SpendCrew Privacy Policy

This policy explains what personal information SpendCrew collects, why it is collected, who it is shared with, how long it is retained, and the rights you have over it. It applies to the SpendCrew mobile application and the SpendCrew website, together referred to in this policy as the Service.

In brief: SpendCrew is a job costing tool for contractors. To provide that service, it stores the receipts you photograph, the jobs and customers you record, and the expenses you enter. Receipt images, job names and customer names are transmitted to OpenAI so their content can be read and matched to the correct job automatically. SpendCrew does not sell personal information, does not use it for advertising, and does not share it with data brokers. You may export or permanently delete your data from within the application at any time. The sections below describe each of these points in full, and are the version that governs if any summary and the full text appear to conflict.

For the purposes of applicable data protection law, including the UK and EU General Data Protection Regulation, the data controller responsible for the personal information described in this policy is the operator of SpendCrew. Any question about this policy, or any request concerning your personal information, should be sent to support@spendcrewapp.com, which is monitored directly by the controller. The full legal name of the controller is available on request to that address, and to any user, regulator, or other party legally entitled to it.

Because you provide it

• Your email address, used to sign in and to contact you about the service.
• Your business name.
• Jobs you create: name, address, notes, material budget, and the customer name you attach.
• Receipts you photograph: the image itself, and the merchant, date, item descriptions and amounts read from it.
• Expenses you type in by hand.

Because the app records how it is used

SpendCrew keeps a limited usage log so the accuracy of its receipt reading can be measured and improved. This includes, for example, how many items were read from a receipt, how long that processing took, and how many of the app’s suggestions you corrected.

This log is built exclusively from a fixed list of permitted fields. Receipt images, item descriptions, merchant names, customer names, addresses and amounts are not on that list and cannot enter it: any field not explicitly named is discarded before the record is written, rather than filtered afterward. This is enforced in code, not by policy alone.

When you contact support

If you contact us by email, we retain your address, your message, and any attachment you choose to include, for as long as reasonably necessary to resolve the matter and to maintain a record of the exchange. Please do not send passwords, payment card numbers, or similar sensitive information by email. We never require them and cannot securely receive them by that means.

Automatically, to operate and protect the Service

Our infrastructure providers generate the ordinary technical records that any web or mobile application produces in the course of operation: IP address, device and browser type, application version, timestamps, sign in events, and error logs. These records exist to keep the Service operating reliably and to detect and prevent misuse.

What is never collected

• Payment card numbers, bank details or card images. SpendCrew reads what you bought, not how you paid.
• Your location. The app never requests it.
• Your contacts, calendar, or activity in other apps.
• Advertising identifiers. There is no advertising and no cross-app tracking.

SpendCrew engages a small number of third party service providers, sometimes called processors, to operate the Service. Each is contractually restricted to using your information solely to provide its service to SpendCrew, and none is permitted to use it for their own independent purposes, to sell it, or to use it to train their own models except where stated otherwise below.

OpenAI: reading your receipts

When you photograph a receipt, the image is transmitted to OpenAI to be transcribed. A second request then sends the item descriptions from that receipt together with your active job names and the customer names attached to them, so the Service can suggest which job each item belongs to.

This is the most significant disclosure described in this policy, and it is stated plainly for that reason: a receipt may reveal where you shop and what you purchase, and your job list identifies your customers by name. Both leave our systems for this specific purpose and no other.

OpenAI processes this information under the terms of its commercial API agreement, which prohibits using submitted content to train its models. The account’s data sharing settings were last verified on 22 August 2026, and every optional sharing setting is disabled. OpenAI may retain the request for a limited period for abuse monitoring purposes, consistent with its own published retention practices.

Supabase: storing your data

Your account, jobs, receipts, and receipt images are stored using Supabase. Receipt images are held in private storage that is not publicly accessible. Each business’s data is isolated at the database level using row level security, so one account cannot read another’s data under any circumstance the application itself controls.

Vercel: running the Service

The application is hosted and served by Vercel, which handles requests between the application and its database and maintains standard infrastructure logs in the ordinary course of providing that hosting.

If the business changes hands

If SpendCrew, or substantially all of its assets, were sold, merged, or otherwise transferred, your information would transfer as part of that transaction. You would be notified before any such transfer takes effect, and any acquiring party would remain bound by the terms of this policy until you are given notice of a change to it.

Nobody else

Your information is not sold, rented, or shared with advertisers, data brokers, or analytics companies. The Service contains no third party advertising or tracking technology. Information is disclosed to a public authority only where SpendCrew is legally compelled to do so, and any such request is scrutinized before being honored.

SpendCrew is operated from the United States, and the infrastructure described in this policy stores and processes personal information there. If you access the Service from the United Kingdom, the European Economic Area, or another jurisdiction outside the United States, your personal information will be transferred to, and processed in, the United States.

Where such a transfer is subject to the UK or EU General Data Protection Regulation, it is made on the basis of the safeguards made available under each processor’s own data processing terms, which are designed to provide a level of protection for personal information equivalent to that required under such law, including the use of standard contractual clauses where applicable. You may contact us at any time for further information about the specific safeguard relied upon for a given transfer.

