Privacy Policy

FieldHub is a Software-as-a-Service field-service management platform built for trade and service businesses. It provides dispatch, job scheduling, commission tracking, call handling, lead attribution, and integrations with third-party systems including ServiceM8, Telnyx, Google Ads, Google Analytics, and Gmail.

This policy applies to personal information we handle through the Service, including information about:

• users who log in to operate the Service on behalf of a business unit (e.g. dispatchers, technicians, administrators);
• customers of those business units whose information is entered into, or generated through, the Service;
• website visitors and callers whose interactions are captured by a business unit's tracking, attribution, and call-handling features.

We act as an “APP entity” in respect of users who hold FieldHub accounts. For data that our business-unit customers upload, generate, or capture through the Service about their own end customers, we generally act as a service provider processing that data on behalf of the business unit under our Terms of Service. Each business unit remains responsible for ensuring it has a lawful basis to provide that data to us.

2.1 Account and user data

When you create or use a FieldHub account, we collect identifying information such as your name, email address, phone number, job title, business unit, role, and authentication identifiers. We also collect operational data tied to your account, such as login timestamps, IP address at sign-in, in-app activity records, and preferences (e.g. theme, default business unit).

2.2 Customer data entered by business units

Business units that use FieldHub enter information about their own customers (such as customer names, addresses, phone numbers, email addresses, job details, quotes, invoices, and payment statuses), and information generated through the course of those jobs (such as schedules, dispatch decisions, technician assignments, and job notes). FieldHub processes that data on behalf of the business unit so the business unit can operate its own service.

2.3 Website visitor and call-tracking data

When a business unit uses FieldHub's tracking and attribution features on its own website, we collect information about visitors to that website so we can attribute leads to their marketing sources. This may include:

• Google click identifiers (GCLID, GBRAID, WBRAID);
• UTM campaign parameters (source, medium, campaign, term, content);
• Google Analytics client identifier (where the business unit has GA4 installed);
• referrer URL, landing page URL, and basic page navigation context;
• IP address and user-agent string;
• a non-identifying browser fingerprint hash used solely to recognise the same browser within a short session window.

We use this data to attribute inbound calls and form submissions to the marketing source that produced them, and to provide attribution reporting to the business unit.

2.4 Communications data

FieldHub sends and receives communications on behalf of business units. We collect records of these communications, including:

• inbound and outbound phone-call metadata (caller and called numbers, timestamps, duration, outcome);
• call recordings, voicemails, and AI-generated transcripts or summaries where the business unit has enabled those features;
• email messages sent or received through any Gmail integration the business unit authorises (see § 4);
• platform-generated emails sent to staff or customers (such as invitations, voicemail notifications, and onboarding documents).

2.5 Payment and billing data

We collect billing information necessary to administer your subscription, including business name, billing address, billing contact, plan, and invoice history. Card payment processing is handled by a third-party payment processor (currently Stripe). FieldHub does not store full payment card numbers. We may receive limited metadata about your payment method (such as the last four digits and brand) from the processor to display in the billing interface.

2.6 Technical and device data

We collect standard server and application logs, including IP addresses, browser type, device type, timestamps, request paths, error reports, and similar diagnostic information needed to operate, secure, and improve the Service.

We use personal information to:

• provide, operate, and maintain the Service and its features;
• authenticate users, enforce access controls, and protect against fraud and abuse;
• route inbound calls, attribute leads to their originating sources, and produce attribution reporting;
• send communications on behalf of business units (including emails, SMS, and recorded phone interactions);
• provide customer support, troubleshoot issues, and respond to your requests;
• process payments, administer subscriptions, and manage billing;
• monitor performance, diagnose errors, and improve the Service;
• comply with our legal obligations and enforce our Terms of Service.

FieldHub integrates with several Google APIs at the option of each business unit. Where a business unit chooses to enable one of these integrations and authorises FieldHub via Google OAuth or another Google-approved authentication mechanism, we receive and process the following categories of Google user data.

4.1 Gmail

Where authorised by a business-unit user, FieldHub uses the Gmail API to send emails on the user's behalf and to read emails associated with their FieldHub-managed jobs so that customer correspondence can be tracked against the relevant job record. Access to Gmail is limited to what is necessary to provide the email-tracking and reply features the user has enabled.

4.2 Google Ads (Data Manager API)

Where authorised by a business unit, FieldHub uses the Google Ads Data Manager API to upload offline conversion events (such as a booked job that originated from a tracked ad click, identified by a GCLID, GBRAID, or WBRAID) back to that business unit's Google Ads account, so the business unit can measure and optimise its advertising. FieldHub does not read campaign data, budgets, or other account information for any purpose other than performing this writeback on the business unit's behalf.

4.3 Google Analytics (Measurement Protocol)

Where configured by a business unit, FieldHub uses the Google Analytics Measurement Protocol to send marketing-event data (such as a captured lead) to that business unit's Google Analytics property. This is a server-to-server write only; no Analytics report data is read by FieldHub.

