XTRA Crew Portal Privacy Policy and Text Messaging Terms

What we collect and why

We collect information you provide, records created during your work with XTRA, information entered by authorized XTRA personnel, and technical information generated when you use the Portal.

This includes:

• Contact and account information: Your name, mobile number, email address, contact details, and account preferences. If you use Google sign-in, we receive the account information Google shares under the permissions presented during sign-in.
• Application and work information: Your experience, availability, qualifications, assignments, shift details, time entries, correction requests, and records needed to administer pay.
• Training and safety information: Training participation, assessments, certifications, authorizations, and safety records.
• Communications and choices: Messages you send us, text-message permissions and withdrawals, and records showing when and how those choices were made.
• Technical and security information: Sign-in attempts, system activity, device and browser information, IP addresses, and information needed to troubleshoot problems and protect the Portal.
• Optional location information: Your device’s location when you allow it during clock-in or clock-out, as described below.
• Visit information: When hosting-platform analytics is enabled, information used to produce aggregate traffic reports, as described below.

We use this information to consider you for opportunities, coordinate work, maintain accurate time and pay records, manage training and safety, document qualifications, respond to requests, operate and improve the Portal, protect accounts, and meet our legal obligations.

We do not sell your personal information or share it for cross-context behavioral advertising—advertising based on your activity across other companies’ websites or services. We do not use crew records for targeted advertising.

Location when you clock in or out

The Portal may request permission to collect your device’s location when you clock in or out. Depending on your device settings, that location may be precise.

If you allow it, we associate the location with your time entry to help document where the punch occurred and review timekeeping questions.

Sharing your location is optional. You may decline the request and still record your time. You can also change location permissions in your browser or device settings. Changing permission stops future permission-based collection; it does not automatically delete location already recorded.

Location information is subject to the access, retention, and privacy protections in this policy. We do not use it for advertising.

Who can see what

Access depends on a person’s role and what they need to do.

• You: You can view the information made available in your own Portal account and request access to additional personal information we hold about you.
• Authorized XTRA administrators: Designated personnel can access the records needed for their responsibilities, such as scheduling, payroll, time review, training, safety, and authorizations.
• Your Lead: A Lead can access the shift information needed for a job you are both assigned to while that job is open.

We maintain logs of administrator changes and exports to support accountability and investigate problems.

When information leaves the Portal

We disclose information when needed to operate the Portal, administer work, or meet a legal obligation.

Recipients may include:

• Service providers: Companies that provide hosting, database services, messaging, technical support, or other necessary operational services. These include Lovable Cloud for Portal hosting, database, and authentication services, and Twilio for text-message delivery.
• Clients, venues, and Exhibit Appointed Contractors: Only the information reasonably needed for a specific job, such as crew identification, assignment details, required credentials, or site access.
• Professional advisers, insurers, and public authorities: When reasonably necessary for advice, claims, required reporting, legal proceedings, or compliance with law.

We limit disclosures to the information needed for the purpose. Where providers process information on our behalf, we require appropriate confidentiality, security, and use restrictions. Providers and telecommunications carriers may also process certain information for their own legal, security, and service-administration obligations.

XTRA operates in the United States. Provider processing and support locations depend on the services and configurations used.

Mobile numbers and messaging consent receive additional protection: We do not sell, rent, or share mobile numbers or text-message opt-in information with third parties or affiliates for their marketing or promotional purposes. We do not transfer your messaging consent to another sender. We disclose messaging information only as needed to providers supporting our messaging program or as required by law.

Text messaging terms

XTRA sends two types of text messages. Permission for one does not automatically give permission for the other.

Sign-in and verification codes

When you request a code after receiving the text-message disclosure, you authorize XTRA to send the verification message to the mobile number you provide.

These messages help verify your identity and provide account access. They do not contain advertising, and requesting a code does not enroll you in scheduling texts.

Message frequency depends on your requests.

Schedule and availability messages

With your separate permission, we send work-related texts such as availability requests, assignment confirmations, call times, and schedule changes. These messages may be sent using automated technology.

Message frequency varies with your availability, assignments, and work activity.

Scheduling texts are optional. Choosing not to receive them, or withdrawing permission, does not affect your eligibility for work with XTRA. We will coordinate necessary communications by phone, email, or another available method.

Stopping messages and getting help

• Reply STOP to stop messages from the sending number or messaging program.
• You can also withdraw permission for scheduling texts through the Portal or by emailing hr@xtracrew.net.
• Reply HELP for help, or contact hr@xtracrew.net.

We honor opt-out requests promptly. You may receive a final message confirming the opt-out. We will not resume messages covered by that opt-out unless you provide new consent.

STOP may also block verification codes, depending on how the messages are delivered. If you stop receiving codes or cannot access your account, contact Crew Operations for assistance.

Message and data rates may apply. XTRA does not charge a separate messaging fee. Delivery depends on your carrier and network availability. Carriers are not liable for delayed or undelivered messages.

Keep your mobile number current and let us know if you stop using it. Do not send Social Security numbers, banking details, or other sensitive records by ordinary text message.

