Privacy Policy

1. Information we collect

Information you provide

• Account and contact information, such as name, email address, telephone number, company, and role.
• Facility, jobsite, vehicle, material, and operational information you submit.
• Photographs, messages, support requests, verification evidence, and other content you provide.
• Transaction and incentive information. Payment-card details are generally collected and processed by our payment provider rather than stored in full by CreteXchange.

Information collected through use of the Service

• Device, browser, IP address, log, diagnostic, and usage information.
• Approximate or precise location information when you grant permission, including information used for facility discovery, geofence evaluation, routing context, and drop verification.
• Camera and photo-library information when you grant permission and choose to capture or upload verification evidence.
• Cookies and similar technologies used for authentication, security, preferences, and service performance.

2. How we use information

We use information to:

• Provide, maintain, personalize, and improve the Service.
• Create and secure accounts and authenticate users.
• Display facility opportunities and support informed destination decisions.
• Evaluate and document recovery events, geofence results, photographs, incentives, fees, and disputes.
• Process payments and payouts where payment features are enabled.
• Communicate service, safety, security, support, and administrative messages.
• Detect fraud, abuse, security incidents, and technical problems.
• Analyze performance and develop aggregated or deidentified insights.
• Comply with law and enforce our agreements.

3. How we share information

We may share information:

• With service providers that support hosting, databases, storage, maps, payments, communications, analytics, security, and customer support.
• Between participating drivers, facilities, contractors, and other users when needed to support an opportunity, visit, verification, incentive, dispute, or requested connection.
• With professional advisers, auditors, insurers, or transaction participants in connection with financing, restructuring, merger, acquisition, or sale of assets.
• When required by law or reasonably necessary to protect rights, safety, security, and the integrity of the Service.
• With your direction or consent.

We do not sell personal information for money, and we do not use personal information for cross-context behavioral advertising. If our practices change, we will update this policy and provide legally required choices.

4. Location information and photographs

Location and photographic evidence can be important to facility discovery and verified-drop workflows. We collect this information only through enabled platform features and applicable device permissions. You may change permissions through your device or browser, but some features may no longer function.

Location signals can be imprecise. We may retain location, timestamp, geofence, and image evidence when reasonably necessary for verification, safety, fraud prevention, dispute resolution, auditing, or legal compliance.

5. Data retention

We retain personal information for as long as reasonably necessary for the purposes described in this policy, including account administration, transaction and verification records, security, dispute resolution, regulatory obligations, and enforcement. Retention periods vary by data type and legal requirement. We may retain aggregated or deidentified information where it cannot reasonably identify you.

6. Data security

We use reasonable administrative, technical, and organizational safeguards designed to protect information. No internet transmission or storage system is completely secure, and we cannot guarantee absolute security. Protect your credentials and notify us promptly of suspected unauthorized activity.

7. Your choices and privacy rights

You may update certain account information in the Service and may contact us to request access, correction, deletion, or a copy of personal information, or to opt out of nonessential communications. We may need to verify your identity and may retain information when permitted or required by law.

Residents of Texas, California, and other jurisdictions may have additional rights where the applicable law covers CreteXchange and the relevant processing. These may include rights to confirm processing, access, correct, delete, or obtain a portable copy of data, and to opt out of certain sales, targeted advertising, sharing, or profiling. CreteXchange does not discriminate against users for exercising applicable privacy rights.

Submit a request to mstiger@cretexchange.com or call (469) 269-6709. If an applicable law provides an appeal right and we deny a request, you may appeal by replying to our decision with “Privacy Appeal” in the subject line.

8. Children’s privacy

The Service is intended for business users age 18 and older and is not directed to children. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.

9. Third-party services

The Service may link to or integrate with third-party services. Their privacy practices are governed by their own policies, and this policy does not cover information they process independently.

10. Processing and transfers

Information may be processed in the United States and other locations where our service providers operate. Where required, we use appropriate safeguards for cross-border transfers.

11. Changes to this policy

We may update this Privacy Policy as the Service, our practices, or legal requirements change. We will post the revised policy with an updated date and provide additional notice when required.

12. Contact

Questions or privacy requests may be sent to mstiger@cretexchange.com or directed to (469) 269-6709.