4.4 Limited Use of Google user data

FieldHub's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, we confirm that information we receive from Google APIs is used only to provide and improve the features described above, and:

• is not sold;
• is not used or transferred for serving advertisements, including retargeting, personalised, or interest-based advertising;
• is not used to train, develop, or improve any generalised or general-purpose AI or machine-learning model;
• is not transferred to other parties except as necessary to provide or improve the user-facing features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to users;
• is not read by humans, other than (a) with the affected user's explicit consent for specific messages; (b) where necessary for security purposes such as investigating abuse; (c) to comply with applicable law; or (d) for FieldHub's internal operations where the data has been aggregated and anonymised.

A business unit may at any time revoke FieldHub's access to its Google account via the Google account security settings or by disconnecting the integration from within FieldHub.

We share personal information only as necessary to provide the Service, with carefully selected sub-processors and service providers. Each provider is engaged under contractual terms requiring them to protect the data and use it only for the purposes of providing their service to us. Current sub-processors and service providers include:

• ServiceM8 — field-service job management system that business units integrate with FieldHub.
• Telnyx — telephony, SIP voice, SMS, and call-recording infrastructure.
• Google — where a business unit has authorised Gmail, Google Ads, or Google Analytics integrations (see § 4).
• Anthropic — AI provider used to power features such as call summarisation and assistant features. Customer data is sent to Anthropic only as needed to produce the requested output, subject to Anthropic's enterprise data-handling commitments.
• Stripe — payment processor for subscription billing.
• Resend — outbound transactional email delivery on behalf of FieldHub and its business units.
• Clerk — user authentication, session management, and account verification.
• Vercel — application hosting and serverless compute.
• Neon — managed PostgreSQL database service.
• Cloudflare R2 — object storage for call recordings and job-related files.

We may also disclose personal information:

• where required or authorised by law, including in response to a valid subpoena, court order, or regulatory request;
• to enforce our Terms of Service or protect our rights, property, or safety, or those of our users or the public;
• in connection with a merger, acquisition, restructuring, or sale of assets, in which case affected users will be notified in advance.

We do not sell personal information.

Personal information processed by FieldHub is stored in Australia. Our application is hosted on Vercel, our primary database runs on Neon's Sydney region (ap-southeast-2), and call recordings and uploaded files are stored on Cloudflare R2 in the Asia-Pacific region.

We apply administrative, technical, and physical safeguards designed to protect personal information against loss, misuse, unauthorised access, alteration, and disclosure. These include:

• encryption of data in transit using TLS;
• encryption at rest for database storage and object storage;
• encryption of sensitive third-party credentials (such as OAuth refresh tokens) using authenticated AES-256-GCM encryption inside our database;
• role-based access controls and per-business-unit data scoping;
• audit logging of sensitive administrative actions;
• routine review of access privileges and security configurations.

No security control is perfect. While we work hard to protect personal information, we cannot guarantee that unauthorised access will never occur, and you provide information at your own risk.

We retain personal information for as long as it is needed to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. Retention periods vary by data type:

• Account data is retained for the life of the account and a reasonable period after closure to allow recovery and to meet record-keeping obligations.
• Customer data entered by business units is retained while the business unit's subscription is active. On termination, data is deleted in accordance with the relevant Terms of Service.
• Visitor and call-tracking data (visitor sessions, tracking-number assignments, raw analytics event payloads) is retained for approximately 60 days from creation, then deleted by an automated retention process. Conversion records sent to Google Ads are kept for longer as an audit trail of writebacks performed.
• Communication records (call metadata, recordings, voicemails, email tracking records) are retained for the period configured by the business unit, subject to any minimum legal retention period.
• Logs and security records are retained for a period proportionate to their security and operational purpose.

Where personal information is no longer needed for any permitted purpose, we will take reasonable steps to delete or de-identify it.

Under the Privacy Act and the Australian Privacy Principles, you may:

• request access to the personal information we hold about you;
• request correction of personal information that is inaccurate, out of date, incomplete, or misleading;
• request deletion of personal information, subject to our legal and operational obligations to retain it;
• withdraw consent for an integration or specific processing where consent is the basis for it;
• make a complaint about how we have handled your personal information.

To exercise any of these rights, contact us at privacy@fieldhub.com.au. We will respond within a reasonable timeframe consistent with the Privacy Act.

Where the personal information was provided to us by a business unit (for example, as a customer of a FieldHub-using business), we will generally direct your request to that business unit so it can respond as the entity that holds the relationship with you. We will assist the business unit as required.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

FieldHub is a business-to-business service and is not directed at children. We do not knowingly collect personal information from children. If you believe we hold personal information about a child, please contact us and we will take appropriate steps to remove it.

FieldHub is operated from Australia and primarily serves Australian trade and service businesses. Personal information we hold is stored in Australia (see § 6). If you access the Service from outside Australia, you understand that the information you provide will be transferred to and processed in Australia and that Australian privacy laws will apply.

Some of our sub-processors (such as Google) may transfer or replicate data to facilities outside Australia in the course of providing their service. We engage those sub-processors only under terms that require them to protect your information to a standard consistent with the APPs.

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. If we make material changes, we will notify you by reasonable means (such as by email to your registered account address, or by an in-product notice) before they take effect. The “Effective date” at the top of this policy will be updated whenever it changes.

Continued use of the Service after a change takes effect constitutes acknowledgement of the updated policy.

If you have questions about this policy or how we handle personal information, contact:

Field Hub Pty Ltd
ACN 696 915 803
Email: privacy@fieldhub.com.au