Privacy Policy

Field 2 Service

---

In short

• We are the controller of your data if you deal with us directly — you visit our website, ask us a question, open a Field 2 Service account, pay us, contact our support desk, or join our affiliate programme. This policy is about that data.
• We are only the processor of the data inside a customer's account. If a business you deal with uses Field 2 Service to manage its work, that business decides what it holds about you and why. It is the controller; we hold that data on its instructions. Contact that business first — see section 3.
• We do not use personal data to train any AI model, we do not provide it to anyone else to train theirs, and we do not sell it or share it for advertising. The terms on which the configured AI provider handles data sent to it, including its position on training, are recorded on our Sub-processor list — see section 13. Only one of the listed AI providers is engaged at a time; the platform console names which.
• Our website, the customer portal and the public booking page load no third-party resources at all — no analytics, no advertising tags, no third-party fonts.
• You have rights over your data, and you can complain to the Data Protection Commission (Ireland) or the Information Commissioner's Office (United Kingdom). See sections 10 and 12.

---

1. Who we are

Field 2 Service is field-service-management software operated by:

We are established in Ireland. Our lead supervisory authority is the Irish Data Protection Commission. Because we also serve businesses in the United Kingdom, UK data protection law applies to that activity and the Information Commissioner's Office is the relevant regulator for people in the UK. Both are named in section 12.

ICO registration: [[OWNER: ICO registration number, if registered]]

We have not appointed an Article 27 representative, because we are established in the EU and therefore do not require an EU representative.

---

2. The two roles we hold — and why it matters

This is the most important thing to understand about our service, so we say it plainly.

When we are the controller. For everything you send us directly, we decide what is collected and why, and this policy governs it. That covers:

• visitors to our website who use the contact form;
• people who register for a trial or a subscription (the account holder);
• billing contacts for a paying account;
• people who contact our support desk;
• people who join our affiliate/partner programme;
• our own platform administrators.

When we are the processor. Businesses use Field 2 Service to run their own operations — their customers, their jobs, quotes, invoices, messages, photographs, and their own staff records. Each business decides what it puts in, why, how long it keeps it, and who it shares it with. That business is the controller; we are the processor and we act on its instructions. Its data is held in a separate database from every other customer's.

Our obligations as a processor are set out in our Data Processing Agreement, which forms part of the contract with every customer. It covers the security we apply, the sub-processors we use, how we help with data-subject requests, what happens when a customer's contract ends, and what we do if there is a security incident.

This policy does not describe how any individual business uses the data it holds about you. Only that business can tell you that.

---

3. If your data is inside a business's Field 2 Service account

If a tradesperson, contractor, service company or similar business holds your details because you are its customer — you booked a job, received a quote or an invoice, used its customer portal, or received a message from it — then:

• that business is the data controller, not us;
• its privacy notice, not this one, tells you what it does with your data;
• you should contact that business first to ask for a copy of your data, to correct it, to have it erased, or to object to how it is used;
• if that business gives you a customer-portal login, you can do two of those things yourself from the portal's privacy page: download a copy of what the business's account holds about you, and ask the business to erase you. The erasure is a request, not a switch — only the business can decide it, because only the business knows what it must keep for tax and legal reasons. Your request is recorded and the business is notified.

If you contact us instead, we will not answer your request as if we were the controller and we will not disclose the data to you. What we will do is pass your request on to the business without undue delay — normally within 3 business days — tell you that we have done so, and help that business respond. Write to hello@field2service.com with the name of the business and we will route it.

The one exception is data we hold about you as controller — for example, if you also emailed our support desk or used our website contact form. We answer those requests ourselves, under section 10.

---

4. What we collect

4.1 Website enquiries

When you use the contact form on our website we collect your name, email address, subject, message, the time of submission and your IP address. A copy is emailed to hello@field2service.com and a record of whether that email was delivered is kept.

Our website sets no cookies and loads no third-party resources. See section 14.

4.2 Trial and account registration

When you register we collect your name, business name, email address, country (all required), and, if you give them, your phone number, VAT number, chosen plan, preferred payment method, any notes you type, and the referral or promotion code you arrived with. We also record the date and version of the terms you accepted.

