Privacy Policy

Last updated: 21 July 2026

This Privacy Policy explains how Fieldwork AI Inc. ("Fieldwork", "we", "us"), a Delaware corporation operating in the United States and the United Kingdom, handles personal data. It covers our website at getfieldwork.ai (the "Site") and our agentic AI platform (the "Service").

The most important thing to understand is that we act in two different roles:

• When we decide why and how personal data is used - for visitors to our Site, prospective customers, and the account, billing, and usage data of people who use the Service - we are the controller, and this policy describes that processing in full.
• When we process data inside a customer's organization on their behalf - the business records, communications, and content our customers connect or enter, which may include personal data about their staff, customers, and suppliers - our customer is the controller and we are the processor, acting under our contract and Data Processing Addendum with them. Sections 1–8 of this policy do not govern that processing; see Section 9. If your data reached us through a business that uses Fieldwork, please direct requests to that business - we will assist them in responding.

1. Personal data we collect as controller

You give us:

• Contact and inquiry data - name, work email, company, role, and message content when you contact us, request a demo, or sign up for updates.
• Account Data - when your organization uses the Service: your name, work email, role, authentication details, and your communications with us (including support requests).
• Billing data - business billing contacts and payment details for paying customers.

Generated when you use the Site or Service:

• Usage Data - technical and usage information: log data, device and browser information, IP address, pages and features used, agent and tool usage metadata, performance metrics, and provenance records (for example, which user approved a change). Usage Data does not include the content of customer organization data.
• Cookies and similar technologies - see Section 8.

From third parties: business contact information from your colleagues (for example, when they invite you to an organization) and from publicly available or licensed business sources used for sales outreach.

2. How we use it (and why we're allowed to)

Purpose	Data	Legal basis (UK/EU GDPR)
Provide and administer the Service; authenticate users; support	Account Data, Usage Data	Contract performance
Billing and account management	Account Data, billing data	Contract performance; legal obligation
Secure the Site and Service; prevent fraud and abuse	Usage Data, Account Data	Legitimate interests (protecting our services and customers)
Improve and develop our products, including analytics and training our application-level models on de-identified data	Usage Data; de-identified data	Legitimate interests (improving our services)
Respond to inquiries; send product and marketing communications	Contact data	Legitimate interests; consent where required (you can opt out anytime)
Comply with law	As required	Legal obligation

We do not sell personal data, and we never train foundation models or large language models on customer organization data - identifiable or de-identified. Our own application-level systems (for example, forecasting and recommendations) learn only from de-identified data and Usage Data.

3. Sharing

We share personal data only with:

• Service providers processing on our behalf - cloud infrastructure and AI model providers, and providers of email delivery, support, billing, and analytics tooling. Our current sub-processors for the Service are listed at https://www.getfieldwork.ai/subprocessors.
• Our group companies - Fieldwork AI Ltd, our wholly-owned UK subsidiary, whose personnel provide engineering, operations, and support functions for us, under our security policies and intra-group data protection safeguards.
• Professional advisers (lawyers, accountants, insurers) under confidentiality.
• Corporate transactions - a buyer or successor in a merger, acquisition, or asset sale, under this policy.
• Legal requirements - where required by law or to protect rights, safety, or security; we will challenge overbroad requests where we reasonably can.

4. International transfers

We operate in the United States and the United Kingdom, and serve customers internationally. For purposes of the UK GDPR, Fieldwork AI Inc. is established in the United Kingdom. Data is stored in the United States (AWS us-east-2). AI inference requests are by default routed globally by our cloud and model providers and may be processed transiently in other regions worldwide, except that inference is not routed to any jurisdiction subject to comprehensive US, UK, or EU sanctions or export restrictions. Inference requests are configured for zero or minimal retention; a small number of models retain prompt data briefly for the model provider's trust-and-safety purposes (never for training), as described on our sub-processor page at https://www.getfieldwork.ai/subprocessors, which also sets out available geography-pinning options. Where we transfer UK or EEA personal data to the United States or elsewhere, we rely on the EU Standard Contractual Clauses supplemented by the UK Addendum, and on our providers' equivalent onward-transfer safeguards (and note the UK–US Data Bridge as additional context). Copies of relevant safeguards are available on request.

5. Retention

We keep personal data only as long as needed: Account Data for the life of the account plus a limited wind-down period; billing records as required by tax law; Usage Data in identifiable form for up to 12 months and thereafter only in de-identified form; marketing contact data until you opt out or it goes stale. Customer organization data is retained and deleted per the customer's contract (export window, then deletion within 30 days).

6. Your rights

If you are in the UK or EEA you may ask us to: access, correct, or delete your personal data; restrict or object to processing (including any processing based on legitimate interests, and direct marketing at any time); receive a portable copy; and withdraw consent where processing is based on consent. Contact privacy@getfieldwork.ai. We will respond within one month. You may complain to your supervisory authority - in the UK, the Information Commissioner's Office (ico.org.uk); in the EU/EEA, your local data protection authority.

If your personal data is in a customer's organization, the customer controls it - contact them, and we will support their response as processor.

Residents of US states with comprehensive privacy laws may have similar rights under those laws.

7. Security

We maintain a written information security program: encryption in transit (TLS 1.2+) and at rest (AES-256), least-privilege access with MFA on all systems, tenant isolation, endpoint protection, audit logging, and a documented incident response procedure with 72-hour breach notification to affected customers. No system is perfectly secure; we design so that a failure is contained and detected.

8. Cookies

Our marketing Site sets no cookies. The Service (app.getfieldwork.ai) uses a strictly necessary first-party cookie to keep you signed in; we do not use analytics or advertising cookies. Because these are strictly necessary to provide the Service you have requested, we do not ask for consent to them. Full details are in our Cookie Policy. If we introduce non-essential cookies or similar technologies, we will add consent controls before doing so. You can control cookies through your browser, though disabling the session cookie will prevent you from staying signed in.

9. The Service: processing on our customers' behalf

When a business connects third-party systems to Fieldwork or its staff enter content into their organization, that data - which may include personal data about the business's staff, end customers, and suppliers - is processed on the business's documented instructions under our Data Processing Addendum. In that processing: the business is the controller; we are the processor; our sub-processors are listed at https://www.getfieldwork.ai/subprocessors; personal data is minimised or pseudonymised at ingestion where practicable; AI outputs are advisory and designed for human review; and data is deleted after the contract ends per Section 5. Where we de-identify organization data or use it to improve the Service, we do so as processor on the business's documented instructions under our contract with them. We are an independent controller only of the Account Data, Usage Data, security data, and de-identified data described in Sections 1–2.

10. Children

The Site and Service are for business users and not directed to anyone under 18. We do not knowingly collect children's data.

11. Changes

We will post changes here and update the date above; material changes will be notified to account holders by email or in-product notice.

12. Contact

Fieldwork AI Inc. - 169 Madison Ave, Ste 79708, New York, NY 10016, USA Email: privacy@getfieldwork.ai