Privacy Policy

Effective date: July 25, 2026 · Applies to: VeraCrew (“Veracrew,” “we,” “us”) web properties and SaaS services

Counsel action required: This page is an engineering-aligned draft. Have counsel rewrite Privacy and the customer DPA from the retention matrix in docs/data-retention-and-deletion.md and the jurisdiction packs in docs/legal-drafts/. Do not treat this page as final legal advice.

This policy describes personal and organizational information we process when you use Veracrew, including when you visit our marketing site or use the subscribed product. Customer organizations (employers) typically act as the primary controllers of worker data; Veracrew provides the multi-tenant SaaS platform.

Categories of information we collect

• Account identifiers. Name, email address, hashed password credentials, OAuth profile basics when signing in via Google, and two-factor authentication state for elevated roles.
• Organization operational data. Crews, schedules, time entries, job activity, compliance documents you upload, messages, invoices, and related audit events.
• Location signals. Geolocation associated with clock-in / time-tracking when your organization enables those features.
• Usage and telemetry. Product analytics (for example PostHog) subject to deployment configuration and masking.
• Support and transactional records. Email via transactional providers (invites, reminders, billing notices) and subscription metadata from Stripe. We do not store full card numbers.
• Security signals. Cloudflare Turnstile during registration and similar public-boundary checks; application and error logs via configured observability tools.

Why we process data

• Operate, secure, troubleshoot, and improve the service.
• Authenticate users and enforce organizational access controls.
• Bill organizations and reconcile subscription state through Stripe.
• Communicate about service changes, outages, onboarding, or legal obligations.
• Meet regulatory, auditing, fraud-prevention, and contractual requirements.

Cookies and analytics

We rely on strictly necessary cookies and similar storage for authentication, CSRF/session continuity, feature flags, analytics, or experimental insights. At minimum we may use PostHog for product instrumentation and Stripe.js or Turnstile iframes as required by those integrations. Detailed cookie tables should be finalized with counsel.

Processors and subprocessors

Representative infrastructure and software vendors powering Veracrew include:

• Stripe for payments and subscription billing.
• Managed PostgreSQL (for example Neon) for primary application storage.
• Cloudflare R2 for document and image object storage (S3-compatible API).
• Resend (or analogous email transports) for automated mail.
• PostHog for analytics and experimentation.
• Cloudflare for edge security and bot challenges (Turnstile).
• Vercel (or equivalent) for application hosting.
• Upstash Redis for rate limiting and short-lived operational keys when enabled.
• Observability vendors such as Sentry for error reporting.

A dedicated subprocessors ledger should be published with the customer DPA. Until then, requests for the latest disclosure should go through Veracrew support referenced in onboarding correspondence.

Retention and deletion

Soft-delete (marking a record deleted) is not the same as permanent erasure. Veracrew uses grace periods, anonymization, legal holds, and scheduled jobs. Current product behavior includes:

• Users: after soft-delete and a 30-day grace period, personal identifiers are anonymized (“tombstoned”) — for example email replaced with an @tombstone.invalid address and display as former-worker-…. The user row id is retained so payroll, time, and audit history stay intact. We do not hard-delete the user row.
• Invoices and time entries: default ~7-year legal hold before hard-delete eligibility. Soft-delete alone does not remove them; after a 90-day soft-delete grace and when the hold has expired, scheduled jobs may hard-delete (invoice PDFs are queued for object-storage deletion in the same step).
• Messages, notifications, and activity feed rows: time-bounded retention (defaults on the order of 90 days to ~2 years depending on type) then hard-delete via scheduled purge, unless an organization legal hold freezes purge.
• Organizations: soft-deleted organizations are not automatically wiped by nightly jobs. After ~30 days they enter an internal review queue for operator handling. There is no silent automatic org hard-delete.
• Cancelled subscriptions: a ~90-day export-oriented grace is tracked from the cancellation audit event; at the end we stamp archival state. We do not silently hard-delete the tenant at that moment.
• Files in object storage: removed through a queued deletion worker when the related database record is hard-deleted, plus a weekly orphan scan for unreferenced objects older than seven days.

Exact schedules and exceptions for diligence are summarized for engineers and counsel in Veracrew’s internal retention matrix. Customer contracts must not promise shorter retention than legal holds encoded in the product.

Rights requests

Workers should generally start with their employer (the organization admin). Organization administrators can contact Veracrew through the onboarding or billing email on file to access, rectify, export, or request erasure of personal information subject to eligibility, employment-record exceptions, and legal holds. In-product audit export (where the plan includes it) helps admins review security-relevant events; it is not a complete substitute for every jurisdiction’s data-subject package. Regulatory timelines vary; we endeavor to respond within commercially reasonable periods after verification.

International transfers

Veracrew is operated using cloud infrastructure that may include United States regions and global edge networks. Organizations outside those regions authorize transfers pursuant to contractual clauses and Standard Contractual Clauses when required. Jurisdiction-specific drafts (Canada PIPEDA, Quebec Law 25, GDPR, US state privacy) are maintained for counsel in Veracrew’s legal-draft pack before publication.

Questions

Contact support@veracrew.com for privacy questions from organization administrators. Workers should generally start with their employer. Security-specific topics are also covered on the Security overview page.