Who we are
Fieldlink (operated by Fieldlink Aotearoa Ltd, a New Zealand company) provides job management, timesheet, safety, and billing software for civil contractors and trades businesses operating in Aotearoa New Zealand. When you sign up your business for Fieldlink, you and your team become users of our service.
For the purposes of the NZ Privacy Act 2020, when you and your workers use Fieldlink:
- Your business is the agency that decides what to do with your workers' and customers' personal information (i.e. you are the data controller).
- Fieldlink hosts and processes that information on your behalf (i.e. we are the data processor).
What we collect
We only collect information that is needed to deliver the features you use. Specifically:
- Account data — name, email, password (hashed with bcrypt, never stored in plain text), role, organisation name.
- Operational data — timesheets, jobs, safety incidents, toolbox talks, fleet records, leave requests, pay runs, variations, quotes, invoices.
- Customer data you enter — names, addresses, emails of your customers and suppliers.
- Field-captured data — site photos, customer signatures on variations, GPS coordinates of jobsites (when you enter an address with Google Places).
- Billing details you enter — your business bank account number, GST number (printed on your customer invoices only — never seen by other Fieldlink customers).
- Device/usage data — IP address, browser type, session timestamps. Used for security (brute-force protection) and basic anonymised usage analytics.
We do not collect: government IDs, drivers' licence images, biometric data, social media profiles, or any data not directly entered into Fieldlink by you or your team.
How we use your data
We use your data only to:
- Run the features you use (e.g. process timesheets, render PDFs, send emails to customers you choose).
- Authenticate you, keep your account secure, prevent bot signups (we use Cloudflare Turnstile).
- Send you operational emails — welcome, password reset, billing receipts, push notifications you've opted in to.
- Diagnose and fix bugs you report (we may view your data with permission to support you).
We do not use your data to:
- Train AI models. Period.
- Sell to advertisers, recruiters, or data brokers.
- Share with other Fieldlink customers (see Multi-tenancy below).
- Profile you, target ads, or any other secondary commercial purpose.
Multi-tenancy — your data stays in your walled garden
Fieldlink is a multi-tenant SaaS — every business that signs up gets its own isolated workspace (we call it an "org"). Every database query in our backend is filtered by your org_id, every API endpoint enforces it, and every file we store is permission-checked. This is a hard architectural rule, not a setting that can be toggled off.
This means: no Fieldlink customer can ever see another Fieldlink customer's jobs, workers, timesheets, customers, quotes, invoices, photos, signatures, rates, or anything else. Not by accident, not by request, not even by us — we don't have a UI that lets us cross orgs.
Sub-processors we use
To run Fieldlink we use a small number of trusted third-party services. We share only the minimum data each one needs:
| Service | What for | What they see |
|---|---|---|
| MongoDB Atlas | Primary database | Encrypted at rest. Hosted in an AWS region serving NZ traffic. |
| Cloudflare | CDN, DDoS protection, Turnstile bot-check on signup | Network traffic metadata only. No application data. |
| Resend | Sending emails (welcome, invoices to your customers, etc.) | The recipient email and the contents of the email Fieldlink sends on your behalf. |
| Google Places API | Address autocomplete | The address text you type while editing a job. |
| Open-Meteo | Weather forecasts for jobsites | Latitude/longitude of jobsites only. No customer data. |
| Anthropic Claude / OpenAI | AI features (invoice scanning, SSSP drafting) — only when you use them | The specific content you submit to that feature. Both providers contractually do not train on API data. |
| PostHog | Anonymised usage analytics | Page views, clicks, browser type. No customer-entered data. |
If we ever add a new sub-processor we'll update this list and notify active customers by email.
Where your data lives
Fieldlink's primary database is hosted with MongoDB Atlas in an AWS region that serves New Zealand traffic. Some sub-processors (Resend, Cloudflare, Anthropic, OpenAI) operate globally and may temporarily process data outside Australasia. All of them are contractually committed to GDPR and NZ Privacy Act-equivalent safeguards.
How long we keep your data
We keep your data for as long as your Fieldlink subscription is active. If you cancel, we retain it for 90 days in case you change your mind, then permanently delete it. You can request immediate deletion at any time by emailing privacy@fieldlink.co.nz.
Some records (audit logs, login history) are retained for security purposes for up to 12 months even after account deletion. They are anonymised where possible.
Your rights
Under the NZ Privacy Act 2020 you have the right to:
- Access the personal information we hold about you.
- Correct anything that is wrong.
- Request deletion of your personal information.
- Export your data (CSV/JSON download — request via email).
- Complain to the Office of the NZ Privacy Commissioner at privacy.org.nz if you think we've mishandled your data.
To exercise any of these rights, email privacy@fieldlink.co.nz. We respond within 5 business days.
Security
Passwords are hashed with bcrypt. All traffic between your device and Fieldlink is encrypted with TLS 1.2+. Database connections are encrypted. Bank account numbers, signatures and other sensitive fields are stored encrypted-at-rest by our database provider. See our Security page for the technical detail.
Changes to this policy
If we make a material change to how we handle your data we'll email all active account owners at least 14 days before the change takes effect. Minor wording changes will be reflected in the "last updated" date at the top of this page.
Contact
Privacy questions, requests, or complaints:
privacy@fieldlink.co.nz
General support: support@fieldlink.co.nz