Privacy Policy

• Account identity: name, mobile phone number (for SMS one-time-password login and role assignment), and email when one is given.
• Customer and lead details: the names, phone numbers, email and street addresses, project descriptions, estimates, invoices and payments a Tenant records about its customers, including leads that arrive from its website or from lead services it connects.
• Calls: calls to and from a Tenant's business number are recorded, and both parties hear a notice that the call may be recorded. Recordings are transcribed and summarised for the Tenant's records.
• AI phone assistant: a Tenant can add an optional AI phone assistant that answers some of its calls on its behalf. Callers hear that the call may be recorded. We process the call audio, the transcript and summary, and the details a caller gives (such as name, phone number, address and project details) for the Tenant, as its processor. The assistant saves those details to the Tenant's customer records and may text the caller a follow-up or a link to send photos.
• Communications: text messages and Instagram and Facebook Messenger threads between a Tenant and its customers, so the Tenant's office can keep one conversation history per customer.
• Meeting recordings: if a Tenant connects a voice recorder (such as Plaud), recordings and transcripts of site visits and meetings.
• GPS location: captured only during clock-in, to verify a crew member is on the job site or at home base for a travel job. We do not track your phone's location in the background. If a Tenant connects vehicle GPS trackers (such as Hapn), we receive those trackers' locations from the Tenant's tracker account about every 5 minutes, to show where its vehicles are. That is the tracker's location, not your phone's.
• Photos: images you upload from your camera or photo library, for job-site documentation and estimate reference.
• Work records: hours, jobs assigned, earnings, and, for subcontractors, the tax details a Tenant needs to issue a 1099.
• Device: push notification token, OS and device class — used to deliver job assignment and payment notifications.

Hewer data is used to operate the CRM platform for our Tenants. We do not sell or rent your information, and do not share workspace data for advertising (the one exception, measuring Hewer's own ads, is described below); do not use your data to train AI models, and our AI providers do not use it to train theirs; and do not track you across apps you don't own. Tenants can only access the data of the workspace they administer.

Measuring Hewer's own ads. When you reach hewer.app from one of Hewer's own ads, we measure whether that ad led to a sign-up. On hewer.app's public pages and the sign-up page only (never inside the app, a sign-in page, a customer portal or a Tenant's website), Google's advertising tag counts a completed sign-up against the ad click. Google receives the address of the page without anything after the path (no query string, so no invitation or personal link code), the page you came from in the same form, your browser's usual request details (such as IP address and user agent) and the fact that a sign-up happened. It receives no name, email or phone number from us. Ad personalization and remarketing are turned off, and nothing is shared with Google for building audiences. Outside the EEA, the UK and Switzerland the tag sets a Google ad cookie and sends the ad click identifier so the click can be counted; inside them it sets no cookie and the identifier is withheld. If your browser sends a Global Privacy Control signal, the tag is not loaded at all, and it is never loaded on a page opened from an invitation or personal sign-up link. When a sign-up came from a Meta (Facebook or Instagram) ad, we tell Meta the sign-up happened, with the ad click identifier and your email and phone in hashed form so Meta can match it. Neither receives any workspace data. You can block these cookies in your browser, and manage Google ad settings at adssettings.google.com.

We use these service providers, each under contract to use the data only to provide their service to us:

• Supabase — database, authentication and file storage.
• Vercel — application hosting, and anonymous page-speed measurements (how long pages take to load and respond; no cookies and nothing that identifies you).
• Twilio — text messages, calls, call recording, and sign-in codes.
• ElevenLabs — the optional AI phone assistant: voice AI that answers a Tenant's calls, converts speech to text and back, and keeps the call's recording and transcript.
• Stripe — payments and card-transaction feeds. Card numbers are entered directly with Stripe and never reach our servers.
• Anthropic (Claude) — AI features: drafting messages and estimates, reading estimate photos, and summarising calls, meetings and site visits.
• OpenAI — converting call, voicemail and meeting audio to text, and reading answers aloud.
• Plaud, Inc. — converting site-visit recordings to text, when a Tenant pairs a Plaud recorder with the Hewer app. We send Plaud the recording's audio, through a link to our copy that expires after 24 hours, and Plaud sends back the transcript. Plaud processes it in the United States.
• Firebase Cloud Messaging — push notifications. We send a device token, not message content.
• Cloudinary — hosting and resizing of job photos and video.
• Google Maps Platform — turning job addresses into coordinates for scheduling and drive-time estimates.
• National Weather Service — job-site weather is looked up using the job site's coordinates rounded to two decimals. No names or addresses are sent.
• Sentry — error and crash reports, so faults can be diagnosed.

