Privacy Policy

This Privacy Policy explains how Backbone Construction LLC (“FieldOS,” “we,” “us”) handles personal information when you visit our website, request early access or a demo, or use the FieldOS web and mobile apps (the “Service”).

Our two roles. For website visitors and people who contact us, we decide how personal information is used (we are the “controller”). For data that our customers put into the Service — such as crew names, production entries, and job-site photos — we process it on the customer’s behalf and under their instructions (we are a “processor”). If you are a user of a customer’s workspace, that customer’s own privacy practices also apply, and requests about that data should usually go to them first.

Information you give us:

• Early-access and demo requests: name, work email, company, phone number, role, and any message you include.
• Account information: name, email address, password (stored only as a secure hash), organization, and role.
• Content in the Service: plans and drawings, production quantities, daily reports, photos, notes, comments and mentions, invoices, and related project records.
• Support conversations: what you tell us when you contact us.

Information collected automatically:

• Log data: IP address, browser and device type, pages and API requests, and timestamps, used for security and troubleshooting.
• Mobile device data: device model, OS version, app version, a push notification token, and crash reports.
• Photo metadata: when you capture or upload a photo, it may include the time and GPS location embedded by your device camera. Location is only collected this way — we do not track your location in the background.
• Cookies and similar technologies, described in our Cookie Policy.

We do not knowingly collect information from children under 16. The Service is intended for business use only.

• To provide, operate, and maintain the Service, including authenticating you and keeping your session signed in.
• To send service messages such as invitations, password resets, mentions, and notifications you have enabled.
• To respond to early-access, demo, and support requests.
• To secure the Service: detecting and preventing fraud, abuse, and unauthorized access.
• To understand usage and fix bugs so we can improve the Service.
• To comply with legal obligations and enforce our Terms.

We do not sell or rent personal information, and we do not share it for cross-context behavioral advertising. We do not use customer content to train general-purpose artificial intelligence models.

Where the law requires a legal basis (for example, in the EU or UK), we rely on performing our contract with you or your employer, our legitimate interests in running and securing the Service, your consent where we ask for it, and compliance with legal obligations.

We share personal information only in these situations:

• Within your organization: other users in your workspace can see information according to the roles and project access your administrators set.
• With service providers (subprocessors) that host and run parts of the Service for us, under contracts that restrict their use of the data. The current list is below.
• At your direction: for example, when you export a report or send an invoice to an owner or utility.
• For legal reasons: to comply with law or a valid legal process, or to protect the rights, safety, and property of our users, the public, or us.
• In a business transfer: if we are involved in a merger, acquisition, or sale of assets, subject to this Policy.

We will update this list before adding a new subprocessor that handles customer data.

We keep customer content for as long as the customer’s subscription is active. After it ends, we make data available for export for 30 days, then delete it from active systems within 90 days. Backups are overwritten on their normal rotation.

Early-access and demo requests are kept for up to 24 months after our last contact with you, unless you ask us to delete them sooner. Security logs are kept for a limited period, usually no longer than 12 months. We may keep some records longer where the law requires it.

We protect information with encryption in transit (TLS) and at rest, hashed passwords, short-lived access tokens, role-based access controls, and strict separation between each customer’s workspace. No system is perfectly secure, but we work to protect your data and will notify affected customers without undue delay if we become aware of a security breach involving their data, as required by law.

Depending on where you live, you may have the right to:

• access the personal information we hold about you and get a copy of it;
• correct inaccurate information;
• delete your information;
• object to or restrict certain processing, or withdraw consent where we rely on it; and
• not be discriminated against for exercising these rights.

To make a request, email [email protected]. We will verify your request and respond within the time required by law (generally 30–45 days). If your data is in a customer’s workspace, we may refer your request to that customer. You can also turn off push notifications in your device settings, and manage email notifications in the app.

If you are in the EU or UK, you also have the right to complain to your local data protection authority.

We are based in the United States, and our Service is hosted there. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. Where required, we use appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

We may update this Policy from time to time. We will change the “last updated” date above, and if the changes are material we will notify account administrators by email or in the app before they take effect.

Questions or requests about privacy: [email protected], or write to Backbone Construction LLC, 2 Burlington Woods Dr Ste 100, Burlington, Massachusetts 01803-4551, United States.