Start Free Trial

Subprocessors

Last updated: November 6, 2026

Crew Rivet is operated by Avion LLC. To run the platform we rely on a small number of third-party vendors (service providers and subprocessors, and some vendors we use under their standard terms) that may process personal or business data. This page lists them, what each is used for, and the data it may touch. We describe only providers actually in use, plus past providers that received, or may have received, data in the last 12 months (marked as past). Some past recipients were third parties, not our subprocessors; they are listed separately at the end.

We use or used some of them under their standard terms of service, not under a data processing agreement with us, including the public map, weather, QR-code, font and script services, Google's Places API (our outreach searches), browser push services, the internal-alert services Telegram and Discord (Discord until October 22, 2026), GitHub (error-report issues, and our support triage until October 24, 2026), FormSubmit (our website contact form until October 1, 2026) and Sentry (our API error monitoring until October 2, 2026, and possibly our app's, on its server and in the browser). Because we have no data processing agreement with those vendors, they may count as third parties rather than service providers under California law (see our Privacy Policy).

Some services below are engaged only if you choose to connect them (for example, syncing your own Google Calendar or QuickBooks). Where a service is optional, it is marked as such.

Core infrastructure

  • Hetzner — cloud hosting. Our app and database server is in Hillsboro, Oregon (United States) and may process any data you store in Crew Rivet. A second server we run in Nuremberg, Germany hosts our error monitoring (GlitchTip), website analytics (Plausible, until October 10, 2026), website support chat (Chatwoot), speech-to-text (Whisper), document text recognition and our automations (n8n), including outreach; it processes error reports, page-visit counts, support chats, outreach records about businesses we contact, and audio and document images while they are transcribed or read. (United States / Germany)
  • Cloudflare — content delivery, DNS, TLS, and bot/abuse protection (Turnstile) for the website and app, analytics for this website (Cloudflare Web Analytics, no cookies), and email routing for our domains. Processes request metadata such as IP addresses; for website analytics, the page address without its query string, referring page, country, browser, operating system, device type and page-load timings; and email sent to our domains' addresses, which it forwards to our inbox (from July 24 until October 24, 2026, email to support@crewrivet.com also went, through our own Cloudflare Worker, to our support triage: see GitHub). Cloudflare Workers also run our internal alert relay, which receives our team's alerts (business names; invoice numbers and amounts; payment and account IDs; error details, which can include text from the record involved, such as names or addresses; request URLs; team members' names with certification expiry dates; and in some alerts a person's name, email, phone number or support message, or a beta/partner applicant's trade, team size, audience, link and the reasons they wrote), removes the email addresses and phone numbers it detects, and the values of fields such as customer name, support messages and chat history, then forwards alerts to Telegram and email. The redacted alerts and short alert-title keys are kept until delivered and for up to about a day afterwards to avoid duplicates; if delivery fails they are kept until a later delivery succeeds. (Global edge network)
  • Backblaze B2 — offsite storage of encrypted backups of the database and of stored files (call recordings, voicemails, photos, e-signatures, PDFs), and of our outreach records about businesses we contact. Backups are encrypted before they leave our servers, so B2 stores only ciphertext it cannot read. (United States, US-East)
  • GlitchTip (self-hosted) — application error monitoring, which we run on our own server rather than a third-party service. Processes error events and the request context captured with them, which can include page or request addresses, IP addresses and other data present at the time of an error. (Germany, our server)
  • Sentry (Functional Software, Inc.) — past: error monitoring for our API until October 2, 2026. Our API now reports errors to GlitchTip, which we host ourselves, and no longer sends error reports to Sentry. We cannot confirm whether our app (its server and the in-browser app) also sent error reports to Sentry before it moved to GlitchTip; if it did, they contained the same kinds of details, and reports from the browser would also include the visitor's IP address and the page address. Processed error reports and performance traces from our API: error messages and stack traces, which can include text from the record involved (such as names, addresses, email addresses or phone numbers); the request method, address and headers, which can include the IP address of the person making the request; account, request and other record IDs; and, in some reports, request bodies and query strings. Before sending, we removed authorization and cookie headers and, for part of that period, also request bodies, query strings and the values of fields such as phone numbers and email addresses where detected. (United States)