A Tenant may also connect its own accounts with other services, and data then flows between Hewer and that service on the Tenant's instruction: Gmail (reading payment notifications in the business inbox, and sending invoices and payment links from it), Google Calendar (syncing job dates), Google Business Profile (reading the business's Google reviews and posting, editing or deleting the owner's replies to them when a Tenant user presses the button), QuickBooks Online (syncing customers, invoices, payments and expenses), Instagram and Facebook (see below), Thumbtack (new leads), and Plaud through Zapier (meeting recordings). Hewer's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Gmail content is not sent to any AI provider. Google review text is sent to the AI provider only when a Tenant user asks for a draft reply to that review, and the draft is shown to them to edit before anything is posted. Data from Google APIs is not used to train AI models, is not sold, and is not used for advertising.

Google Calendar. When a Tenant connects a Google account, Hewer accesses the account email to identify the connection and stores encrypted access and refresh tokens. Hewer sends job and site-visit titles, descriptions, addresses, dates, times and reminders to that account's primary calendar, and stores the resulting event identifiers so later schedule changes can update or remove the associated events. Duplicate-event cleanup also reads event metadata from the primary calendar to identify Hewer-managed events. Calendar data is not sent to AI providers. Disconnecting Calendar in Settings deletes the stored connection tokens and stops future syncing; it does not remove events already in Google Calendar. Stored scheduling records follow the retention and deletion rules below.

Facebook and Instagram. When a Tenant connects its Facebook Page and the Instagram professional account linked to it, Hewer, on the Tenant's instruction: receives the Messenger and Instagram messages people send the business, with their name and username, and sends the replies the Tenant's users write; reads the answers people give on the Tenant's Lead Ads forms (such as name, phone, email and the form's questions) and files them as leads; reads the recommendations left on the Page, with the reviewer's name, for the Tenant's Reviews page; reads the monthly spend of the ad account the Tenant picks; sends Meta a conversion event, with hashed contact details, when a lead from the Tenant's own ads becomes a job; and posts the videos and photos a Tenant user approves to the Tenant's Page and Instagram account. Hewer does not create or change the Tenant's ads, does not post anything a Tenant user has not approved, and does not sell this data or use it for advertising. A Tenant can disconnect at any time in Settings, which deletes the stored access tokens; how to have the data deleted is on our account deletion page.

What the AI features receive. The AI features send the provider what the task needs, and sometimes that includes personal details:

• Call summaries. The call audio goes to OpenAI to be transcribed. Before the transcript goes to Anthropic, we replace the names, phone numbers, email and street addresses we hold with placeholders. Anything said aloud that we have never stored, such as a family member's name, is not removed.
• AI phone assistant. For a Tenant that turns it on, the caller's voice goes to ElevenLabs as the call happens, as spoken. The assistant also receives the Tenant's business details and, for a caller the Tenant already knows, their first name, upcoming visits and the stage of their open jobs. To suggest improvements to the assistant, recent call transcripts go to Anthropic with the names, phone numbers, email and street addresses we hold replaced with placeholders.
• Meeting and site-visit recordings. When a Tenant's recorder uploads a meeting, its transcript is sent to Anthropic automatically, as recorded, to fill in the job and note details the customer mentioned. These can include personal circumstances the customer chose to share.
• Message drafts. When a Tenant asks for a suggested reply, the customer's name, the conversation, and the job's status and balance are sent.
• Estimates from photos. The photos are sent when a Tenant asks for an estimate to be drafted from them.

AI output is a draft for the Tenant to review; Tenants are responsible for what they send to their customers.

Data is stored with Supabase in the United States. Access controls keep each Tenant's data separate and limit each user to what their role allows. Documents, call recordings and other private files are stored behind short-lived signed links. Job photos and video are hosted on Cloudinary. Data is encrypted in transit with TLS 1.2 or later.