If you are located in the European Economic Area or the United Kingdom and consider that your personal information has been processed in a manner inconsistent with applicable law, you have the right to lodge a complaint with your local data protection supervisory authority, in addition to any right to contact us directly.

The website uses cookies strictly necessary to keep you signed in. They hold your session identifier and nothing else. There is no advertising cookie, no tracking pixel, and no third party analytics script anywhere on the website or within the application.

Because this is the only function these cookies serve, blocking them will prevent you from remaining signed in to the Service.

The iPhone app asks for the camera so you can photograph a receipt, and for photo access if you would rather pick an image you already have. Both are optional and both are controlled in your iPhone’s settings, where you can withdraw them at any time. Declining the camera means you cannot capture a receipt with it; nothing else is affected.

The app does not ask for your location, contacts, calendar, microphone, or anything else.

Personal information is processed and stored in the United States. The database and receipt images are held in Supabase’s East US region. See the section on international transfers above for how this applies if you use SpendCrew from outside the United States.

Receipts, jobs, customers, and all records derived from them are retained for as long as your account remains open, and are removed when you delete the individual record or delete the account itself, as described below.

Support correspondence is retained while a matter is being handled and for a reasonable period afterward for record keeping purposes. Technical and security logs are retained briefly by the providers named above, under their own published retention schedules. The usage log described above is deleted together with your account.

Within the application, open Settings, then Delete account. You will be asked to type DELETE to confirm the request.

This permanently removes your business, every job, every customer, every receipt and its line items, every allocation, every manual expense, your usage log, and every receipt photograph. Deletion occurs immediately and cannot be reversed, and we retain no copy from which the account could later be restored. Residual copies may persist briefly in routine infrastructure backups maintained by our hosting providers, and are overwritten in the ordinary course of their backup cycle.

If you would like a record of your data before deleting it, use Settings, then Export CSV, which provides a complete spreadsheet of every cost recorded in your account.

Depending on where you live, you may have some or all of the following rights in relation to your personal information: the right to be informed of how it is used, the right to access a copy of it, the right to have inaccurate information corrected, the right to request its erasure, the right to restrict or object to certain processing, and the right to receive it in a portable format.

SpendCrew is built so that you can exercise most of these rights yourself, without waiting on a request: the application displays everything it holds about your jobs, receipts, and expenses, allows you to edit or delete individual records at any time, exports the complete record as a spreadsheet on request, and permanently deletes the account and all associated data on request. For any right you cannot exercise directly within the application, contact support@spendcrewapp.com and we will respond within the time required by applicable law.

Personal information about your customers. When you record a customer’s name within SpendCrew, you are entering that individual’s personal information into the Service. As between you and SpendCrew, you remain solely responsible for having a lawful basis to collect and process that information under the law applicable to your business. Customer names are included in the request to OpenAI described above, and you are responsible for informing your own customers of this where required by law.

Several states, including California, Colorado, Connecticut, Virginia, Texas and others, give residents specific rights over personal information. Where such a law applies, you may ask us to confirm what we hold, give you a copy, correct it, delete it, or provide it in a portable form.

We do not sell personal information, and we do not share it for targeted or cross-context behavioural advertising. There is no advertising in SpendCrew and no third-party tracking, so there is nothing to opt out of. If that ever changes, this page changes first and you will be given a way to opt out.

We will not treat you differently for exercising any of these rights. Email support@spendcrewapp.com to make a request; we may need to confirm who you are before acting on it. If we turn a request down you may ask us to look at it again, and we will reply with our reasons.

If we discover a security incident affecting personal information, we will investigate it promptly, take reasonable steps to contain and limit any resulting harm, and notify affected individuals and the relevant regulators without undue delay where required by applicable law.

SpendCrew mentions shops and software by name, and may link to other sites. We do not control how those companies handle information. Once you leave SpendCrew, their policy applies, not ours. Naming them does not mean they are connected with us.

SpendCrew is a tool for running a business. Accounts are for adults (our terms of service require you to be at least 18) and we do not knowingly collect information from children under 13. If you believe a child has provided information through SpendCrew, email support@spendcrewapp.com and we will remove it.

All connections to the Service use HTTPS encryption. Receipt images are held in private storage that is not publicly accessible. Database access is restricted on a per account basis and enforced by the database itself, not only by the application layer, and that isolation is verified by automated tests run against the live system. No system can be guaranteed to be completely secure, and this section describes the measures we have taken rather than a warranty of absolute security.

We may update this policy from time to time. If a change is material, particularly one that expands who your information is shared with or where it is sent, the date at the top of this page will be updated and you will be notified within the application before the change takes effect. Continued use of the Service after a change becomes effective constitutes acceptance of the revised policy.

The terms of service cover what SpendCrew does, what it does not do, and the limits of what it can promise. The two are meant to agree with each other; if you ever find they do not, tell us and we will fix it.

support@spendcrewapp.com