Privacy Policy

Effective: May 4, 2026 · Last updated: May 4, 2026

FieldStaff Workforce ("FieldStaff Workforce", "we", "us", or "our") provides a software-as-a-service workforce management platform that helps service businesses schedule, dispatch, track, and pay their mobile workers. This Privacy Policy explains what information we collect, why we collect it, how we use and share it, how long we keep it, and your rights with respect to your information.

We're a Canadian company. This Policy is governed by the laws of the Province of Ontario, Canada, and applies worldwide to anyone who uses our website, our customer admin web app, or our worker mobile/web app.

1. Who is FieldStaff Workforce

FieldStaff Workforce is a Canadian software company offering a multi-tenant cloud platform for service businesses (HVAC, plumbing, home care, delivery, security, cleaning, electrical, and other field-service industries) to schedule and manage their workforce. Customers ("Companies") subscribe to our service and onboard their own workers ("Workers") into their tenant.

Our principal place of business is Mount Hope, Ontario, Canada. Our applications run on Google's North American cloud infrastructure (Firebase Hosting, Firestore, Cloud Functions, Cloud Run).

2. Information we collect

We collect different categories of information depending on whether you're a Company administrator, a Worker invited by a Company, or a visitor to our marketing website.

Account & profile information

• Name, email address, phone number
• Company name, role/position, employee/contractor status
• Encrypted password hash (we never store cleartext passwords; password authentication is handled by Firebase Auth)
• Company-issued employee ID and licensing/certification numbers (for trades) where the Company chooses to capture them

Operational information you generate using the platform

• Shifts, schedules, and assignments created by Company administrators
• Clock-in / clock-out events including timestamp and (with permission) GPS coordinates
• Daily-log entries: services performed, hours, notes, signatures
• Photos uploaded to incident reports, expense reports, or daily logs
• Messages sent through the in-app messenger
• Job dispatches and acceptance confirmations

Device and usage information

• Device type (phone model, OS version), browser type, IP address
• App-installation identifiers and push-notification tokens for the mobile app
• Pages visited, features used, error logs (used to diagnose problems and improve the product)
• Service-worker / cache state for offline support

Marketing-website information

Our public marketing site at fieldstaffworkforce.com uses Google Analytics 4 to count visits. If you fill in a contact or demo-request form, we collect your name, email, phone, and message, and store the submission so our sales team can follow up.

3. Location (GPS) data — specifically

Our app uses your device's GPS for a narrow, work-related purpose. Apple App Store policy requires us to be specific about this, so:

Each Company that subscribes to FieldStaff Workforce chooses one of two location-tracking modes for its workers, based on their industry. Your Company tells you which mode applies before you onboard.

Mode A — Clock-events-only (default)

Used by: HVAC, plumbing, home care, cleaning, security, electrical, and most general field-service businesses.

• What we collect: Latitude, longitude, and accuracy radius at two specific moments — when you tap Clock In at the start of a shift, and when you tap Clock Out at the end. We may also briefly capture GPS when you submit a daily-log report so the report is timestamped.
• What we do NOT do: we do not track your location continuously while the app is open, in the background, or while you are clocked out.
• Permission: "While Using the App" location permission is sufficient.

Mode B — Continuous-during-shift (delivery / route work)

Used only by Companies whose workers do delivery, courier, mobile sales, or similar route-based work where the route itself is part of the job record.

• What we collect: Latitude, longitude, and accuracy radius at intervals of approximately one to two minutes only while you are clocked in. The app captures these in the foreground while running and (where the Company has configured it) in the background.
• What we do NOT do: we do not track your location at any time when you are clocked out. Tracking always starts at clock-in and ends at clock-out — there is no other window in which the app records your location.
• Permission: Mode B requires "Always Allow" location permission so route data can be captured even when you put the phone in your pocket. Your phone's operating system clearly indicates background-location use with a status icon.
• You can decline at the operating-system level. Your phone always lets you change permission in Settings → Privacy → Location Services, and FieldStaff Workforce honours that decision in real time. Note, however, that route tracking may be a condition of employment set by your Company (much like wearing a uniform, holding a valid driver's licence, or completing a drug test). If you decline at the OS level, the app will fall back to Mode A (clock-events-only), your Company will be notified that route tracking is disabled for your account, and your Company's policies will determine the consequences for your role. FieldStaff Workforce does not impose those consequences — they are between you and your employer, just as with any other employer-set work requirement.

Common to both modes

• Why we collect it: So the Company you work for has a verified record of where and when you started and ended your shift (Mode A), or of your route during the shift (Mode B). This is the same purpose as a paper time-card or paper route sheet — just digital, accurate, and tamper-resistant.
• Withdrawing permission: You can revoke location access at any time in your phone's Settings → Privacy → Location Services. We will stop receiving GPS the moment you change the setting.
• Storage: GPS coordinates are stored alongside the corresponding clock event (Mode A) or in a per-shift route record (Mode B) in our Firestore database, encrypted at rest.
• Use: location data is used solely to provide the workforce-management service to your Company. We do not sell, share, or use location data for advertising, profiling, or any purpose unrelated to your work.
• Retention: aligned with your Company's retention policy (typically 7 years for tax / payroll records; longer for regulated industries).

4. Camera and photo data

Workers may use the camera (or upload existing photos) to attach images to incident reports, expense reports (e.g. receipts), and where applicable, daily logs (before/after photos for installations).

• Photos are uploaded directly to Firebase Storage (Google Cloud) or to the Company's Dropbox folder via our secure upload Cloud Function.
• Photos are visible only to your Company's administrators and to you. We do not display them publicly, share them with third parties, or use them for anything beyond the Company's recordkeeping.
• You may decline camera/photo permission. The features that depend on it will then be unavailable until you grant it.