Platform functionality

  • Stripe — payment processing for Crew Rivet subscriptions and, where you enable it, payments from your customers. Processes billing and payment information. (United States)
  • Telnyx — telephone and SMS provider for the phone number, AI receptionist, and text messaging features. Processes phone numbers, call audio, and message content. (United States)
  • Anthropic (Claude) — our first-choice AI for drafting quotes and invoices, voicemail summaries, neighborhood marketing suggestions, the in-app help chat and marketing advice, plus photo quotes when other models can't read the photo and quality review of receptionist call transcripts, and assessing the homepage of businesses we contact about Crew Rivet to categorize them (from about August 4 to 6, 2026, using Claude Haiku). Processes voice-note and typed notes, voicemail transcripts with the caller's phone number, job addresses, help-chat messages and business context, job-site photos, and receptionist call transcripts, after we remove the phone numbers, addresses, email addresses and card numbers we detect (names a caller mentions may remain); for businesses we contact about Crew Rivet, the business name, trade, city, the kind of email address it uses and its homepage text (Claude returns an estimate of the business's size). (United States)
  • Groq — backup speech-to-text when our own transcription server is unavailable, and first choice for reading text from document photos, review-reply drafts and forecast summaries, and photo reading when our own model can't. Processes audio (backup speech-to-text only), document text, review text with the customer's name, and photos. (United States)
  • Resend — delivery of transactional and notification email (for example, account and invoice emails), internal alert emails to our team, and messages sent through our website contact form to our support address (support@crewrivet.com), which goes to our inbox (and, until October 24, 2026, also went to our support triage: see GitHub). Processes recipient email addresses and message content, including the name, email, subject and message a contact-form sender submits. (United States)
  • Google LLC (Google Workspace) — our team's email inbox, which receives internal alert emails and the email sent to our addresses (including contact-form and support messages); and our outreach mailbox (getcrewrivet.com), which sends our emails to businesses we contact about Crew Rivet and receives their replies. Processes the sender's name, email address, subject and message, and anything else they include, for emails sent to us; and the alert content: business names; invoice numbers and amounts; payment and account IDs; error and system details, which can include text from the record involved (such as a name or address) and request URLs; team members' names with certification expiry dates; and beta/partner applicants' names and submitted details, which can include a phone number or email address. Some alerts (most urgent ones, and some that our relay fails to accept) are also emailed directly and skip our relay's redaction (including its removal of the email addresses and phone numbers it detects). Outreach emails: the business's name and email address, the email we send (which can mention the owner's first name, the city, the trade and details from its website) and its replies. (Global)
  • GitHub, Inc. — private repositories for our code and operations. Error-report issues: when an error repeats often, an automated job files a private issue with the error's title and where in our code it happened, its level, how many times it happened and how many users it affected, when it was last seen and a link to our error monitor; error titles can include text from the record involved (such as a name or email address). Past support triage (July 24 until October 24, 2026): a copy of the messages sent to our support team (email to support@crewrivet.com, including website contact-form messages, and messages in our website support chat) went to a private GitHub repository, where an automated job had Anthropic (Claude) classify it and, if it looked like a product problem or could not be classified, opened a private issue that contained the message; another automated step then added to that issue a summary of the Crew Rivet account that matched the sender's email address, if any. Processed for support triage: the message: an email's subject and text (first 8,000 characters) or the chat message, which can contain anything the sender writes (for contact-form messages, the name, email address, subject and message entered in the form); the sender's email address; the email's message ID or the chat conversation ID; on filed issues, the matched account's summary: subscription plan and status, trial end date, onboarding status, whether a payment profile exists, active and disabled team member counts, counts and totals of unpaid, overdue and disputed invoices and the oldest overdue due date, messages sent and failed in the last 7 days and failures by channel, QuickBooks, Xero and Google Calendar connection status, account risk level and score, last login and last message sent, and the matched email address. Workflow logs are kept for 90 days; issues, their comments and workflow run records are kept until we delete them. (United States)
  • PostHog — product analytics that help us understand and improve how the app is used. On by default with an opt-out in the app (opt-in in the EU/UK); processes usage events and page views; page addresses (URLs), which since October 25, 2026 we send without query strings or fragments (until then they included the query string, which on the password-reset page included your email address and on search pages could include search terms you typed, such as a customer's name or phone number, and included the one-time code in team-invite links (these expire after 7 days)); until October 25, 2026, page titles, which on some pages included a contact's name, the title of a job, an invoice or quote number, or an inventory item name (we no longer send page titles); device/session metadata; IP address; your account ID and account details (trade, plan, subscription status, demo-account flag, your role and the account's sign-up date); and, when you subscribe, your subscription ID and plan. PostHog session replay was never turned on, so no session replays were ever recorded; since October 25, 2026 replay is also disabled in our code. (United States)
