Field2Office privacy

Robert Sparrow trading as Field2Office · 7 Windermere Close, Daventry, NN11 9ED, United Kingdom

Field2Office Privacy Notice Operator and contact Robert Sparrow trading as Field2Office, 7 Windermere Close, Daventry, NN11 9ED, United Kingdom. Support and privacy requests: hello@field2office.co.uk. We control account, support, subscription and platform-security data. The subscribing trade business normally controls its customer and job information, and we process it on that business's instructions. Requests about a trade job should normally go to the trade business first. Information and purposes We process account email addresses, business details, password hashes, activation codes, authenticator settings, sessions and security records to operate accounts and protect the service. The bases are contract for account operation and legitimate interests for security and abuse prevention. Trial registration records include business name, email, requested workspace address, country, language and currency preferences, and acceptance of the current legal documents. A one-use activation code is delivered through Resend. The trial starts when the account is activated. Workspace information may include customer names and contact details, addresses, job notes, dates, photos, service prices, quotes, invoices, receipts, recorded payments, voice transcriptions and calendar entries. We process it to provide the service on the business's instructions. The business is responsible for its lawful basis and customer notices. We process subscription status, Stripe references, currency, billing invoices and amounts to operate subscriptions, resolve billing disputes and meet applicable legal obligations. Payment card details are collected by Stripe Checkout and are not entered into the Field2Office database. Support messages and operational/security logs help us answer enquiries, investigate failures and protect users. The bases are legitimate interests, contract where applicable, and legal obligation where applicable. We do not sell customer lists or use workspace data to train our own AI model. AI suggestions are reviewed by users rather than being used for solely automated decisions with legal or similarly significant effects. Providers and recipients Hostinger provides the VPS infrastructure for workspace databases and local backups. The public marketing website is hosted using ChatGPT Sites through OpenAI and Cloudflare infrastructure. Workspace databases are not stored in the marketing site. Each provider may process service metadata and technical logs under its terms. OpenAI provides API-based AI assistance and transcription when those features are used. Necessary prompts, selected business/job context and audio may be sent for those requests. The service does not promise zero provider retention or UK-only AI processing. OpenAI's API service terms and Data Processing Addendum govern provider processing. Resend, operated by Plus Five Five, Inc., delivers activation and document emails. Document sending shares recipient/sender/reply-to addresses, subject, message, attachments and delivery metadata. Authorised platform operators may access managed sending records and potentially content or attachments in the shared Resend account. Replies are handled by the business's own mailbox provider. Users may configure a complete custom sender where supported. Google handles authorisation and calendar data when a user connects Google Calendar. Stripe handles checkout, subscriptions, payment methods, invoices and cancellation. These providers may also act as controllers for their own account, security and payment obligations. We disclose data where required by law and restrict operator access to necessary support, security and service operation. Locations and international processing Provider processing can take place outside the UK, including in the United States and the European Economic Area. A European email sending region or a UK-facing website does not mean all stored data remains in the UK. We do not promise a UK-only hosting region. Provider contracts and published subprocessor schedules identify their processing locations. Transfers must use an applicable adequacy decision or appropriate contractual safeguards, including the UK Addendum to Standard Contractual Clauses where applicable. Contact us for relevant supplier and transfer information. Optional providers should not be used for information your business is prohibited from transferring to them. Retention criteria Workspace records remain while the service is used and until an authorised deletion or return instruction is completed, subject to documented legal retention needs. Trial expiry and subscription cancellation pause or end access; they do not immediately erase records. For a verified deletion request we review subscriptions and statutory record requirements, explain any exception, and arrange erasure of live workspace data. We confirm completion separately from backup and external-provider handling. We do not promise immediate automatic erasure. Account, security, support and audit records are retained for as long as needed to provide access, investigate incidents, resolve complaints and establish or defend legal claims. Billing/accounting records are retained for the applicable statutory period. When responding to deletion requests we identify the records and legal basis for any continued retention rather than keeping all workspace data for accounting purposes. Local encrypted platform backups are made at startup and normally daily while the service runs. The