Privacy Policy

Last updated: 22 October 2026

This Privacy Policy explains how Fieldwork AI Inc. ("Fieldwork", "we", "us"), a Delaware corporation operating in the United States and the United Kingdom, handles personal data. It covers our website at fieldwork.ai (the "Site") and our agentic AI platform (the "Service").

The most important thing to understand is that we act in two different roles:

• When we decide why and how personal data is used - for visitors to our Site, prospective customers, and the account, billing, and usage data of people who use the Service - we are the controller, and this policy describes that processing in full.
• When we process data inside a customer's organization on their behalf - the business records, communications, and content our customers connect or enter, which may include personal data about their staff, customers, and suppliers - our customer is the controller and we are the processor, acting under our contract and Data Processing Addendum with them. Sections 1–8 of this policy do not govern that processing; see Section 9. If your data reached us through a business that uses Fieldwork, please direct requests to that business - we will assist them in responding.

1. Personal data we collect as controller

You give us:

• Contact and inquiry data - name, work email, company, role, and message content when you contact us, request a demo, or sign up for updates.
• Account Data - when your organization uses the Service: your name, work email, role, authentication details, and your communications with us (including support requests).
• Billing data - business billing contacts and payment details for paying customers.
• Referral tax data - the reward recipient’s legal name, address, tax identification number, relevant citizenship and birth date, tax classification, service locations, signed certifications, signer identity and reward/withholding records. A workspace may belong to an individual. Bank details for cash rewards are collected by Stripe.

Generated when you use the Site or Service:

• Usage Data - technical and usage information: log data, device and browser information, IP address, pages and features used, agent and tool usage metadata, performance metrics, and provenance records (for example, which user approved a change). Usage Data does not include the content of customer organization data.
• Cookies and similar technologies - see Section 8.

From third parties: business contact information from your colleagues (for example, when they invite you to an organization) and from publicly available or licensed business sources used for sales outreach.

2. How we use it

We do not sell personal data, and we never train foundation models or large language models on customer organization data - identifiable or de-identified. Our own application-level systems (for example, forecasting and recommendations) learn only from de-identified data and Usage Data. Data obtained from Google APIs is subject to the further limits in Section 10 and is never used to train generalized or cross-customer models.

3. Sharing

We share personal data only with:

• Service providers processing on our behalf - cloud infrastructure and AI model providers, and providers of email delivery, support, billing, and analytics tooling. Our current sub-processors for the Service are listed at https://fieldwork.ai/subprocessors.
• Google, for website analytics and for measuring our own Google ads - we use Google Analytics on our marketing Site, and only where analytics cookies are allowed (where you have accepted them, or in the United States unless you have opted out). If you arrived from one of our Google ads with ads-measurement cookies allowed, we also tell Google Ads when that visit led to you creating an account or booking a call, sending only the ad click's identifier and the time, never your name, email address or anything from your organization. Neither is used inside the Service and Google receives no customer organization data, which is why it does not appear on the sub-processor page above.
• Our group companies - Fieldwork AI Ltd, our wholly-owned UK subsidiary, whose personnel provide engineering, operations, and support functions for us, under our security policies and intra-group data protection safeguards.
• Professional advisers (lawyers, accountants, insurers) under confidentiality.
• Corporate transactions - a buyer or successor in a merger, acquisition, or asset sale, under this policy.
• Legal requirements - where required by law or to protect rights, safety, or security; we will challenge overbroad requests where we reasonably can.

Any third party with whom we share personal data must provide the same or equivalent protection described in this Privacy Policy.