  • Chatwoot — live chat support on the website and app. We self-host Chatwoot on our own infrastructure (chat.aviontechs.com), so support chats are stored on our servers rather than in a third-party chat service; from July 24 until October 24, 2026, a copy of support-chat messages also went to our support triage (see GitHub, and Anthropic under “Past third parties”). Processes the messages and contact details you share in a support chat. (Self-hosted, Germany)
  • Browser push services (Google, Apple, Mozilla) — deliver the push notifications you turn on. Process your device's push address and an encrypted notification they cannot read. (Global)
  • OpenStreetMap (Nominatim) — a public geocoding API used to turn a job or customer address into map coordinates for dispatch and routing. Processes the street address sent for geocoding. (European Union)
  • Open-Meteo — a public weather API used to show conditions for a job site. Processes the job-site coordinates sent with the request. (European Union)
  • Discord Inc. — past internal team alerts sent through October 22, 2026 (support requests, beta and partner sign-ups, billing and system alerts). Nothing new is sent, and we deleted that message history on October 23, 2026. Processes the name, email, phone and business name in a support request or sign-up, the other details beta and partner applicants submit (trade, team size, audience, link and the reasons they wrote), support messages and recent help-chat history, invoice numbers and amounts, payment and account IDs, error and system details (which can include text from the record involved and request URLs), and team members' names with certification expiry dates. (United States)
  • Telegram (Telegram Messenger Inc.) — internal alerts to our operator's private chat (support requests, beta and partner sign-ups, billing and system alerts, replies to and failed sends of our outreach emails and, until October 2026, reports from our ops routine and daily server health check). Processes business names, invoice numbers and amounts, payment and account IDs, and error and system details, which can include text from the record involved (such as names or addresses, and any email address or phone number our relay does not detect) and request URLs; team members' names with their certification expiry dates; for beta and partner sign-ups, the applicant's name, business, trade and the other details they submit, which can include a phone number or email address; and for support tickets still open past our response target, the ticket ID and account ID (and, until October 23, 2026, the ticket subject and the contact email on the ticket); until October 24, 2026, the daily health-check report from our operations job, which could quote what it read in our server's files and logs (such as IP addresses, email addresses, phone numbers or message metadata); and, when a business we emailed about Crew Rivet replies or an email to it bounces, the business's name, email address, city and trade and the type of reply; when an outreach email fails to send, the address and the mail server's error message; and, from May 17 until October 10, 2026, reports from our ops routine, which could quote our automation server's error details (such as email addresses or message text). Before alerts that pass through our alert relay are forwarded, it removes the email addresses and phone numbers it detects, and the values of fields such as customer name, support messages and chat history. (Location not published by Telegram for accounts outside the UK and EEA)
  • FormSubmit (formsubmit.co) — past: delivered messages sent through our website contact form through October 1, 2026. Our contact form now sends messages through our own server, and our website no longer sends messages to FormSubmit. Processed the name, email, subject and message you submitted, and your IP address, browser (user agent) and referring page.
  • OpenStreetMap map tiles and unpkg — map images for maps in the app and on the customer tracking page, and the map library for the customer tracking page. See the viewer's IP address and the map area shown. (Global)
  • Google Fonts — past: the fonts used by the app (app.crewrivet.com, including the pages your customers open) from June 29 to November 6, 2026, and by this website from June 28 to August 22, 2026. Saw the visitor's IP address and browser details. The app and this website now serve their fonts from our own servers. (Global)
  • goQR.me (api.qrserver.com) — QR-code images for your marketing links in the app. Sees the public link encoded in the QR code and the viewer's IP address. (European Union)
  • MillionVerifier (Southern Vector Limited) — from August 1 to October 22, 2026, checked that the email addresses of businesses we contact about Crew Rivet could receive mail, under MillionVerifier's data processing agreement, which forms part of its terms of service. The service was run by GBD Software as a Service (Hungary) until Southern Vector Limited (New Zealand) took over the business (current agreement published October 19, 2026). Processes those businesses' email addresses. (New Zealand, Hungary, the European Economic Area, the United States or other jurisdictions where its subprocessors operate)
  • Google (Google Maps Platform, Places API) — finds public business listings for our outreach to businesses we contact about Crew Rivet, under the Google Maps Platform terms. Receives the search text we send (such as a trade and city, or a business's name and city) and returns public listing details: the business name, address, phone number, website, rating and review count, business hours, business status, business types or categories, number of photos and place ID. (United States or other locations where Google processes data)
  • ElevenLabs and Microsoft (Edge text-to-speech) — past: on May 23, 2026, while we were testing the AI receptionist, our code briefly sent the text of the receptionist's spoken replies to ElevenLabs (if it was configured) and then to Microsoft's Edge text-to-speech service, to turn it into audio. Processed that reply text, which can repeat what a caller said (such as a name or address).