4.3 Your login and account security

We store your password as a bcrypt hash — never in a readable form. If you turn on two-factor authentication we store your authenticator seed encrypted and your recovery codes hashed. We record when your account was last active.

4.4 Billing

For a paying account we hold your subscription and invoice records (plan, amounts, currency, dates, payment method, VAT number where given) and the customer and subscription identifiers issued by our payment provider.

We never see or store your card number. Card details are entered on our payment provider's own hosted payment page and go directly to them.

4.5 Support

When you contact our support desk — from our website or from inside the application — we hold your name, email address, the category and subject you chose, your message, any files you attach, and the whole message thread, including our replies.

4.6 Affiliate and partner programme

If you join our affiliate programme we hold your name, email address, your password as a hash, your payout details (account name, bank name, IBAN, account number, sort code, BIC/SWIFT and/or PayPal email address, as you choose to supply them), and your commission and payout records.

4.7 Security and technical records

We keep an activity log of changes made in the application, recording who made the change, what changed, when, and the IP address it came from. Administrative actions on our platform are logged separately. Failed login attempts are counted temporarily to enforce rate limits; that counter is transient and is not kept as a permanent record. Our servers also produce application error logs.

4.8 What we do not collect

• We do not collect any special-category data (health, racial or ethnic origin, religious or philosophical beliefs, trade union membership, genetic or biometric data, sex life or sexual orientation) or criminal-offence data through our website forms, our signup or our support desk. Please do not send it to us.
• We do not collect date of birth or age, and we perform no age verification. See section 15.
• We run no analytics, advertising, profiling or lead-enrichment tools of any kind.

---

5. Why we use it, and our legal basis

Where we rely on legitimate interests, we have considered whether our interest is overridden by your interests, rights and freedoms. You can object at any time — see section 10 — and you can ask us for our assessment.

We do not use any of this data for marketing to you without your consent, and we operate no marketing mailing list. We do not use personal data to train any AI model, we do not provide it to anyone else to train theirs, and we do not sell it or share it for advertising.

---

6. Do you have to give us this data?

You are never under a statutory obligation to give us personal data. Some of it is a contractual requirement, in the sense that we cannot do what you are asking without it:

---

7. Who we share it with

We share personal data only with the providers we need in order to run the service, and only with the data they need. Most of them act on our instructions and are not permitted to use it for their own purposes; the few that act on their own account, or that a business chooses for itself, are separated out in section 7.3 rather than mixed in with the rest.

We keep two separate lists, because they are two different populations of data. The definitive, dated list — with each provider's legal entity, the categories of data it receives, its country and its transfer mechanism — is our Sub-processor list. What follows is the summary.

7.1 Providers that receive data about you as an account holder, enquirer, support contact or partner

(Field 2 Service is the controller of this data.)

7.2 Providers reached when a business uses the product

(Field 2 Service is the processor of this data; the customer business is the controller. Each of these is engaged only if that business turns on the corresponding feature.)

The customer portal, the public booking page and our marketing website load nothing from third parties. Only the staff application does.

7.3 Recipients that act on their own account, not ours

Two of the providers a business can switch on are not our processors. PayPal and Google Maps Platform decide for themselves how they handle the data they receive, under their own terms with the business and with you — we pass them the minimum the feature needs and nothing more. Anything a business sends to a webhook endpoint it has configured is that business's own transfer.

---

8. International transfers

Some of the providers above are outside the European Economic Area, principally in the United States. Where personal data leaves the EEA or the UK, we rely on one of the following, in this order:

1. An adequacy decision — including the EU–US Data Privacy Framework, or its UK Extension, where the receiving organisation is currently certified under it for the type of data concerned; or
2. Standard contractual clauses — the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914) for data from the EEA, and the ICO's International Data Transfer Agreement, or the UK Addendum to the EU clauses, for data from the United Kingdom — supported by a transfer risk assessment. The EU clauses alone are not valid for UK data, which is why we use the UK instruments as well.

Transfers between Ireland and the United Kingdom are covered by adequacy decisions in both directions and need no additional safeguard.

The mechanism that applies to each individual provider — and the date we last verified it — is recorded against that provider on our Sub-processor list. Certifications can lapse, so we record the mechanism per provider rather than making a single blanket claim here.

To obtain a copy of the safeguards we rely on for any transfer, email hello@field2service.com and we will send you the relevant clauses, redacted only where necessary to protect confidential commercial terms.

