Privacy Policy
Last updated: June 16, 2026
CrewLeadPro ("CrewLeadPro", "we", "us", or "our") provides a software-as-a-service platform that helps home-service contractors capture and manage leads, track visitor activity on their websites, and notify their staff about new inquiries. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and what choices you have.
We act as a service provider (under California law) and a data processor (under EU/UK law) for our contractor customers ("Tenants"). The contractors themselves are the controllers of the lead and visitor data submitted through their websites. If you are a homeowner or prospective customer of a contractor who uses CrewLeadPro, the contractor is primarily responsible for how your information is used; please contact them for any data requests in the first instance.
1. Who this policy applies to
- Tenant users - the contractor accounts who sign in to manage their leads.
- End-visitors - individuals who visit a contractor website that has the CrewLeadPro beacon installed.
- Leads - individuals who submit a contact form on a contractor website.
- Website visitors of crewleadpro.com - prospects who view our marketing pages.
2. Information we collect
2.1 Information Tenants give us directly
- Name, email address, password (stored as a hash, never in plain text).
- Display name, business name, time zone, notification preferences.
- Two-factor authentication secret (encrypted) and recovery codes (hashed).
- Optional Google account identifier if you sign in with Google.
- Tracking IDs you configure (Google Analytics, Google Ads, Meta Pixel, Microsoft Clarity, etc.).
- Mobile phone number (for SMS lead alerts, only if you opt in during onboarding).
- Billing information processed by our payment provider (Stripe). We never see or store full card numbers.
2.2 Information collected automatically from end-visitors via the beacon
When the CrewLeadPro beacon script is installed on a contractor's website, it collects the following information about people visiting that website:
- A randomly-generated visitor identifier stored as a first-party cookie (
clp_vid, 365-day expiry). - A session identifier stored as a first-party cookie (
clp_sid, 30-minute expiry). - URLs visited, page titles, document referrer, UTM campaign parameters.
- IP address and browser user-agent string (we summarize to a coarse "Chrome on Windows"-style label).
- Approximate geographic location derived from IP address (country, region, city).
2.3 Information collected when a lead form is submitted
- Name, email, phone, address fields, message body, photos, and any custom fields the form includes.
- The IP address and user-agent of the submitting browser.
- The visitor identifier (if the beacon has set one), so the contractor can see what pages the lead viewed before submitting.
2.4 Information we collect from our own crewleadpro.com marketing pages
- Standard server logs (IP, request URL, user-agent).
- If we ever add marketing analytics, we will disclose it here.
3. How we use the information
- To provide the service: store and display leads, attribute visits to leads, route notification emails and SMS.
- To secure your account: authenticate sign-ins, enforce two-factor authentication, rate-limit bruteforce attempts, write append-only audit logs of sensitive actions.
- To communicate with you: transactional emails (new-lead alerts, password resets, invoice receipts), SMS lead alerts (only if opted in), and occasional product update emails.
- To comply with law: respond to subpoenas, court orders, or other legal process.
- To improve the product: diagnose errors using application logs (which may contain IP, URL, and stack-trace data).
We do not sell personal information. We do not share phone numbers or SMS opt-in consent with third parties for marketing purposes. We do not use lead or visitor data to train artificial-intelligence models. We do not share data across Tenants - every Tenant is logically isolated.
4. Cookies and similar technologies
The CrewLeadPro beacon sets two strictly-necessary first-party cookies on the contractor site:
| Cookie | Purpose | Expiry |
|---|---|---|
clp_vid | Persistent visitor identifier for cross-session attribution | 365 days |
clp_sid | Session identifier (rolls every 30 minutes of inactivity) | 30 minutes |
The CrewLeadPro app itself sets a session cookie (clp.auth) to keep
Tenants signed in. These cookies are HttpOnly, Secure, and SameSite=Lax.
If the contractor site configures additional third-party tags through CrewLeadPro (Google Analytics, Meta Pixel, Microsoft Clarity, etc.), those vendors set their own cookies under their own privacy policies. The contractor is responsible for disclosing those cookies to end-visitors and obtaining consent where applicable.
5. Service providers and sub-processors
| Provider | Role | Data shared |
|---|---|---|
| DigitalOcean, LLC | Hosting (compute, managed Postgres) | All Tenant + lead + visitor data, encrypted at rest |
| SendGrid (Twilio Inc.) | Transactional email delivery | Recipient email + email body for notifications |
| Twilio Inc. | SMS delivery (lead alerts, transactional messages) | Recipient phone number + message body |
| Stripe, Inc. | Payment processing | Tenant billing email + payment card data (Stripe holds card data, not us) |
| Google LLC | Optional Sign in with Google for Tenant accounts | Email + name from your Google profile (only if you opt in) |
| Cloudflare, Inc. | DNS + edge proxy (when configured) | Network metadata only |
6. Data retention
- Lead data: retained as long as the Tenant subscription is active. Tenants can soft-delete individual leads via the dashboard; soft-deleted leads are hidden from view but retained for 30 days to support undo, then permanently removed.
- Visitor and pageview data: retained for 24 months, after which it is automatically purged.
- Audit logs: retained for at least 24 months for security forensics.
- Account data: retained until the Tenant cancels and requests deletion, then removed within 30 days.
- SMS opt-out records: retained indefinitely to honor previous opt-outs and avoid re-messaging.
- Backups: encrypted daily backups are retained for 14 days.
7. Security
We implement the following controls:
- HTTPS-only transport with HSTS.
- Cookie authentication scoped to the same origin (no JWT in browser storage).
- Cross-site request forgery defense via an X-Requested-With header check.
- Two-factor authentication available to every account; bruteforce rate limits on sign-in.
- Per-Tenant API keys with optional Origin allowlists for the public ingest endpoints.
- Encrypted-at-rest managed Postgres with automatic daily backups.
- Append-only audit log of sensitive actions (impersonation, member changes, API key creation/revocation, settings updates).
8. Your rights
Depending on your jurisdiction, you may have the right to:
- Access the personal information we hold about you.
- Correct inaccurate information.
- Delete your information (subject to legal retention requirements).
- Object to or restrict certain processing.
- Port your data to another provider.
- Withdraw consent at any time where processing is based on consent.
- Lodge a complaint with your local data-protection authority.
To exercise these rights, email [email protected]. If you are an end-visitor or a lead whose data was collected via a contractor website, please contact the contractor in the first instance; we will assist them in fulfilling your request.
9. California residents (CCPA / CPRA)
California residents have the right to know what personal information we collect, delete it, and opt out of any "sale" or "sharing" of personal information. We do not sell or share personal information for cross-context behavioral advertising. To submit a request, email [email protected]. We will verify your identity before fulfilling sensitive requests.
10. International data transfers
CrewLeadPro stores data on servers located in the United States. If you access the service from outside the United States, you consent to the transfer of your information to the United States for processing as described in this policy.
11. Children
CrewLeadPro is not directed to children under 16. We do not knowingly collect personal information from anyone under 16. If you believe we have collected information from a minor, please contact us and we will delete it.
12. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be announced at least 14 days in advance via email to active Tenants or a notice on the in-app dashboard. The "Last updated" date at the top of this page always reflects the current revision.
13. Contact
CrewLeadPro / Bindingstone LLCPrivacy inquiries: [email protected]
General inquiries: [email protected]