Consumer financing (optional)

  • Wisetack, Hearth — if you turn on financing, your quotes and invoices show your customer a link to the provider. Only the amount (and, for Wisetack, an invoice or quote reference) is in the link; your customer applies with the provider directly. (United States)

Optional integrations you connect

These providers are engaged only if you explicitly connect the integration.

  • Google Calendar — one-way calendar sync (Crew Rivet to Google), if you connect your Google Calendar. Processes each job's title, date and time, customer name, address and notes. (United States)
  • Intuit (QuickBooks Online) — accounting sync, if you connect your QuickBooks account (new connections are currently paused for maintenance). Processes the customers, invoices, and payments involved in the sync. (United States)
  • Xero — one-way accounting sync (Crew Rivet to Xero), if you connect your Xero account. Processes the contacts and invoices you sync. (United States)

Past third parties (not our subprocessors)

These recipients received, or may have received, information in the last 12 months under their own terms, which let them use it for their own purposes, so for these uses they were third parties, not our subprocessors or service providers. None of them receives this information today.

  • Anthropic (Claude, consumer terms) — past. Until October 24, 2026, our staff used Anthropic's Claude, and an automated engineering agent (Claude) worked on issues in our private GitHub repository (including error-report issues), to operate, support, debug and market the service (including preparing emails to businesses we contact about Crew Rivet). From July 24 until October 24, 2026, our automated support triage also had Claude classify the messages sent to our support team (email to support@crewrivet.com, including website contact-form messages, and website support-chat messages), in the automated job described under GitHub. From May 17 until October 10, 2026, a scheduled Claude routine in Anthropic's cloud (our ops routine) also ran every 6 hours on that subscription account, read the error details of our automation server (n8n) and reported to us on Telegram; those errors could include details of the data the automations processed (such as support, contact-form or outreach messages and email addresses). From June 14 until October 24, 2026, an automated operations job, a daily health check of one of our servers (our second server, in Germany), also had Claude read files and system and service logs on that server and send its report to us on Telegram; those files and logs could include information about you (such as IP addresses, account email addresses, phone numbers or message metadata). These uses ran on a Claude subscription account, so Anthropic's consumer terms applied to them, not its commercial terms: they allow Anthropic to use the content to improve its services and develop other products, and to train its models unless training is turned off in the account's settings, and even then for content flagged for safety review or submitted as feedback (such as a thumbs-up or thumbs-down rating). We verified that training was turned off on October 24, 2026; we cannot confirm the setting before then. On October 24, 2026, our automated support triage stopped sending messages to Anthropic, we stopped our automated operations job and turned off our engineering agent, and our staff stopped using that account with customer information, support messages or information about businesses we contact about Crew Rivet (their contact details, trade, public business listing details, our estimate of the business's size, our draft emails to them and their replies); we had retired our ops routine on October 10, 2026. Processed what our staff or the engineering agent worked with, which could include, among other things, contractors' account information (such as names, email addresses, phone numbers, and business and billing details), records