Privacy Policy

1. Introduction

Hamilton Digital Solutions, doing business as Field Ops Management ("we," "us," or "our"), operates the Field Ops Management platform, including fieldopsmanagement.com, the Field Ops web dashboard, and the Field Ops mobile application for iOS and Android (collectively, the "Service").

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

This policy applies to all users of the Service, including company administrators who create accounts ("Account Holders"), employees and team members added by Account Holders ("End Users"), and clients who access the client portal ("Portal Users").

2. Information We Collect

2.1 Information You Provide Directly

• Account & Registration Information: Name, email address, phone number, company name, industry type, and password when you register for an account.
• Employee Information: Names, roles, pay rates, contact details, and employment information for employees added to the platform by Account Holders.
• Client & Service Location Information: Client names, addresses, service locations, and contact details entered by Account Holders.
• Payment & Billing Information: Billing details processed through Stripe, our third-party payment processor. We do not store full credit card numbers, bank account numbers, or other sensitive financial data on our servers.
• Communications: Messages sent through the in-app messaging feature between team members within an organization.
• Job Site Photos & Notes: Photos, notes, and checklists uploaded through the mobile application for job documentation purposes.
• Invoicing Data: Invoice details, line items, and payment records created within the Service.
• Cancellation Feedback: If you cancel a subscription, we ask why you are leaving and provide an optional comment box. Answering is voluntary — your cancellation is processed whether or not you respond. We retain your answer, any comment you write, and your company and plan details so we can improve the Service.

2.2 Information Collected Automatically

• Location Data: GPS coordinates collected during clock-in/clock-out events, route tracking, and geofence verification when the mobile app is in use. Location data is only collected when End Users are actively clocked in or using route navigation features. We do not track location when the app is closed or the user is clocked out.
• Device Information: Device type, model, operating system version, browser type, screen resolution, and unique device identifiers.
• Usage Data: Pages visited, features used, timestamps, click patterns, and interaction data within the Service.
• Log Data: IP addresses, access times, referring URLs, and error logs.
• Cookies & Local Storage: Session tokens, authentication state, and user preferences stored in cookies and browser local storage.
• Advertising & Analytics Data: On our public marketing website we use the Meta (Facebook) Pixel, Google Analytics 4, and Microsoft Clarity. These tools collect your IP address, browser and device type, pages viewed, referring URLs, actions such as starting or completing a sign-up, and — in the case of Microsoft Clarity — recordings of mouse movement, scrolling, and clicks on our marketing pages. See Section 11 for details and how to opt out. These tools are not used inside the logged-in dashboard or the mobile app.

2.3 Information from Third Parties

• Payment Processors: Stripe may provide us with limited transaction information (such as payment status and subscription state) to manage your account.
• Accounting Integrations: If you connect QuickBooks Online, we receive customer and invoice data that you authorize during the OAuth connection process.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Provide, operate, and maintain the Service and its features
• Process employee time tracking, GPS verification, route management, and job documentation
• Generate timecards, payroll reports, exception alerts, and operational analytics
• Create and send invoices and process payments on behalf of Account Holders
• Facilitate crew communication through in-app messaging
• Process billing, manage subscriptions, and handle payment disputes
• Send transactional emails (password resets, account notifications, billing receipts)
• Respond to customer support requests and troubleshoot issues
• Improve, optimize, and develop new features for the Service
• Detect, prevent, and respond to fraud, unauthorized access, or other security incidents
• Comply with legal obligations and enforce our Terms of Service

We do not use your information for third-party advertising, behavioral profiling, or sale to data brokers.

4. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information to third parties. We may share information only in the following limited circumstances:

• Advertising & Analytics Partners (marketing website only): Meta, Google, and Microsoft receive marketing-website activity through the Meta Pixel, Google Analytics 4, and Microsoft Clarity, as described in Sections 9.3 and 11. This never includes employee, timecard, location, photo, client, or invoice data.
• Within Your Organization: Account Holders, administrators, and managers can view employee data, timecards, location data, job site photos, and messages as part of normal platform operations. End Users can view information relevant to their role (their route, their hours, etc.).
• Service Providers: We use third-party services strictly to operate the Service, including:
  • Railway (hosting & database)
  • Vercel (web hosting)
  • Stripe (payment processing)
  • Resend (transactional email)
  • Cloudflare (file storage & CDN)
  • Expo / EAS (mobile app distribution & OTA updates)
  These providers process data on our behalf and are contractually obligated to protect your data and use it only for the purposes we specify.
• Accounting Integrations: If you connect QuickBooks Online, data you authorize (customers, invoices, time activities) is synced to your QuickBooks account.
• Client Portal: When Account Holders share invoice or service history with their clients via the client portal, those clients can view the specific data shared.
• Legal Requirements: We may disclose information if required by law, subpoena, court order, governmental authority, or to protect the rights, property, or safety of Field Ops Management, our users, or the public.
• Business Transfers: In the event of a merger, acquisition, bankruptcy, or sale of assets, user data may be transferred to the acquiring entity. We will provide notice before your data is transferred and becomes subject to a different privacy policy.