4. International transfers

We operate in the United States and the United Kingdom, and serve customers internationally. For purposes of the UK GDPR, Fieldwork AI Inc. is established in the United Kingdom. Data is stored in the United States (AWS us-east-2). AI inference requests are by default routed globally by our cloud and model providers and may be processed transiently in other regions worldwide, except that inference is not routed to any jurisdiction subject to comprehensive US, UK, or EU sanctions or export restrictions. Inference requests are configured for zero or minimal retention; a small number of models retain prompt data briefly for the model provider's trust-and-safety purposes (never for training), as described on our sub-processor page at https://fieldwork.ai/subprocessors, which also sets out available geography-pinning options. Where we transfer EEA, UK, or Swiss personal data to the United States, we rely on our certification under the Data Privacy Framework described below. Where that certification does not cover a transfer, or for transfers elsewhere, we rely on the EU Standard Contractual Clauses supplemented by the UK Addendum, and on our providers' equivalent onward-transfer safeguards (and note the UK–US Data Bridge as additional context). Analytics data from our marketing Site, where analytics cookies are allowed, is processed by Google in the United States on the same basis. Copies of relevant safeguards are available on request.

Data Privacy Framework

Fieldwork AI Inc. complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Fieldwork AI Inc. has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom (and Gibraltar) in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, and to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this Privacy Policy and the EU-U.S. DPF Principles or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

Data covered. Our commitment covers the personal data we receive as controller (visitors, prospects, and the account, billing, and usage data of people who use the Service, as described in sections 1 and 2) and the personal data we process as processor within our customers' organizations on their documented instructions (section 9), in each case for the purposes described in this Privacy Policy and our Data Processing Addendum.

Onward transfers. We transfer personal data to the sub-processors listed at https://fieldwork.ai/subprocessors, which process it on our behalf under written contracts requiring at least the same level of protection as the Principles. Fieldwork AI Inc. remains responsible under the Principles if a third party acting on our behalf processes personal data in a manner inconsistent with the Principles, unless we prove that we are not responsible for the event giving rise to the damage.

Your choices and access. You may access, correct, or delete the personal data we hold about you, and limit its use and disclosure, by contacting privacy@fieldwork.ai, as described in section 6. Where personal data is in a customer's organization, we will support the customer's response as processor.

Complaints and independent recourse. In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Fieldwork AI Inc. commits to resolve complaints about our collection or use of your personal data transferred to the United States in reliance on the framework. Individuals in the EU, the UK, and Switzerland with inquiries or complaints should first contact us at privacy@fieldwork.ai. We will respond within 45 days. Fieldwork AI Inc. has further committed to cooperate with the panel established by the EU data protection authorities (DPAs), the UK Information Commissioner's Office (ICO), and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension, and the Swiss-U.S. DPF. If you do not receive timely acknowledgment of your complaint from us, or if we have not addressed your complaint to your satisfaction, please contact the EU DPAs, the ICO, or the FDPIC as applicable; their services are provided at no cost to you.

Binding arbitration. Under certain conditions, more fully described in Annex I of the Data Privacy Framework Principles on the Data Privacy Framework website at https://www.dataprivacyframework.gov/, you may invoke binding arbitration for residual claims not resolved by other redress mechanisms.

Enforcement and lawful requests. Fieldwork AI Inc. is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC). We may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

Human resources data. Fieldwork AI Inc. does not currently rely on the Data Privacy Framework for human resources data of EU, UK, or Swiss employees; such data is transferred under the safeguards described above.

5. Retention

We keep personal data only as long as needed: Account Data for the life of the account plus a limited wind-down period; billing records as required by tax law; Usage Data in identifiable form for up to 12 months and thereafter only in de-identified form; marketing contact data until you opt out or it goes stale. Customer organization data is retained and deleted per the customer's contract (export window, then deletion within 30 days).

Signed referral tax forms and associated financial evidence are encrypted and access-restricted. Necessary tax records are retained separately from a deleted account or organization so that deletion does not erase reporting evidence. We do not process these forms with AI or use them to train models. Tax information may be disclosed to the relevant tax authorities and authorized tax-filing or accounting providers for these purposes.