contractors keep about their customers (such as names, contact details, addresses, and job and invoice details), text messages and call records or transcripts, team members' details (such as names, contact details, and time and location records), support messages and error reports. For the support triage: an email's subject and text (first 8,000 characters) or the chat message, which can contain anything the sender writes (for contact-form messages, the name, email address, subject and message entered in the form); and, for issues handed to our engineering agent (Claude), the whole issue, including the sender's email address, the email's message ID or chat conversation ID, and the account summary listed under GitHub; for the operations job, the files and log lines it read on that server; for the ops routine, the automation error details it read; and, about businesses we contact about Crew Rivet, their contact details, trade, public business listing details (such as address, rating, review count, business hours, business status and business types), our estimate of the business's size (an inference), the emails we drafted to them and their replies. (United States)
  • Meta Platforms, Inc. (Meta Pixel) — past advertising tracker. From May 25 to June 26, 2026, every page of this website loaded the Meta Pixel, with no consent step; from June 5 to July 6, 2026, the app loaded it on the screen shown after sign-up to report the completed sign-up. After that, until July 10, 2026, our code could load it on this website (from July 5) and in the app (from July 6) only if a pixel ID was configured; we have no record that one was, so Meta may have received this data in that period. Processed the pages visited, clicks on our sign-up and demo buttons, completed sign-ups (and, from July 6, checkout starts), the visitor's IP address, browser and device details, and Meta's cookie identifiers. Meta uses this kind of data for advertising. (Global)
  • Meta Platforms, Inc. (Conversions API) — past: from July 5 to July 10, 2026, our code could send Meta a server-side “Subscribe” conversion event when a subscription checkout completed, only if Conversions API credentials were configured; we have no record that they were, so Meta may have received this data in that period. Processed the subscriber's email address, hashed (SHA-256) before sending, and the subscription event with the plan's price and an ID derived from the subscription or customer. Meta uses this kind of data for advertising. (Global)
  • Google LLC (Google Analytics) — past analytics used to measure our advertising. From May 25 to June 26, 2026, every page of this website loaded Google Analytics, with no consent step. From June 5 to October 4, 2026, the app loaded it on the screen shown after sign-up to record the sign-up; once loaded it could keep recording page views and engagement in that browser session, and it set its _ga cookie. In the app this had no consent step until September 11, 2026; from then it ran only with analytics consent (prior opt-in in the EU/UK; elsewhere unless you declined analytics or your browser sent a Global Privacy Control signal). Processed the pages visited, clicks on our sign-up and demo buttons, the sign-up event, the visitor's IP address, browser and device details, and Google Analytics cookie identifiers. (Global)
  • Google LLC (Gemini API) — past: until August 2, 2026, a backup AI in our code for classifying messages, drafting quotes and invoices, and reading photos, used only if it was configured. We have no record that it was configured in production; if it was, it may have received those messages, notes and photos under terms that let Google use them to improve its products. (Global)

Changes to this list

We may add or replace subprocessors as the platform evolves. When we do, we will update this page. If you would like advance notice of changes, or have questions about how a subprocessor handles your data, email privacy@crewrivet.com.