI's API to extract structured data from your uploaded SOWs. Document content is sent to OpenAI for processing and is subject to OpenAI's API data usage policy. OpenAI does not use data submitted via their API to train models. We do not use your documents to train our own models.

4. Data Sharing

We share data only as follows:

  • Service providers: Supabase (database & auth), OpenAI (extraction), Resend (email), Upstash (rate limiting), Vercel (hosting), Sentry (error tracking)
  • Connected tools: data you explicitly push to Asana or other integrations
  • Your clients: project-specific information visible in client portals
  • Legal compliance: when required by law, subpoena, or to protect rights and safety

We do not sell personal information to third parties.

5. Data Storage & Security

Data is stored in Supabase (hosted on AWS) with row-level security policies. Files are stored in encrypted cloud storage. All data in transit uses TLS 1.2+. We implement rate limiting, input validation, security headers (CSP, HSTS, X-Frame-Options), and authentication checks on all protected endpoints.

6. Data Retention

  • Account data: retained while your account is active, deleted within 30 days of account termination
  • Uploaded documents: retained until you delete them or terminate your account
  • Portal access logs: retained for 90 days
  • Error logs: retained for 30 days

7. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate data
  • Delete your data ("right to be forgotten")
  • Export your data in a portable format
  • Object to or restrict certain processing
  • Withdraw consent at any time

To exercise these rights, email privacy@groundcrew.online. We will respond within 30 days.

8. Client Portal Users

If you access Groundcrew through a client portal, your email address and portal activity are processed on behalf of the organization that invited you. For questions about how your data is used, contact the organization directly. We act as a data processor on their behalf.

9. International Transfers

Data may be processed in the United States. By using the Service, you consent to transfer of data to the US. We rely on standard contractual clauses and service provider agreements to protect transferred data.

10. Children's Privacy

The Service is not intended for individuals under 18. We do not knowingly collect data from children.

11. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes via email or in-app notice. The "Last updated" date at the top reflects the most recent revision.

12. Contact

For privacy-related inquiries: privacy@groundcrew.online