6. Your rights

If you are in the UK or EEA you may ask us to: access, correct, or delete your personal data; restrict or object to processing (including any processing based on legitimate interests, and direct marketing at any time); receive a portable copy; and withdraw consent where processing is based on consent. Contact privacy@fieldwork.ai. We will respond within one month. You may complain to your supervisory authority - in the UK, the Information Commissioner's Office (ico.org.uk); in the EU/EEA, your local data protection authority.

If your personal data is in a customer's organization, the customer controls it - contact them, and we will support their response as processor.

Residents of US states with comprehensive privacy laws may have similar rights under those laws.

7. Security

We maintain a written information security program: encryption in transit (TLS 1.2+) and at rest (AES-256), least-privilege access with MFA on all systems, tenant isolation, endpoint protection, audit logging, and a documented incident response procedure with 72-hour breach notification to affected customers. No system is perfectly secure; we design so that a failure is contained and detected.

8. Cookies

Outside the United States, our marketing Site sets analytics, ads-measurement and referral cookies only if you accept them through our cookie banner. In the United States they are on unless you opt out, through Your privacy choices in the Site footer or a Global Privacy Control signal from your browser. Whenever they are not allowed, Google Analytics runs in a cookieless mode that stores and reads nothing on your device, and the Meta Pixel, LinkedIn Insight Tag, Google Ads conversion tracking and OpenAI Ads pixel we use to measure our own advertising do not load. The Service (app.fieldwork.ai) uses a strictly necessary first-party cookie to keep you signed in; because it is strictly necessary to provide the Service you have requested, we do not ask for consent to it. We use no advertising or cross-site tracking cookies inside the Service. Full details, including how to withdraw consent or opt out at any time, are in our Cookie Policy. You can also control cookies through your browser, though disabling the session cookie will prevent you from staying signed in.

9. The Service: processing on our customers' behalf

When a business connects third-party systems to Fieldwork or its staff enter content into their organization, that data - which may include personal data about the business's staff, end customers, and suppliers - is processed on the business's documented instructions under our Data Processing Addendum. In that processing: the business is the controller; we are the processor; our sub-processors are listed at https://fieldwork.ai/subprocessors; personal data is minimised or pseudonymised at ingestion where practicable; AI outputs are advisory and designed for human review; and data is deleted after the contract ends per Section 5. Where we de-identify organization data or use it to improve the Service, we do so as processor on the business's documented instructions under our contract with them; for data obtained from Google APIs, those uses are limited to what the Limited Use requirements described in Section 10 permit. We are an independent controller only of the Account Data, Usage Data, security data, and de-identified data described in Sections 1–2.

For AI chat, we send messages you enter, attachments you upload, relevant conversation history, profile and organization context, and information retrieved from connected systems to the AI providers listed on our sub-processors page, to answer your requests and perform the work you ask for. When you use dictation, microphone audio is sent to Microsoft Azure for transcription. The transcript may then be sent to AI providers for cleanup.

10. Google user data

When you or your organization connect a Google account to Fieldwork, our access is limited to the data covered by the OAuth scopes shown on the Google consent screen and approved by you - your basic Google account profile (name and email address) and, depending on what you approve, Gmail messages, labels, and mail settings, and files and content in Google Drive, Calendar, Docs, Sheets, Slides, Forms, Tasks, and Contacts. We use that data only to provide and improve user-facing features that are visible in the product and that you direct, including through automations you configure: reading, organizing, and triaging email (including applying labels), drafting and sending email you ask Fieldwork to send, and reading, creating, and editing files, events, tasks, and contacts as part of work you ask Fieldwork to do.