---

9. How long we keep it

Where our hosting arrangements include backups, deletion takes effect in the live systems immediately and works through to backup copies on that provider's ordinary backup cycle. Our hosting arrangements are with [[OWNER: hosting provider and data-centre location]].

Since 6 September 2026 we also take our own encrypted backups of the databases, using a key kept separately from the application's own, recording the size and checksum of each backup, and keeping thirty days of them — never fewer than one copy per database. We can decrypt and re-read a backup, and restore one into a scratch database to check it. Being straight about the limits: no copy is held off-site yet, no key custody arrangement is in place, we state no recovery time or recovery point, and no restore rehearsal has been carried out on the live host. We make no backup or disaster-recovery commitment on the strength of it.

---

10. Your rights

Over the data for which we are the controller, you have the right to:

We will also tell each recipient we have disclosed your data to about any correction, deletion or restriction, unless that proves impossible or involves disproportionate effort.

How to exercise them

Email hello@field2service.com, or write to us at the address in section 1. Say which right you are exercising and give us enough detail to find your records.

• We respond without undue delay, and in any event within one month of receiving your request.
• If your request is complex, or you have made several, we may extend that by up to two further months. We will tell you within the first month if we need to, and why.
• There is no charge. We may charge a reasonable fee, or refuse, only if a request is manifestly unfounded or excessive — and it is for us to show that it is.
• If we have reasonable doubts about who you are, we may ask for enough information to confirm it. We will ask for the minimum needed and will not use it as an obstacle.
• If we do not act on your request, we will tell you within one month why not, and that you can complain to a supervisory authority and seek a judicial remedy.

We handle these requests ourselves. There is no self-service export or deletion button for the data we hold about you as controller: we record each request in our internal data-subject-request register, which tracks the one-month deadline and the ground for any refusal or extension, and we assemble the extract with our own tooling. Please allow us the time above rather than expecting an immediate automated answer.

Inside a business's Field 2 Service account it is different: if that business has given you a customer-portal login, you can download a copy of your data and lodge an erasure request from the portal yourself — see section 3.

If your data is inside a business's Field 2 Service account, these rights are exercised against that business, not against us — see section 3.

---

11. Withdrawing consent

We do not rely on consent for anything. Every purpose in section 5 runs on contract, legal obligation or legitimate interests, and our website stores nothing that requires your consent. If that ever changes, this section will tell you what we ask consent for and how to withdraw it — and withdrawing will be as easy as giving it.

That is true of every surface we operate, including the staff application our customers' own staff sign in to: everything it stores in a browser is either strictly necessary or a record of a choice that member of staff made. Every item is listed by name, purpose and lifetime in our Cookie Policy, which also explains how to clear it.

Service emails about your account (row 4 of the table in section 5) are not based on consent and cannot be switched off while you hold an account — they include security and billing notices you need to receive.

---

12. Complaints

Please tell us first — email hello@field2service.com and we will try to put it right. You do not have to come to us first, and doing so does not affect your right to go to a regulator at any time.

If you are in the European Union or the EEA, or you are unhappy with how we have handled your data under EU law:

Data Protection Commission (Ireland) How to contact the DPC and how to make a complaint: www.dataprotection.ie/en/contact/how-contact-us

You may also complain to the supervisory authority in the EU country where you live or work, or where the problem happened.

If you are in the United Kingdom, or you are unhappy with how we have handled your data under UK law:

Information Commissioner's Office (United Kingdom) Helpline 0303 123 1113 · www.ico.org.uk/make-a-complaint

A note for people in the UK. UK law requires us to make it easy for you to complain to us about how we handle your personal data, to acknowledge your complaint within 30 days, and to tell you the outcome without undue delay. Send a complaint to hello@field2service.com with "Data protection complaint" in the subject line; we will acknowledge it within 30 days, keep you informed, and tell you the outcome and what we have done. The ICO normally expects you to have raised it with us first.

You also have the right to an effective judicial remedy against us or against a supervisory authority.

If you are anywhere else in the world, the regulator you can complain to, and any rights your local law gives you beyond those in section 10, are in the jurisdiction addendum at section 19.