5. Employer Responsibility

Account Holders who add employees (End Users) to the platform are responsible for:

• Informing their employees that the Service collects GPS location data, time tracking data, and job site photos during work hours
• Obtaining any required consent from employees under applicable state, local, or federal laws before enabling GPS tracking features
• Ensuring their use of the Service complies with all applicable employment, labor, and privacy laws in their jurisdiction
• Providing employees with access to this Privacy Policy

Field Ops Management provides the technology platform. The Account Holder, as the employer, is the data controller for employee data and is responsible for the lawful basis of collection in their jurisdiction.

6. Data Retention

• Active Accounts: We retain your data for as long as your account is active and as needed to provide the Service.
• Account Deletion: Upon account deletion by an Account Holder, we will delete or anonymize all associated company data within 90 days, except as noted below.
• Post-Deletion Export: Account Holders have 30 days after initiating deletion to export their data through the Service's export features.
• Legal Retention: Timecard records and payroll data may be retained for up to 7 years to comply with federal and state labor and tax regulations. Audit logs may be retained for up to 1 year for security purposes.
• Backups: Data may persist in encrypted backups for up to 30 days after deletion.

7. Data Security

We implement industry-standard security measures to protect your information, including:

• Encryption of all data in transit using TLS 1.2 or higher
• Encryption of data at rest in our database and file storage
• Secure password hashing using bcrypt with appropriate cost factors
• JWT-based authentication with short-lived access tokens and refresh token rotation
• Role-based access controls enforced at the API level
• Input validation and sanitization to prevent injection attacks
• Automated encrypted database backups
• Infrastructure hosted on SOC 2 compliant providers (Railway, Vercel, Cloudflare)

While we strive to protect your data, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security. If we become aware of a security breach that affects your personal information, we will notify affected users and relevant authorities as required by applicable law.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data (subject to legal retention requirements)
• Restriction: Object to or restrict certain processing of your data
• Portability: Request your data in a structured, commonly used, machine-readable format
• Withdraw Consent: Withdraw consent where processing is based on consent
• Non-Discrimination: Exercise your privacy rights without receiving discriminatory treatment

To exercise any of these rights, contact us at support@fieldopsmanagement.com or visit our Account Deletion page. We will respond within 30 days (or 45 days for complex requests, with notice).

End Users (employees): If you are an employee whose employer uses Field Ops Management, please contact your employer first regarding data access, correction, or deletion requests. Your employer is the data controller for your employment data. If your employer is unable to assist, contact us directly.

9. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

9.1 Right to Know

You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purpose for collecting it, and the categories of third parties with whom we share it.

9.2 Right to Delete

You have the right to request deletion of your personal information, subject to certain exceptions (such as legal retention requirements for payroll records).

9.3 Right to Opt-Out of Sale or Sharing

We do not sell your personal information for money. However, our public marketing website uses the Meta (Facebook) Pixel and Google Analytics 4 to measure and improve our advertising. Under the CCPA/CPRA, disclosing information to these advertising partners may be considered "sharing" for cross-context behavioral advertising, and we treat it as such so that you can exercise your rights.

This applies only to visitors of our public marketing pages. We do not run advertising or analytics trackers inside the logged-in dashboard or the mobile app, and we never share your employee, timecard, location, photo, client, or invoice data with advertisers.

You may opt out at any time by visiting our Do Not Sell or Share My Personal Information page, by enabling a Global Privacy Control (GPC) signal in your browser (which we honor automatically), or by emailing support@fieldopsmanagement.com with the subject line "Do Not Sell or Share My Personal Information." Opting out will not affect your ability to use the Service.

9.4 Right to Correct

You have the right to request correction of inaccurate personal information that we maintain about you.

9.5 Right to Limit Use of Sensitive Personal Information

We collect precise geolocation data (a category of sensitive personal information under the CPRA) solely to provide the GPS tracking and route verification features of the Service. We do not use this data for purposes other than providing the Service. You may limit geolocation collection by revoking location permissions on your device, though this may affect the functionality of the Service.