Fieldwork's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular:

• No advertising, no selling, no unrelated use. We use Google user data only for the features described above. We do not use it for advertising, do not sell it, and do not use it to determine credit-worthiness or for lending.
• AI models. Google user data is processed by the AI models that power the Service solely to provide features you request - for example, triaging your inbox or summarizing an email thread. We never use Google user data - identifiable, de-identified, aggregated, or derived - to create, train, or improve foundation models, large language models, or any other generalized AI or machine-learning model, whether ours or our model providers'. Where the Service learns from Google user data to personalize a feature - for example, adapting email triage to your corrections - that learning serves only the granting user's or organization's own use of that feature and never carries over to other customers, as permitted by the Limited Use requirements. Our model providers act as our processors and are configured for zero or minimal retention as described in Section 4. The application-level training described in Section 2 does not use Google user data.
• Human access. Our personnel do not read Google user data unless you explicitly agree (for example, when you grant access to a support engineer), it is necessary for security purposes such as investigating abuse, it is required by applicable law, or the data has been aggregated and anonymized for internal operations as permitted by the Limited Use requirements.
• Transfers. We transfer Google user data only to the sub-processors that host and operate the Service (listed at https://fieldwork.ai/subprocessors), where necessary for security purposes, where required to comply with applicable law, or as part of a merger, acquisition, or sale of assets after obtaining your explicit prior consent.
• Storage and security. Google user data is encrypted in transit and at rest as described in Section 7, and the OAuth tokens that grant access to your Google account are stored encrypted.
• Disconnection and deletion. You can disconnect Google from Fieldwork at any time in the product, or revoke Fieldwork's access from your Google Account at https://myaccount.google.com/permissions. On disconnection we revoke our authorization with Google - which invalidates the stored tokens - and stop accessing your Google data. Google user data already stored in the Service (for example, in conversation history) remains subject to the retention and deletion terms in Section 5 and your organization's contract, and you or your organization can ask us to delete it sooner at privacy@fieldwork.ai.

11. Slack user data

When you or your organization install the Fieldwork bot in Slack, its access is limited to the permissions shown on Slack's authorization screen and approved by you or your workspace administrator. The bot receives messages that mention it in channels where it has been invited and posts its answers in the related Slack thread.

An individual may separately connect their Slack account to Fieldwork's Slack MCP integration. That user-level authorization lets the Fieldwork-hosted MCP server expose Slack tools to the AI client or agent the individual chooses to use. Those tools can search, read, create, and update Slack content on the individual's behalf, but only within the conversations and resources that individual can already access in Slack and only within the scopes they approved. The MCP integration does not give an AI client unrestricted or administrator-level access to the workspace.

We process Slack data only to provide the Fieldwork features that you request. Slack message, file, canvas, reaction, conversation, workspace, channel, and user data may be sent to the AI model and infrastructure providers listed on our Sub-processors page when necessary to answer a question or perform an action. Those providers act as our processors, are configured for zero or minimal retention where available, and are prohibited from training their models on Customer Data. Fieldwork likewise never uses Slack data to train foundation models or large language models, for advertising, or for sale.

Fieldwork does not create a separate archive of your Slack workspace. Slack content included in a Fieldwork conversation or returned through an MCP tool call, together with the bot message that invoked Fieldwork and its answer where applicable, is Customer Data and follows the retention and deletion terms in Section 5 and your organization's contract. Bot and MCP OAuth tokens are encrypted at rest. You can disconnect the relevant Slack connection in Fieldwork settings or revoke the authorization from Slack at any time; doing so revokes or invalidates the applicable authorization and stops future access. You or your organization can request earlier deletion at privacy@fieldwork.ai.

12. Children

The Site and Service are for business users and not directed to anyone under 18. We do not knowingly collect children's data.

13. Changes

We will post changes here and update the date above; material changes will be notified to account holders by email or in-product notice.

14. Contact

Fieldwork AI Inc. - 169 Madison Ave, Ste 79708, New York, NY 10016, USA Email: privacy@fieldwork.ai

EU representative. Fieldwork AI Inc. is not established in the European Union. Our representative in the European Union under Article 27 of the GDPR is MAJA Conseil SRL, Belgium. If you are in the European Union you may contact our representative, in addition to or instead of us, on any matter relating to our processing of your personal data, at eu-representative@fieldwork.ai.