---

13. Artificial intelligence and automated decisions

For the data we hold as controller — your account, your billing, your enquiry, your support ticket, your affiliate record — we make no automated decisions. Nothing is decided about you solely by automated means, there is no profiling, no automated scoring, and no automated acceptance or refusal of an application. A person decides.

About the AI features inside the product, for transparency, and because our customers ask:

• The AI assistant works by proposing and then asking a person to confirm. Changes it suggests are held as proposals and are applied only when a user presses Confirm. Every applied change is logged and can be undone.
• There are hard limits enforced by our software, not by the AI: no more than 10 proposed changes and no more than 5 destructive actions in a single exchange, whatever the AI is asked to do.
• The AI available to a business's own customers through the customer portal is read-only, is limited to the single signed-in customer's own records, and is off unless the business turns it on.
• There is one optional exception: a scheduling "auto-pilot" that a business can switch on for its dispatch board. When it is on, up to six scheduling actions per exchange — reassigning or re-sequencing work between that business's own engineers — apply without a confirmation step. It is off by default, it cannot touch money or delete anything, and every action is logged and reversible. Whether to enable it is the business's decision, and it is the business — not us — that must tell its staff about it.
• We do not use personal data to train any AI model, we do not provide it to anyone else to train theirs, and we do not sell it or share it for advertising. The AI features use the configured provider named on our Sub-processor list and in the platform console (one of Anthropic PBC, X.AI LLC, or OpenAI OpCo, LLC / OpenAI Ireland Ltd.). The terms on which that provider handles data sent to it, including its position on training and retention, are recorded on that list, with the date we last checked them. Only that one provider is engaged; switching the features off, or a platform per-tenant opt-out, means no Customer Personal Data is sent to any of them.
• Images uploaded to the AI assistant are stored outside our web root and deleted automatically after 60 minutes.

Where a business uses these features on data about you, that business is the controller and is responsible for telling you about it in its own privacy notice.

---

14. Cookies and browser storage

• Our marketing website sets no cookies, loads no third-party resources and stores nothing in your browser except a note that you dismissed our storage notice.
• The application and the customer portal use two strictly necessary first-party cookies: one to keep you logged in, and one security token that protects forms from cross-site request forgery. Both expire after 2 hours. There is no "remember me" cookie and no analytics or advertising tag anywhere in the application. The application and the portal also keep an unsaved form you are typing in your own browser for up to 7 days, so a refresh does not lose your work.
• The staff application — the part used by our customers' own staff — additionally loads fonts and maps from Google, as listed in section 7.2. Nothing it stores in a browser requires consent.

The full, itemised list — every cookie and every piece of browser storage, with its name, purpose, lifetime and whether it needs your consent — is in our Cookie Policy, which also explains how to clear or block any of it.

---

15. Children

The service is not intended for children. We do not knowingly collect personal data from children. Our customers are instructed not to enter a child's personal data into the platform. Where we hold such data as controller we will delete it on request; where it sits inside a customer's account, that customer is the controller and we will pass the request to them and carry out the erasure on their instruction. Where local law sets a specific age of consent, that law applies to our customer as the controller of the record.

Field 2 Service is a business-to-business service. It is not directed at children and is not intended for use by anyone under 18. We do not knowingly collect personal data from children.

We should be clear about what that means in practice: we collect no date of birth and perform no age verification anywhere in our website, our signup, our support desk or the product. Our statement is about who the service is for, not a technical control that filters children out.

If you believe a child's personal data has reached us, email hello@field2service.com and we will look into it and delete it where we hold it as controller. If it is inside a business's account, we will pass the matter to that business — see section 3.

---

16. How we protect personal data

These are the measures we actually operate. We have deliberately not listed anything we do not do.

Keeping accounts separate

• Every customer's data lives in its own database. One class is responsible for connecting to a customer's database, and until a customer has been positively identified, the application is pointed at a database that does not exist — so a stray query fails rather than reading someone else's data.
• Every query inside the application is additionally scoped to the customer's own company record.
• The AI is locked to the calling customer's data, and for a field engineer, to that engineer's own jobs.