9.6 Categories of Information Collected

In the preceding 12 months, we have collected the following categories of personal information:

• Identifiers: Name, email address, phone number, IP address, device identifiers
• Account Information: Username, password (hashed), company name, role
• Employment Information: Job title/role, pay rate, crew assignments (provided by employer)
• Geolocation Data: Precise GPS coordinates during active work tracking
• Photos: Job site photos uploaded by users
• Communications: In-app messages between team members
• Internet/Network Activity: Browser type, pages visited, usage data, log data
• Commercial Information: Subscription plan, billing history, invoices
• Inferences & Advertising Data: Marketing-website activity collected through the Meta Pixel and Google Analytics 4, used to measure and optimize our advertising

9.7 How to Submit a Request

California residents may submit a verifiable consumer request by emailing support@fieldopsmanagement.com with the subject line "CCPA Request" or by visiting our Account Deletion page. We will verify your identity before processing the request. You may also designate an authorized agent to make a request on your behalf.

9.8 Shine the Light

Under California Civil Code Section 1798.83, California residents may request information about our disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.

10. Location Data

Our mobile application collects GPS location data to enable core features. This section provides detailed information about our location data practices:

• When collected: Location is collected only when End Users are actively clocked in or using route navigation. We do not track location when the app is in the background, closed, or the user is clocked out.
• What is collected: Latitude, longitude, and timestamp at periodic intervals (approximately every 30 seconds during active tracking, every 5 minutes for background pings while clocked in).
• Who can see it: Account administrators and dispatchers can view employee location data through the GPS tracking dashboard. End Users can view their own location trail.
• How long it's kept: Location data is retained as part of timecard records for up to 90 days in the tracking system, and as part of timecard audit records for up to 7 years.
• How to stop it: End Users can revoke location permissions in their device settings at any time. Account Holders can disable GPS tracking features in their company settings.

11. Cookies and Local Storage

We use cookies and browser local storage to operate the Service:

• Authentication Cookies: Session tokens to keep you logged in
• Preference Storage: Theme (light/dark mode), language preference, and dashboard settings stored in local storage
• Security: CSRF protection tokens

On our public marketing website only, we also use the following third-party advertising and analytics technologies:

• Meta (Facebook) Pixel: Measures the performance of our Facebook and Instagram advertising. It records page views and sign-up milestones and sends them to Meta, which may use this information for ad measurement and targeting. See the Meta Privacy Policy and your Meta ad preferences.
• Google Analytics 4: Measures website traffic and how visitors navigate our marketing pages. See the Google Privacy Policy and the Google Analytics Opt-Out Browser Add-on.
• First-Party Visit Analytics: We record page paths, device type, and browser type on our own servers to understand where visitors drop off during sign-up. This data stays with us and is not sold or shared.
• Microsoft Clarity: Produces heat maps and session recordings of how visitors interact with our marketing pages (mouse movement, scrolling, and clicks). Clarity masks text input by default, and we do not use it on the logged-in dashboard. See the Microsoft Privacy Statement.

These advertising and analytics tools do not run inside the logged-in dashboard or the mobile app. They never receive your employee, timecard, GPS location, job photo, client, or invoice data.

You can block these trackers using your browser's privacy settings, an ad blocker, or a Global Privacy Control (GPC) signal, or turn them off for this browser on our Do Not Sell or Share My Personal Information page. Blocking them will not affect your ability to use the Service.

12. Children's Privacy

The Service is designed for business use and is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected data from a child under 16, we will delete it promptly. If you believe a child has provided us with personal information, please contact us immediately.

13. International Data

The Service is operated from the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States. By using the Service, you consent to this transfer. We do not currently offer data residency in other regions.

14. Third-Party Links

The Service may contain links to third-party websites or services (such as Stripe's payment portal or QuickBooks Online). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on this page with a new "Last updated" date
• Sending an email notification to Account Holders for significant changes
• Displaying a notice within the Service dashboard

Your continued use of the Service after changes are posted constitutes your acceptance of the revised policy. If you do not agree with a change, you may delete your account.

16. Contact Us

If you have questions about this Privacy Policy, our data practices, or wish to exercise your privacy rights, please contact us:

• Email: support@fieldopsmanagement.com
• Subject Line: Use "Privacy Inquiry" or "CCPA Request" as appropriate
• Website: Account Deletion & Data Requests

We will acknowledge your request within 5 business days and provide a substantive response within 30 days.