You may request: a copy of your data, correction of inaccurate data, or deletion of your account.

Email privacy@hewer.app with the subject "Privacy request" — we respond within 14 days. If your information was collected by a Tenant (the company you work for or do business with), that Tenant controls it, and we will pass your request to them and help them respond.

• We keep a Tenant's data while its account is active, so it can keep its customer and job history.
• When a Tenant closes its account, we delete its data within 90 days after a 30-day export window, and copies in our backups expire within 12 weeks after that.
• We keep records of text-message consent and opt-outs for up to four years, to show that messages were sent with permission, and billing records as long as the law requires.
• For the AI phone assistant, ElevenLabs keeps its copy of a call's recording and transcript for 90 days. The transcript and summary stay in the Tenant's call records like any other call.
• When a Tenant uses a Plaud recorder, Plaud keeps the transcript it makes of a recording for seven days. The transcript stays in the Tenant's records like any other recording. Once a recording has been copied into Hewer, Hewer deletes it from the recorder.
• Push tokens are discarded when the device deregisters.

Hewer is a business tool, not directed at children. Accounts are provisioned only for adult employees, contractors, and clients of our Tenants.

We post each version of this policy here with the date it was last updated. For a material change, we will tell Tenant account owners by email or in the app before it takes effect.

Hewer Tenants operate their own SMS programs to send their clients transactional and customer-service messages — appointment confirmations, estimate and invoice links, payment reminders, scheduling updates, project status notifications, and post-project follow-ups. Hewer provides the underlying infrastructure (via Twilio); the messages originate from the Tenant's registered business number.

Opt-in. You consent to receive SMS from a Tenant when you (a) submit a contact form on their website and check the SMS-consent checkbox; (b) text their published keyword to their business number; (c) provide your phone number to them in person or by phone with verbal consent; or (d) message them first on Instagram or another channel and ask them to text you.

No sharing. Neither Hewer nor its Tenants sell, rent, share, or otherwise disclose your mobile phone number or SMS opt-in information to any third party for their marketing purposes. Phone numbers are used solely to communicate with you about your project and are processed through Twilio for delivery.

Frequency. Message frequency varies based on your active projects. A typical client receives 1–20 messages over the course of a project.

Carrier rates. Standard message and data rates may apply, depending on your mobile plan.

HELP. Reply HELP to any SMS to receive support contact details, or email privacy@hewer.app.

STOP. Reply STOP to any SMS to unsubscribe at any time. You will receive a single confirmation message and then no further SMS from that sender unless you re-opt-in.

Texts from Hewer itself. Hewer LLC also runs its own support line. If you text it — the number is on our contact page — you agree to receive replies from Hewer about your question. We only text people who texted us first, never for marketing, and the same rules apply: message frequency varies, message and data rates may apply, reply HELP for help and STOP to opt out. We do not sell, rent or share your number or your opt-in with anyone for their marketing.

Hewer Trade Toolkit is a free, separate app of layout and material calculators. It has no account and no login, and it does not connect to any company's Hewer data.

• Your projects stay on your phone. Layouts, drawings and exported PDFs are stored on the device and are never sent to us.
• Anonymous usage counts. The app sends events such as “app installed”, “tool opened” or “PDF exported”, with the trade and tool involved, a random install identifier made by the app, the platform and the app version. They contain no name, email, contact, location or project content, and are used only to count how the app is used. On their own they are not linked to you.
• If you sign up for Hewer from the app. The web and Android apps (not the iOS app) can open Hewer’s signup page. That link carries the app’s random install identifier, the tool you tapped it from and the platform. If you then create a Hewer account, we save them with the new company so we can tell which tools lead to signups; from then on, that identifier’s usage counts can be connected to that company. This is our own analytics, and it is never shared or sold.
• Request a tool. If you use this optional form, we receive what you asked for, your trade, and, only if you enter them, your name and email. We use these to decide which tools to build and, if you left an email, to tell you when your tool is ready.
• No advertising, no tracking across other apps or websites, and no third-party analytics or advertising SDKs. We never sell this data. To have a tool request removed, email privacy@hewer.app.

Hewer LLC · 11215 Saint Johns Industrial Pkwy N, Unit 13, Jacksonville, FL 32246 · privacy@hewer.app