implementation retains the seven most recent snapshots, not a guaranteed seven calendar days. Older snapshots are removed when subsequent successful backups replace them; if the service or backups stop, copies can persist longer and require operator removal. Restored data is subject to the same deletion instructions. Separately exported recovery kits require separate operator handling and are not included in that rotation. Pending registration codes expire after 48 hours. Expired reservation records are removed during later registration requests. Legal acceptance and relevant security audit records are retained separately under the criteria above. Provider-side data follows the providers' retention arrangements. Resend states that standard Free, Pro and Scale email/log retention is 30 days, with separate backups and account-termination handling. Deleting one workspace does not terminate the shared provider account. We handle requests affecting provider records with the provider rather than promising immediate automatic deletion. Google calendar entries and business-mailbox replies are controlled separately by the connected business account. Rights and choices You may request access, correction, erasure, restriction, objection and portability where applicable by emailing hello@field2office.co.uk. We verify identity and respond within the applicable statutory timeframe. Owners can export records and request deletion in the account page. Contact the trade business for rights relating to its customer/job data; we assist that business with valid requests. You may complain to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/. Protect your password and recovery codes, enable two-factor authentication and revoke lost devices. We use business separation, access checks, hashed passwords and encrypted integration credentials and recovery snapshots. No system is risk-free. Tell us promptly about suspected misuse. Cookies and changes The platform uses necessary session cookies for sign-in and local preference storage for country, language and currency. Marketing-site hosting may use necessary security cookies. This notice does not authorise advertising tracking; additional ad pixels or non-essential tracking require a separate review and appropriate consent controls. We publish material updates as a new legal version and request renewed acceptance where required. Provider reference information Hostinger: https://www.hostinger.com/legal/dpa OpenAI API: https://openai.com/policies/data-processing-addendum/ OpenAI Sites: https://openai.com/policies/chatgpt-sites-data-processing-addendum/ Resend: https://resend.com/legal/dpa and https://resend.com/legal/subprocessors Google: https://policies.google.com/privacy Stripe: https://stripe.com/privacy Managed email privacy — updated 12 October 2026 Field2Office uses Resend (Plus Five Five, Inc.) to deliver document emails through the managed sender. Resend receives sender and recipient addresses, the reply-to address, subject, message, attached documents and delivery metadata. Documents may include customer names, addresses, job details and financial information. Review the recipient and attachment before sending. Managed emails pass through the platform operator's Resend account. Authorised people with access to that account can access sending records and potentially message content and attachments. Separate business workspaces do not hide provider records from the platform operator. Provider access should be used only for necessary delivery support, security, abuse prevention or legal obligations. Emails are not end-to-end encrypted. Replies go to the business reply-to mailbox and are not automatically imported into Field2Office. Your mailbox provider handles those replies. A complete custom Resend configuration uses your own provider account instead of the managed sender; Field2Office still processes the message to deliver it. Resend states that customer data is stored in the United States. Selecting a European sending region does not change the storage location. Its published terms specify 30-day email and log retention on Free, Pro and Scale plans, flexible Enterprise retention, seven-day backups and deletion of remaining customer data within 90 days after termination of the Resend account. Deleting a Field2Office workspace does not terminate the shared Resend account or immediately erase provider records. Early removal requests require coordination with Resend. Businesses control their customer data and instruct Field2Office to process it to provide the service. Customer-data requests should normally go to the trade business first. Workspace owners can contact the platform operator through their existing support channel. Resend's Data Processing Addendum describes its processing and international-transfer safeguards, including the UK Addendum. This feature notice supplements the platform privacy notice and does not replace the full terms or Data Processing Addendum. Provider information: https://resend.com/security/gdpr Provider DPA: https://resend.com/legal/dpa Provider subprocessors: https://resend.com/legal/subprocessors Technician access records include invited staff names, email addresses, individual login credentials stored as password hashes, assigned visits, permissions and attributed work updates. The business owner determines which staff are authorised and what customer information they can access. Recurring service records include service addresses, instructions, visit dates and agreed charges. These records are processed to provide the business workspace.

Field2Office · privacy