Accounts and access

• Passwords are stored as bcrypt hashes, never in readable form, and are removed from the session and from every API and AI response.
• Two-factor authentication using standard time-based one-time codes is available; seeds are encrypted at rest and recovery codes are stored hashed.
• Stored secrets — outgoing email passwords, payment API keys, OAuth tokens — are encrypted at rest (AES-256 with an HMAC-SHA-512 integrity check) and decrypted only at the moment they are used. They are never written to a log.
• Roles and permissions limit what each user can see and do.

Resisting attack

• Rate limits on the paths attackers target: 5 login attempts per IP address and 5 per email address in 10 minutes; 20 password-reset requests per hour per IP address and 5 per hour per email address; 5 customer-portal login attempts per IP address in 10 minutes; 5 website contact-form submissions per hour per IP address.
• We never reveal whether an account exists. Login, password reset, portal reset and signup all return the same response either way.
• Cross-site request forgery protection on every request that changes data, with a randomised token. The few public forms that cannot carry one — signup, public booking, support intake — are protected by origin checks, a hidden honeypot field and per-IP throttling instead.
• Session cookies are HttpOnly, SameSite=Lax and Secure in production, and expire after 2 hours.
• Public payment and quote links are unforgeable: each carries an HMAC-SHA-256 signature that cannot be guessed or constructed. Since 6 September 2026 they also expire — 90 days from issue by default, and the business can change that — and can be revoked one at a time, or all of one customer's at once. We store only a one-way hash of each link, so the register behind them cannot be turned back into links.
• Since 6 September 2026 security-relevant events — failed sign-ins, lockouts, password changes, two-factor removals, API-key changes, data exports, bulk permanent deletions and content-security-policy violations — are written to a durable record that nothing in the application updates or deletes, and four alert rules fire on it: repeated failed sign-ins from one address, one address attacking several accounts, an export outside working hours, and a batch of twenty-five or more permanent deletions. We do not describe this as monitoring, and §19.15 says exactly what it is not.

• Every change to a customer's email or SMS contact preference is recorded — the old and new value, where the change came from, who made it and from which IP address.
• Uploaded files are stored outside the web root and are not directly reachable by URL.
• The application sends anti-framing and strict-transport-security headers.

Accountability

• Every change is logged — who made it, what changed, when, and from which IP address. Administrative actions on our platform are logged separately.
• Data is encrypted in transit by TLS.

What we do not claim. We do not hold ISO 27001, SOC 2 or any other independent security certification, and we do not claim to. No system is perfectly secure; if something does go wrong, we have committed to our business customers, in the Data Processing Agreement, to tell them without undue delay so they can meet their own obligations.

---

17. Changes to this policy

We may update this policy — for example when we add a feature, change a provider, or the law changes.

• The version number and effective date at the top always tell you which version you are reading.
• If we make a material change, we will tell account holders by email and in the application before it takes effect.
• If we ever want to use personal data we already hold for a genuinely new purpose, we will tell you about that new purpose, and give you the information in this policy that relates to it, before we start — and where the new purpose needs your consent, we will ask for it.
• Changes to the providers we use are announced on the Sub-processor list in advance, as set out in our Data Processing Agreement.

---

18. Contact us

Related documents: Terms of Service · Data Processing Agreement · Sub-processor list · Cookie Policy · Acceptable Use Policy · Government and law-enforcement requests

---

19. Jurisdiction addendum

19.0 How this section works

We apply the GDPR standard to everyone, everywhere. Where your local law gives you rights beyond it we honour those rights, and they are listed below. We do not claim to be subject to a law that does not apply to us; where a law does apply to us directly it is named.

Everything in sections 1 to 18 applies to you wherever you are. The European standard is the strictest of the regimes we have looked at on almost every point — the reasons we may hold data, the terms we impose on providers, the rights you have, and the way data may cross a border — so applying it to everyone means nobody gets a weaker standard because of where they live.

But it is not strictest on every point, and this section is where we say so. Each entry below states three things and nothing more: the rights your law gives you beyond the ones in section 10; the regulator you can complain to; and how your data reaches us in Ireland lawfully. Where your law imposes a duty on us directly, we name the provision. Where it imposes the duty on the business whose account holds your data, we say that instead, and section 3 tells you what to do about it.

One rule governs the whole section. We say "we comply with" a law only where that law binds us directly and our software can actually meet it. Everywhere else we say either "your law gives you the following rights, which we honour" or "this is your provider's obligation, and here is how we support them in meeting it". Anything our software cannot do is written as a limitation, in section 19.15, and not dressed up.

