FieldFlow Privacy Policy
DRAFT — pending review. This document is a working draft published so that it has a stable address. It will be reviewed before FieldFlow is listed on Google Play and may change.
This policy covers the FieldFlow mobile app, its sync and licence server at fieldflow.fixflex.co.uk, and this website. FieldFlow is built so that we cannot read your business data: it lives on your company's phones and is synced between them end-to-end encrypted.
1. Who is responsible for what
| Data | Who decides how it's used |
|---|---|
| Everything your company records in the app — employees, attendance, GPS points, photos, pay, invoices, clients, messages, leave | Your company is the controller. FIXFLEX LTD only relays it in encrypted form as your processor (see the Data Processing Agreement). If you are an employee, your employer's privacy notice explains how it uses your data — we provide a template. |
| Licence and device records, support emails, website visits | FIXFLEX LTD is the controller (this policy). |
FIXFLEX LTD, registered in England and Wales, company no. 08944523, registered office 170 Connell Crescent, London, W5 3BP, United Kingdom. Contact: [email protected].
2. What the app does on your phone
- Storage: all business data is stored in an encrypted database on the device. The key is kept in the phone's secure storage (Android Keystore).
- Location: when a worker clocks in or out, the app reads the phone's GPS position once and records it with the attendance entry. It flags entries made far from the site. The app does not track location in the background or between clock-in and clock-out. Admins can also save a site's location when setting up a project.
- Camera: used only when you choose to — scanning QR codes (clock-in, device invites), taking attendance, receipt and project photos, and scanning documents. Document scanning uses Google's on-device ML Kit via Google Play services.
- Biometrics: fingerprint or face unlock is handled entirely by the phone's operating system. The app only receives "unlocked" or "not unlocked" — no biometric data ever reaches the app, your company or us.
- No tracking: the app contains no advertising, analytics or crash-reporting SDKs.
3. What reaches our server
| What | Can we read it? | How long we keep it |
|---|---|---|
| Sync packets — your business data, encrypted on the phone with AES-256-GCM using a key only your company holds (it is passed between phones by QR code, never through our server) | No. We see only which company and device sent a packet, the table name, the time and who it's addressed to. | Until your company admin purges them from the app, or until we delete them after your licence ends (section 6). |
| Licence record — a hash of your licence key, a random company code, plan, seats, expiry date and our internal notes | Yes | For the life of the licence plus 6 years (accounting). |
| Purchase record — if you buy online: the buyer's name, e-mail, company name, billing address and VAT number (collected by Stripe on its payment page), the plan bought and the licence it created. Card details go only to Stripe; we never see them. | Yes | 6 years after the purchase (accounting). The licence key itself is kept readable for at most 48 hours so the confirmation page can show it, then only its hash remains. |
| Device registry — a random device token, role (admin / manager / worker / viewer), the internal employee or client number the device is linked to, an optional label (e.g. phone model), when it was added, last seen and revoked | Yes (no names) | Until the device is revoked and the licence ends. |
| Invite tokens for adding a phone by QR | Yes | Expire after 15 minutes. |
| Access logs — time, request path, status and user agent | Yes. Because our server sits behind Cloudflare, the IP recorded is Cloudflare's, not yours. | About 4 weeks (rotated weekly). |
4. Who else is involved
- OVHcloud — hosts our server in the United Kingdom.
- Cloudflare — sits in front of our server for security and delivery; it sees your IP address and the encrypted traffic.
- Stripe — takes online payments for licences and issues the receipt/invoice. It processes the buyer's payment and billing details under its own privacy policy.
- Google — distributes the app (Google Play) and provides on-device document scanning (ML Kit). Google's own terms apply to your Google account and Play services.
Cloudflare, Stripe and Google are US companies or groups; transfers rely on the UK–US Data Bridge or the UK International Data Transfer Agreement / UK Addendum in their terms.
5. This website
This website sets no cookies and uses no analytics. Your browser loads fonts and icons from Google Fonts, jsDelivr and cdnjs, which receive your IP address.
6. Your rights and deleting data
- Employees and clients of a FieldFlow customer: ask your employer (the company using FieldFlow). We cannot read the encrypted data, so we can't search or change it; your employer can, in the app.
- Customers: your admin can purge synced packets from the app at any time. When your licence ends, email [email protected] and we will delete your company's sync packets and device records within 30 days.
- For anything else, email [email protected]. You have the right to access, correct, delete, restrict or object to our use of your data, and to data portability.
- You can complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.
7. Children
FieldFlow is a business tool for adults and is not intended for children.
8. Changes
We will post changes here and update the date above; significant changes will also be notified in the app or by email to licence holders.