Privacy Policy

Effective Date: 2026-05-10 Last Updated: 2026-10-19

FieldSpect ("we," "us," or "our") provides a mobile-first checklist and inspection platform (the "Service"). This Privacy Policy explains what information we collect, how we use and share it, and the rights available to you.

This policy is written to comply with the California Consumer Privacy Act as amended by the CPRA ("CCPA/CPRA"), Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA"), and Quebec's Act respecting the protection of personal information in the private sector, as modernized by Law 25 ("Law 25").

This policy does not describe the practices of our Customers. Where a Customer collects information from Inspectors, clients, or other end-users through the Service, the Customer is responsible for providing its own notices and obtaining any required consents.

1. Definitions

• Customer. The organization that signs up for and pays for the Service.
• Account Holder. The individual who creates the Customer's account (typically an owner or admin).
• Inspector. A user authorized by a Customer to perform inspections through the Service. Inspectors are often Customer employees or contractors.
• Account Data. Information about the Customer and its users — names, emails, organization name, branding assets, payment metadata, subscription state.
• Inspection Data. Content produced by an Inspector while using the Service, including checklist responses, notes, signatures, photos, location coordinates, scores, timestamps, and client names and email addresses entered by Inspectors.
• Personal Information or PI. Information that identifies, relates to, or could reasonably be linked with an identified or identifiable person. "Personal information" under PIPEDA and Law 25 has substantially the same meaning.

2. Our Roles

Different parts of the data flow place us in different roles:

• Account Data — we act as the business (CCPA/CPRA), organization (PIPEDA/Law 25), or controller of this information. Section 5 rights apply directly.
• Inspection Data — we act as a service provider (CCPA/CPRA) or processor (PIPEDA/Law 25) on behalf of the Customer. The Customer is responsible for the lawful basis and notices that apply to Inspection Data. Requests from Inspectors or other Customer end-users regarding Inspection Data should be directed to the Customer; we will assist the Customer in responding.

A Data Processing Addendum ("DPA") is available on request for Customers that require one.

3. Information We Collect

A. Account Data

Collected directly from you when you register, configure your organization, or pay:

• Name and email address. We do not use passwords: you sign in with a one-time code or a link that we send to your email address.
• Organization name, an optional description of your industry, and branding assets (logos, colors)
• Email addresses of people you invite to your organization, kept with the invitation, including pending and revoked invitations
• Records of your acceptance of our Terms of Service and this Policy: the date, the document version, and, on the web, your IP address and browser user agent
• Subscription tier and billing metadata (we do not store card numbers; Stripe handles all card data)

B. Inspection Data

Captured by Inspectors using the Service:

• Completed checklist responses, notes, and signatures as entered on signature questions
• Client details entered by the Inspector: a client name and a client email address
• Photos taken in the mobile app. The app uses the camera only. Each photo is re-encoded on the device to a 1600-pixel JPEG with embedded metadata (EXIF) removed. When the photo is taken, the app records a hash (a digital fingerprint), file size, pixel dimensions, app version, capture time, and the inspection's location if it was captured, so that a later change to the photo can be detected. The hash is checked again before upload, and recorded hashes cannot be changed.
• Photos added in the web app. These are taken with the device camera or chosen from files, and are resized in the browser, which removes embedded metadata. The hash is recorded when the photo is uploaded, not when it was taken. No location is attached, and the photo's time comes from the file.
• Geolocation (mobile app only). The new-inspection screen has a "Capture location" switch. It is on by default and can be turned off before you start the inspection. When it is on, the app records the device's GPS coordinates once, at the start of the inspection, and attaches them to that inspection's photos. The coordinates are printed under each photo in the PDF report. The web app never collects location.
• Whether the inspection was done in the mobile app or the web app
• Scores, timestamps, and inspection status

C. Device and Usage Data

Collected automatically when you use the Service:

• Device identifier, operating system version, hardware model, and app version
• IP address (used for security, abuse prevention, and approximate geographic context)
• Product analytics events (collected via PostHog): page and screen views and feature usage. On our website and web app, analytics cookies and session recordings are used only if you accept them (see Section 11). In session recordings, the text on the page and everything you type are masked. The mobile app sends product analytics without session recordings.
• Error and crash reports (collected via Sentry)
• App update checks: each time the mobile app starts, it checks Expo's update service for app updates

We do not use the Service to track users across unrelated websites or for cross-context behavioral advertising.

