Privacy Policy

This Privacy Policy explains how Field Forge Limited ("we", "us", "our"), a company registered in Northern Ireland (company number NI715154) with its registered office at Office 1739, 92 Castle Street, Belfast, BT1 1HE, collects, uses, stores, and protects your personal data when you use the Field Forge platform and related services (the "Service").

We are the data controller for the personal data we collect about you as a user of the Service (for example your account details and how you use the Service). For the personal data you and your team enter about other people — your clients, their contacts, your staff, suppliers and subcontractors — your organisation is the controller and we process that data on your behalf as its processor, under our Data Processing Agreement. If you have questions about this policy or your personal data, please contact us at contact@fieldforge.io.

1. Information We Collect

1.1 Account Information

When you register for Field Forge, we collect:

• Your name and email address
• Company name
• Password (stored securely via Firebase Authentication — we never have access to your plain-text password)
• Google account data if you sign in with Google (name, email, profile photo)

1.2 Business Data You Provide

Through your use of the Service, you may input:

• Client & contact data: names, email addresses, phone numbers, billing addresses, account references
• Site data: addresses, GPS coordinates, access instructions
• Staff data: names, email addresses, roles, trades, hourly cost rates, time and attendance records
• Staff location data: the location of clock-ins, clock-outs and completed tasks, and — where the employer turns on location tracking — route history while clocked in. The employer chooses how long route history is kept; staff are shown what is recorded before they use the field app
• Supplier & subcontractor data: names, contact details, payment terms
• Job & quote data: descriptions, scheduled dates, labour items, material items, costs, photos, notes, time entries
• Financial data: invoices, payment records, VAT information
• Contracts & forms: maintenance contracts, custom form submissions
• Asset data: equipment details, inspection records, barcode/QR references

1.3 Data Processed by AI Features

When you use an AI feature — for example generating a quote, importing a scope of works, reading a supplier invoice or weather forecast, matching import columns, drafting a form, report, programme, workflow rule or email, summarising a job, or asking the help assistant a question — the content needed for that task is sent to a third-party AI provider for processing. See Section 5 for what is sent and how it is protected.

1.4 Payment Information

Subscription payments are processed by Stripe. We do not store your full credit/debit card details. Stripe collects and processes your payment information in accordance with their own privacy policy. We receive limited information from Stripe such as the last four digits of your card, card type, and billing address.

1.5 Technical & Device Data

We automatically collect:

• IP address and approximate location
• Browser type and version
• Device type and operating system
• Firebase App Check tokens (via reCAPTCHA v3) to protect against automated abuse
• Usage data including pages visited and features used (through Google Analytics, only if you accept analytics cookies)
• Error logs and performance data, including — when an error occurs — a short replay of the screen leading up to it with on-screen text masked (through Sentry)
• Records of AI feature use (which feature, when, and its processing cost) to operate the AI allowance described in our Terms of Service

1.6 Activity & Audit Data

We maintain an audit trail of actions performed within your account, including timestamps, user identifiers, and the nature of each action (e.g., creating a job, updating an invoice, deleting a record).

2. How We Use Your Information

We use the information we collect for the following purposes:

3. How We Share Your Information

We do not sell your personal data. We share data only with the following categories of recipients:

3.1 Service Providers (Sub-processors)

3.2 Customer Portal

If you use the Customer Portal feature, limited job, quote, and invoice information may be shared with your clients through the portal interface. You control what data is made available through the portal.

3.3 Integrations You Connect

If you connect an accounting package (such as Xero or QuickBooks), we send the invoices, customers and related records you choose to sync to that provider. Once received, that data is handled under your own agreement with the provider and its privacy policy.

3.4 Legal Requirements

We may disclose your data if required by law, regulation, or legal process, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

4. International Data Transfers

Some of our service providers are based in or operate from the United States. When your data is transferred outside the United Kingdom, we ensure appropriate safeguards are in place, including:

• UK adequacy regulations where available (including the UK Extension to the EU–US Data Privacy Framework, the “UK–US data bridge”, for certified US recipients)
• The UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, issued by the Information Commissioner

Our service providers each maintain data protection agreements that include these safeguards.

5. AI Data Processing

Our AI features send the content needed for each task to Google (Gemini API) and, where enabled as a fallback for quote generation, OpenAI. Important points:

• Data is sent when someone in your organisation uses an AI feature, or when an automation your organisation has set up drafts an email or summary with AI
• We send only what the task needs: for example the job description for a quote; the uploaded document for a scope of works, supplier invoice, forecast or form; the column headings and a few sample rows for import matching; the job’s notes, time and materials for a job summary; and your question and the page you are on for the help assistant
• That content can include personal data — for example names, addresses or contact details that appear in a document or job record — so please avoid including personal data an AI feature does not need
• Our AI providers process this data to return a result to us, and do not use it to train their general models under the terms on which we use their API services
• AI output is a suggestion only — it is labelled in the Service, and you review, edit, and approve it before it is saved or sent. AI-drafted emails are never sent to anyone without a person in your organisation approving them

6. Data Retention

We retain your data as follows:

• Active account data: retained for the duration of your subscription
• Soft-deleted records: retained in the recycle bin for 30 days before permanent deletion
• Audit logs: retained for 2 years from creation
• Our own financial records (such as subscription invoices): retained for 7 years, to meet HMRC and Companies Act record-keeping requirements
• Account data after cancellation: retained for 30 days to allow reactivation, then permanently deleted within 90 days
• Backup data: removed from backups within 90 days of deletion from production systems

7. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of access: request a copy of the personal data we hold about you
• Right to rectification: request correction of inaccurate or incomplete data
• Right to erasure: request deletion of your personal data (subject to legal retention requirements)
• Right to restrict processing: request that we limit how we use your data
• Right to data portability: receive your data in a structured, machine-readable format
• Right to object: object to processing based on legitimate interests
• Right to object to direct marketing: tell us to stop sending you marketing at any time, and we will. Switch off “Product news and offers” in Settings → Privacy & Data, use the unsubscribe link in any marketing email, or contact us
• Right to withdraw consent: where processing is based on consent, withdraw it at any time
• Rights related to automated decision-making: we do not make any solely automated decisions that have legal or similarly significant effects on you. AI output in the Service is always subject to human review.

To exercise any of these rights, please contact us at contact@fieldforge.io. We will respond within one month.

8. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• Encryption in transit (TLS/HTTPS) and at rest (AES-256 via Google Cloud)
• Firebase Authentication with secure password hashing
• Role-based access controls within the application
• Firebase App Check with reCAPTCHA v3 to prevent automated abuse
• Firestore Security Rules enforcing company-level data isolation
• Regular security reviews and updates
• Subscription-gated write access to prevent unauthorised data modification

9. Cookies

We use cookies and similar technologies to operate the Service. For full details, please see our Cookie Policy.

10. Children's Data

Field Forge is a business-to-business service designed for contractors and trade professionals. We do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by a prominent notice within the Service. The "Last updated" date at the top of this page indicates when the policy was most recently revised.

12. Complaints

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Telephone: 0303 123 1113

13. Contact Us

For any questions about this Privacy Policy or your personal data:

• Field Forge Limited
• Office 1739, 92 Castle Street, Belfast, BT1 1HE, Northern Ireland
• Company Number: NI715154
• Email: contact@fieldforge.io