Cookies, browser storage, and online services

Cookies and similar technologies

The XTRA Crew Portal does not set or read browser cookies of its own. It uses browser local storage, a similar technology, for two functions:

• Keeping you signed in: The Portal stores your authentication session so you can remain signed in between visits. This session information is removed when you sign out.
• Remembering display choices: The Portal remembers preferences on your device, such as which people you have hidden on your calendar view.

We do not use this storage to follow you across websites, build advertising profiles, or serve advertising.

You can clear this information through your browser’s site-data settings. Doing so will sign you out and may reset your saved display preferences. Blocking local storage may prevent sign-in or other Portal functions from working.

Analytics

We do not install advertising trackers in the Portal.

Lovable, our hosting provider, offers built-in visitor analytics. When enabled, it gives XTRA aggregate traffic reports, including page views, device types, and countries, to help us understand Portal use.

Lovable describes this analytics service as cookie-free, without browser storage or profiles that follow visitors across separate visits. Its reports do not identify visitors by name or link visits to signed-in Portal accounts. This aggregate measurement is separate from the account, timekeeping, and security records described elsewhere in this policy.

More information is available in Lovable’s analytics documentation and privacy policy.

Third-party services and collection

We do not install advertising pixels or other tools designed to follow your browsing across unrelated websites. Some Portal functions nevertheless connect your browser to external services:

• Google Fonts: The Portal loads typefaces from Google. Your browser sends Google technical information needed to deliver the font files, including your IP address. Google states that its Fonts service does not set cookies. See Google Fonts privacy information.
• Google sign-in: Authorized client contacts may choose to sign in with Google. Google may use cookies and process information during that sign-in under its own privacy policy. The Portal receives the account information shared under the permissions presented during sign-in.
• Hosting, database, and authentication: These services are provided through Lovable Cloud, which uses Supabase technology. These services process account and technical information needed to operate, secure, and support the Portal.

External services have their own privacy practices. Their involvement does not authorize them to use XTRA crew records for their own advertising.

Do Not Track and Global Privacy Control

Do Not Track: The Portal does not change its behavior in response to older browser “Do Not Track” signals. We do not use Portal browsing activity to follow you across unrelated websites for advertising.

Global Privacy Control: GPC communicates a preference to opt out of certain sales or advertising-related sharing of personal information. Because XTRA does not sell personal information or share it for cross-context behavioral advertising, a GPC signal does not change how the Portal handles your information.

If our practices change, we will provide the notices and choices required by law, obtain consent where required, and honor applicable opt-out preference signals.

How long we keep information

We keep information for the purposes described in this policy, subject to applicable recordkeeping requirements. Different records have different retention needs:

• Application and talent-network records: For recruiting, maintaining the relationship you request, and applicable hiring-record obligations.
• Assignment, time, pay, and related location records: For administering work, reviewing corrections, and meeting wage, tax, employment, and dispute-related obligations.
• Training, qualification, and safety records: For documenting qualifications and meeting applicable safety, insurance, and recordkeeping obligations.
• Messaging consent and opt-out records: For documenting permission, honoring your choices, and meeting applicable legal and messaging-program requirements.
• Browser preferences: Until you clear the relevant site data or the Portal replaces or removes the preference.

How we protect information

We use administrative, technical, and physical safeguards appropriate to the information and the work the Portal supports. These include access restrictions, limits on code requests, and activity logs. Crew sign-in uses one-time verification codes; authorized client contacts may also use Google sign-in.

Access controls restrict who can read or change records. Crew members cannot approve their own training results or grant themselves work authorizations. Practice submissions are identified separately from official records.

No system can guarantee complete security. Protect your device, keep verification codes private, and report suspected unauthorized access to hr@xtracrew.net.

Your information and your choices

You can:

• Review information available in your Portal account.
• Update editable account details.
• Request corrections to time records through CrewTime.
• Request access to or a copy of your personal information.
• Ask us to correct or delete personal information.
• Withdraw permission for scheduling texts.
• Decline optional location collection or change device permissions.
• Clear Portal data stored in your browser.

Send privacy requests to hr@xtracrew.net. You may also contact Crew Operations at hr@xtracrew.net for help submitting a request or obtaining this policy in an accessible format.

Depending on where you live and which laws apply, you may have additional rights, including rights concerning data portability, sale or sharing, targeted advertising, certain automated decisions, or sensitive personal information. You may use an authorized agent where permitted by law.

We may verify your identity and an agent’s authority before acting. We request only information reasonably needed for verification.

Some records must be retained or withheld from disclosure to meet legal obligations or protect another person’s rights. If we cannot fulfill all or part of a request, we will explain the reason and any available appeal process. To appeal, email hr@xtracrew.net and identify the request you want reviewed.

We respond within applicable legal deadlines and do not unlawfully discriminate or retaliate against anyone for exercising privacy rights.

Age requirement

The Crew Portal is intended for adults age 18 and older. We do not knowingly collect personal information through the Portal from anyone under 18. Contact us if you believe a minor has provided information.

Changes to this policy

We will post updates here and change the date above. For material changes, we will provide notice through the Portal or another appropriate method. If a change requires additional notice or consent, we will provide that notice or obtain that consent before implementing it.

Contact XTRA

XTRA Crew LLC
Crew Operations
Las Vegas, Nevada

Privacy and records requests: hr@xtracrew.net
Portal and messaging support: hr@xtracrew.net
Website: www.xtracrew.net