D. Sensitive Personal Information (CCPA/CPRA)

Some of the data above is classified as Sensitive Personal Information under CPRA:

• Precise geolocation (GPS coordinates from Inspection Data)
• Account log-in information (your email address combined with the one-time sign-in codes we send)

We use Sensitive PI only to provide the Service and for the purposes described in Section 4. We do not use it to infer characteristics about you or for any purpose that gives rise to a right to limit under §1798.121.

E. CCPA category mapping

For California residents, the categories of PI we collect, sources, business purposes, and the third parties we share each category with:

We do not knowingly collect the following CCPA categories: biometric information (we do not perform facial recognition on photos), education information, characteristics of protected classifications, geolocation outside of inspections, or inferences drawn from PI.

4. How We Use Information

• Provide the Service — authenticate users, sync inspections, render branded PDF reports, deliver email, deliver reports to the recipients a Customer designates, and keep records of when you accepted our terms.
• Secure the Service — detect abuse, prevent fraud, enforce rate limits, screen sign-up and login for automated (bot) abuse via CAPTCHA, and investigate incidents.
• Support and communicate — respond to questions, send service-related emails (subscription, security, billing), notify of material policy changes, and proactively reach out to new users to help with onboarding or ask for product feedback.
• Improve the Service — analyze aggregated usage to prioritize features and fix defects.
• Comply with law — respond to lawful requests, enforce our agreements, defend our rights.

We do not collect, use, retain, sell, or share your Personal Information — including Inspection Data, Account Data, or Device and Usage Data — to develop, train, or fine-tune any large language model (LLM), generative artificial intelligence system, or other machine learning model, and we do not permit our subprocessors to do so on their own behalf.

5. How We Share Information

We do not sell Personal Information, and we do not share Personal Information for cross-context behavioral advertising as those terms are defined under CPRA.

We share information with:

• Subprocessors. A current list is maintained at fieldspect.com/legal/subprocessors. At the time of this policy: Supabase (database, authentication, file storage; US; runs on AWS infrastructure), Stripe (payments; US), Vercel (web hosting and CDN; US), Cloudflare (DNS, inbound email forwarding, and bot/abuse protection (CAPTCHA) on our website's sign-up and login pages; US), PostHog (product analytics and masked session recording; US), Sentry (error monitoring; US), Resend (transactional email, including sign-in codes and reports sent to recipients the Customer designates; US), Expo (mobile app updates; US). Some of these subprocessors rely on their own infrastructure providers (for example, Supabase hosts data on Amazon Web Services); we are not a direct customer of those underlying providers.
• Legal compliance. When required by law, subpoena, court order, or where necessary to protect the rights, safety, or property of FieldSpect, our Customers, or the public.
• Business transfers. In connection with a merger, acquisition, financing, reorganization, or sale of assets — we will require successors to honor the commitments in this policy.
• Report recipients your organization designates. When an inspection includes a client email address, the Service automatically emails that address a link to the PDF report the first time the report is generated. The email is sent through Resend, and its sender shows your organization's name followed by "via FieldSpect". The link expires after 24 hours, and an admin can re-send it from the web app. Reports and report emails show the inspector's name, or the inspector's email address if no name has been set.
• Public Template Library. If a Customer marks a template as Public, the template's structure and questions become publicly visible at fieldspect.com/templates/[slug]. Inspection responses against a public template are never made public. Customers are responsible for ensuring no Personal Information is embedded in templates they choose to publish.

We require subprocessors to commit, by contract, to handling Personal Information consistently with this policy and with applicable law.

6. Data Storage, Transfers, and Device Storage

Server-side storage. Inspection Data and Account Data are stored on Supabase infrastructure in the United States. Inspections started in the web app are saved to our servers as you go, starting with the first autosave, including drafts that are never submitted. If you are located outside the United States, your information will be transferred to and processed in the United States. By using the Service you consent to this transfer.

Storage on your device. The mobile app stores Inspection Data locally on the device so that inspections can be completed offline. Local data is removed when you sign out of the app or uninstall it. Local storage is protected by the operating system's standard application-data isolation; it is not separately encrypted at rest. If your organization's rules require encrypted device storage, take this into account before deploying the mobile app.