19.1 United Kingdom

⚠ The UK's adequacy finding in favour of the EEA was not verified from a primary source in the research behind this section; the EU's finding in favour of the UK was. Both are recorded in section E of the owner notes.

19.2 United States — California

California is treated separately from the other states because it is the only US state privacy law that does not exempt business contacts or staff records. Its business-to-business and employment exemptions (Civ. Code §1798.145(m) and (n)) both became inoperative on 1 January 2023, so a Californian business's staff records and its business customers' contact details are fully within the CCPA.

19.3 United States — the other states

Twenty-two other states have enacted comprehensive consumer privacy laws that we have examined — twenty-three including California, or twenty-four if Florida's narrower Digital Bill of Rights is counted. Eighteen of those twenty-two, together with California, are in force today; the remaining four take effect between 2027 and 2028. Their rights are near-identical, so we state them once rather than twenty-two times, and we honour them for any US resident who asks — whichever state you are in, and whether or not your state's law happens to reach us.

19.4 Canada

19.5 Canada — Quebec

Quebec's Law 25 is the most demanding privacy regime in Canada and several of its rights have no European equivalent.

19.6 Brazil

19.7 Australia

19.8 New Zealand

19.9 South Africa

19.10 Switzerland

19.11 Japan

⚠ Japan's breach-notification regime was not researched in the work behind this section, so nothing here states a Japanese breach position.

19.12 Singapore

19.13 India

⚠ State of the law first, because it changes the answer. India's Digital Personal Data Protection Act 2023 is enacted, but its operative provisions are not yet in force. The obligations, the rights and the penalty power all commence around May 2027. Until then the operative Indian law for sensitive personal data remains section 43A of the Information Technology Act 2000 and the SPDI Rules 2011. ⚠ Those were not examined in the research behind this section, so nothing here states a position under them, and we make no claim of compliance with either regime.

19.14 Marketing messages, and what we do about them

Our software sends messages for the businesses that use it, and it is those businesses that decide what to send and to whom. Two things follow, and we state them plainly rather than making a compliance claim.

• ⭐ We can be a "sender" in our own right. Singapore's Do Not Call rules treat anyone who sends a message, causes it to be sent or authorises its sending as a sender — including a platform transmitting it for someone else's purposes — and being a data intermediary is expressly no defence. We therefore treat ourselves as a potential sender rather than a mere conduit.
• ⚠ A person's contact preference cannot separate marketing messages from operational ones. Since 6 September 2026 our software does classify each message it sends as transactional, automated, marketing or account-security when it decides whether to send, and applies a person's preference to every one of them — including the direct "send quote" and "send invoice" actions, which used to go round it. But there is still one pair of contact preferences per person, so switching a channel off switches off all of those classes together — with the single deliberate exception of a message about the person's own portal access that they asked for in that request, which is always sent so that an opt-out cannot lock somebody out of their own records — and there is no field recording why a person is on a list. Our software also has no campaign or bulk-messaging feature, so there is no marketing send list within it to separate. Those are limitations, recorded in section 19.15 and in Annex 5 of our Data Processing Agreement, and they are the reason we make no marketing-compliance claim for any jurisdiction.

Where a business uses our software to send an appointment confirmation, an arrival window, a completion notice or an invoice, that is an operational message and is treated as such everywhere we have looked. A promotional message is a different thing in law, and it is the sending business's responsibility to have a lawful basis for it — under South African law, consent in the prescribed form; under Singaporean law, an express consent or a register check, because neither legitimate interests nor deemed consent can carry marketing there; under Indian law, consent, because the closed list of other lawful uses contains no marketing limb.

⚠ Four regimes that plainly bear on this were not researched: Canada's anti-spam law, the United States Telephone Consumer Protection Act, the UK and EU e-privacy direct-marketing rules, and Australia's Spam Act and Do Not Call Register Act. We make no marketing-compliance claim for Canada, the United States, the United Kingdom, the European Union or Australia, and nothing in this policy should be read as one.

19.15 What our software cannot do — stated, not implied

Every entry below is a limitation of the product, not a drafting choice. Each is also recorded in Annex 5 of our Data Processing Agreement, where the businesses that use the software can see it.

---