5. How we use information

We use the information described above for the following purposes:

• To provide the workforce management service to your Company (scheduling, dispatching, time tracking, reporting, payroll handoff)
• To authenticate you when you sign in
• To send you push notifications and SMS about your assigned shifts, dispatched jobs, and messages
• To generate end-of-period payroll reports for the Company
• To respond to support requests
• To investigate suspected fraud, abuse, or security incidents
• To comply with our legal obligations (tax, employment standards, IPC requests, court orders)
• To improve the product through aggregated usage analytics — never tied to a specific individual

We will not use your information for marketing, advertising, profiling, or sale to third parties without your express consent.

6. Who we share information with (subprocessors)

We use a small number of trusted service providers ("subprocessors") to run our platform. Each is bound by a written contract requiring confidentiality, security, and lawful processing.

We may also disclose information when required by law, when responding to lawful requests from public authorities (subpoena, search warrant, court order), to protect the rights, property, or safety of FieldStaff Workforce, our customers, or the public, or in connection with a corporate transaction (merger, acquisition, sale of assets) — in which case we will notify affected users in advance.

7. How long we keep information

Retention periods depend on the type of information:

• Active account data: retained while your account is active and your Company subscribes to our service.
• After account closure: personal information is retained for a reasonable period (typically 30 to 90 days) to allow recovery from accidental deletion, then permanently removed except for what we must retain by law.
• Operational records (clock events, daily logs, photos): retained for the retention period set by your Company. For most Canadian field-service industries this is 7 years (CRA tax recordkeeping). For homecare, longer periods may apply under PHIPA and equivalent provincial law.
• Backups: we keep encrypted backups for up to 30 days for disaster-recovery purposes.
• Marketing-site analytics and cookies: default Google Analytics 4 retention (14 months from last activity).
• Marketing-form submissions: kept for up to 24 months unless you've become an active customer (then retained as account data).

8. How we protect information

We use industry-standard safeguards to protect personal information from unauthorized access, alteration, disclosure, or destruction:

• Encryption in transit: all communication between your device and our servers uses HTTPS / TLS 1.2+.
• Encryption at rest: our Firestore database, Firebase Storage, and backups are encrypted at rest using Google's standard encryption.
• Authentication: Firebase Auth handles password hashing, session management, and rate-limiting. We support strong passwords and force a password change on first login.
• Authorization: Firestore security rules enforce that Workers can only read records related to clients they're assigned to, and Companies can only access their own tenant data.
• Audit logging: we record access to sensitive records so Companies (and we) can investigate any privacy concern.
• Personnel: our team accesses customer data only for support, troubleshooting, or as necessary to operate the service, and is bound by confidentiality obligations.
• Breach response: if we ever detect a security incident affecting personal information, we will notify affected Companies promptly (in accordance with our agreement with them and applicable law) and take immediate steps to contain and remediate.

9. Account deletion

You can delete your FieldStaff Workforce account at any time:

• Workers: open the FieldStaff Workforce mobile app, go to Settings → Delete My Account. The system will sign you out and delete your personal information from our active database. (Operational records related to work you performed for your Company — clock events, daily logs, etc. — remain in your Company's tenant for the retention period required by law and your Company's policies, since the Company is the owner of those business records.)
• Company administrators: contact us at info@fieldstaffworkforce.com to close your tenant. We will export your data on request and confirm in writing once your tenant is fully closed.
• Marketing-only contacts (people who filled in a demo form but never became customers): email us with the request and we'll remove your information within 30 days.

10. Your rights (GDPR / CCPA / PIPEDA)

Depending on where you live, you may have the following rights regarding your personal information. We honour all of these globally as a baseline, even where local law doesn't strictly require it:

• Right to access — request a copy of the personal information we hold about you.
• Right to correct / rectify — ask us to fix inaccurate or incomplete information.
• Right to delete / erasure — request that we delete your personal information (see Section 9). Note: business records owned by your Company and retained for legal purposes are not subject to your individual deletion right.
• Right to data portability — receive a copy of your information in a machine-readable format.
• Right to object / withdraw consent — object to certain uses of your information or withdraw consent at any time.
• Right to restrict processing — ask us to limit how we use your information while we resolve a dispute.
• Right to non-discrimination — we will not deny service or charge a different price because you exercised a privacy right.
• Right to lodge a complaint — you can file a complaint with your local data-protection authority. In Canada, this is the Office of the Privacy Commissioner of Canada (priv.gc.ca) or your provincial equivalent.

To exercise any of these rights, email us at info@fieldstaffworkforce.com. We respond within 30 days.

11. Children's privacy

FieldStaff Workforce is a B2B workforce-management product. Our service is not directed to children under 16, and we do not knowingly collect information from children. If you believe we have inadvertently collected information from a child, contact us and we'll delete it.

12. International data transfers

Our infrastructure is hosted in Google's North American cloud regions (primarily Canada and the United States). If you access our service from outside North America, your information will be transferred to and processed in North America. By using FieldStaff Workforce, you consent to this transfer. Where required by law (e.g. GDPR), we rely on Standard Contractual Clauses with our cloud provider for transfers.

13. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the law, or our services. We'll post the revised version here and update the "Last updated" date at the top. For material changes, we'll notify Company administrators by email. If you continue to use the service after changes take effect, you accept the revised Policy.

14. How to contact us

This Privacy Policy is provided for clarity. It is not a substitute for legal advice. The Personal Information Protection and Electronic Documents Act (PIPEDA), the Personal Health Information Protection Act, 2004 (PHIPA), and other applicable privacy laws govern in case of any conflict.