FieldSync ("FieldSync", "we", "us") is a checklist and field-operations platform operated by Nordicprog AB (Sweden). This policy explains what personal data the FieldSync mobile app and service collect, why, how it is stored, and the rights you have. It applies to the FieldSync Android and iOS apps and the FieldSync service at app.fieldsync.eu.

01 · Who controls your data

FieldSync is a multi-tenant business tool. You use it because your employer or the organisation that invited you ("your organisation") has an account. Your organisation is the data controller for the operational data you enter — checklists, cases ("ärenden"), water samples, photos and schedules.

FieldSync acts as a data processor on their behalf, and as controller only for the account and security data needed to run the service. Accounts are invitation-only — FieldSync does not offer self-registration to the general public.

02 · What data we collect

We collect only what is needed to provide the service:

• Account information: your name and email address, your role, and the organisation you belong to. Used to sign you in and to attribute your work.
• Authentication data: a login token stored securely on your device (in the device keystore / secure storage) so you stay signed in. Passwords are stored only in hashed form on the server.
• Content you create: checklist answers, case notes and messages, water-sample readings, and other field data you enter.
• Photos and images: pictures you attach to checklists or cases. The app requests camera and photo-library permission only when you choose to add an image or scan a site QR code.
• Site QR codes: when you scan a site label, we read the code to open the correct site or form.
• Basic technical data: app version, device/OS type, and error and diagnostic information used to keep the app working and secure.

We do not collect data for advertising, and FieldSync contains no third-party ads or ad trackers.

03 · How we use your data

• Provide the FieldSync service — create, sync, sign, and export checklists and related records.
• Keep records of who performed and approved each action (audit logging is a core feature).
• Sync your work between your device and your organisation's account, including offline changes made in the field.
• Send transactional emails, e.g. completed-checklist notifications and invitations.
• Maintain security, prevent abuse, and diagnose problems.

We do not sell your personal data.

04 · Who we share data with

Your data is visible to authorised members of your own organisation according to their role and site permissions. Beyond that, we share data only with the service providers ("sub-processors") that operate FieldSync on our behalf:

These providers process data only to deliver the service and under contractual data-protection obligations. We may also disclose data if required by law.

• Hosting & database: Servers and PostgreSQL database hosted in the EU (Hetzner, Germany).
• Media storage: Photos and files stored on Cloudflare R2.
• Email delivery: Transactional email sent via Resend.

05 · Where data is stored and security

Data is hosted in the EU. Data is encrypted in transit (HTTPS/TLS) between the app and our servers, and sensitive credentials are encrypted at rest. Access is restricted to authorised personnel and systems.

06 · Data retention

We keep operational records for as long as your organisation's account is active, subject to the history-retention period of their plan. When an account is closed, data is deleted or anonymised within a reasonable period, except where we must retain it to meet legal obligations.

07 · Your rights

Depending on your location (including under the EU/EEA GDPR) you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing.

Because your organisation controls your operational data, please direct requests to your organisation's administrator first. You can also contact us at [email protected] and we will assist and, where we act as controller, respond directly. To request deletion of your account data, email [email protected].

08 · Children

FieldSync is a workplace tool intended for use by employees and authorised personnel. It is not directed to children and we do not knowingly collect data from children under 16.

09 · Changes to this policy

We may update this policy from time to time. Material changes will be reflected here with a new "Last updated" date.

Questions about this policy or your data?

Reach out to Nordicprog AB and we'll help. For operational data, please contact your organisation's administrator first. [email protected]