Photos. Photos taken in the mobile app are compressed and re-encoded on the device before upload, with embedded device metadata (EXIF) removed. A hash of each photo is recorded when it is taken and checked again before upload. Photos added in the web app are resized in the browser, which removes embedded metadata, and are hashed when they are uploaded. Photos are stored in Supabase Storage with access controlled by per-organization signed URLs. After an inspection is submitted, users cannot alter or remove its individual photos; the database enforces this.

7. Data Retention

We retain Personal Information for the periods below. After the retention period expires, data is deleted or anonymized.

Inspections a member completed stay with the Customer's organization when that member leaves the organization or deletes their account.

A Customer may request earlier deletion at any time, subject to legal-retention exceptions.

8. Your Rights and Choices

The following rights are available depending on where you live:

How to exercise these rights. Email privacy@fieldspect.com. We will acknowledge requests within 10 business days and respond substantively within 45 days (extendable by 45 additional days where permitted by law). We will not discriminate against you for exercising any of these rights.

Self-service deletion. You may also delete your account and Personal Information immediately yourself, without waiting on the response times above: from Settings within the mobile app, or from the web at fieldspect.com/delete-account. If you are the sole member of your organization, this immediately cancels any paid subscription (with a prorated refund) and deletes the organization's data. If you are a member of an organization with other members, only your own account is deleted, and the inspections you completed stay with the organization. If you are the sole owner of an organization that has other members, you cannot delete your account yourself, so that one person cannot delete data shared with a team. Email privacy@fieldspect.com and we will help you transfer ownership or delete the organization.

Verification. We verify requests by confirming control of the email address on file. For requests that affect Sensitive PI or Inspection Data, we may request additional verification.

Authorized agents. California residents may use an authorized agent. The agent must provide written permission from the consumer and we may verify the consumer's identity directly.

Inspection Data requests. Where a request concerns Inspection Data, we will refer the requester to the relevant Customer (the controller of that data) and will support the Customer in responding.

9. Children

The Service is not directed to children under 13, and we do not knowingly collect Personal Information from anyone under 13. If you believe a child has provided us Personal Information, contact us at privacy@fieldspect.com and we will delete it.

10. Security

We maintain administrative, technical, and physical safeguards designed to protect Personal Information, including:

• TLS 1.2+ for all data in transit.
• AES-256 encryption at rest for data stored in Supabase managed services.
• Row-Level Security policies to enforce tenant isolation between Customer organizations.
• Least-privilege access controls for staff.

No security control is infallible. We cannot guarantee absolute security and you are responsible for keeping your account credentials confidential.

Breach notification. If we discover a breach of security involving Personal Information, we will notify affected Customers without undue delay and, where required by law, the appropriate regulators — consistent with the notification timelines required by CCPA, PIPEDA, and Law 25.

11. Cookies and Similar Technologies

Our website and web app use two kinds of cookies and similar browser storage:

• Strictly necessary. These keep you signed in, protect sign-up and login from automated abuse (Cloudflare Turnstile), remember the email address you are signing in with until you enter your code, and remember your cookie choice. They are always on, because the Service does not work without them.
• Analytics (optional). PostHog cookies and browser storage that recognize your browser across visits, and session recordings that show how pages are used. These stay off until you choose Accept in the cookie banner.

If you have not made a choice, or you choose Decline, PostHog still counts page views and feature usage, but without cookies, without storing an identifier in your browser, and without session recordings. You can change your choice at any time with Cookie settings in the footer of our website.

We do not use advertising cookies, and we do not use cookies to track you across other websites. The mobile app does not use cookies.

12. Automated Decision-Making

We do not use automated decision-making that produces legal or similarly significant effects about you.

13. Quebec (Law 25)

In addition to the rights described in Section 8:

• Privacy Officer. Our designated Person Responsible for the Protection of Personal Information is named in Section 15.
• Data residency. Personal Information of Quebec residents is stored in the United States.
• Confidentiality settings. Our defaults are designed to provide the highest level of confidentiality without further action from you.

14. Changes to This Policy

We will update this policy when our practices change. Material changes will be notified by email to Account Holders and posted on the marketing site at least 10 days before they take effect. The "Last Updated" date at the top of this policy reflects the most recent revision.

15. Contact Us

FieldSpect LLC 116 Agnes Rd Ste 200 Knoxville, TN 37919 Privacy contact: privacy@fieldspect.com General contact: hello@fieldspect.com Website: fieldspect.com

Person Responsible for the Protection of Personal Information (Law 25 / Privacy Officer): FieldSpect Privacy Officer — reachable at privacy@fieldspect.com.