Privacy Policy

How GenAspect Inc. collects, uses, stores, shares and protects personal information in FieldValve.

Effective date: September 20, 2026 · Last updated: October 21, 2026

1. Who we are and scope

FieldValve is operated by GenAspect Inc., a corporation incorporated in Ontario, Canada ("GenAspect", "we", "us"). This Policy covers personal information processed through:

• the marketing website at fieldvalve.com (the "Site");
• the staff web application at app.fieldvalve.com and the FieldValve mobile apps for iOS and Android (the "App");
• the customer portal at portal.fieldvalve.com (the "Portal");
• our APIs, integrations (including QuickBooks Online and Stripe), support channels and emails.

Together these are the "Services". This Policy is part of our License Agreement & Terms of Service (the "Agreement"). Capitalized terms not defined here have the meaning given there.

2. Our roles: controller and service provider

FieldValve holds information about several kinds of people, and our role differs for each:

Where we act as a service provider, we process personal information only on the Customer's documented instructions (this Policy, the Agreement and the Customer's configuration of the Services) and for the purposes in Section 4. Requests about data held in a Customer's account should be directed to that Customer; we will assist them, and if you contact us directly we will forward your request to them where appropriate.

Two access paths inside a Customer's account are worth knowing about. First, a Customer's owner can open a read-only view of the Portal exactly as a given End Customer sees it, to help with support; every such view is recorded in an audit log. Second, GenAspect platform staff can access Customer accounts for support, security and engineering purposes, under confidentiality obligations.

3. Information we collect

3.1 Information you provide

• Account and profile: name, email address, password (stored as an argon2id hash, never in clear text), phone number, avatar, role, skills and certifications, and the company name and locations (branches) you set up.
• Billing: when paid subscriptions are available to you, the plan, seat count, billing contact and the payment-method token returned by our payment provider. We do not store full card numbers. (Payments your own customers make to you are separate and are described in Section 10.)
• Customer Data: customer and site records, service requests, quotes, jobs, visits, schedules, checklists, line items, invoices, payment records, refunds, time entries, comments, notes, ratings of visits, and photos or file attachments your team uploads. These may contain personal information about End Customers and staff. Photos uploaded from the staff app are usually re-encoded, which removes embedded camera metadata. The original file is stored as uploaded, including any location metadata the camera recorded, when it is uploaded through the Portal, taken with the in-app camera, in a format we cannot re-encode (for example HEIC), or when its correct rotation depends on that metadata. We do not strip metadata on our servers.
• Signatures: an image of the handwritten signature an End Customer draws to approve a quote or acknowledge an invoice, with the signer's name and time.
• Portal submissions: service requests, uploaded photos, approvals, ratings and messages that End Customers submit through the Portal.
• Site forms: the contact form (name, company, email, team size, optional phone) and the newsletter form (email).
• Signup answers: what you enter while creating an account — email address, name, business name, phone number and your answers about your work, team and how you get paid — saved as you go, including if you do not finish, together with how you reached the signup page (the campaign tags in the link and the address of the website that sent you, without the page) and when you reached each step. We use them to help you complete your signup and to improve the Services, and we may contact you about an unfinished signup.
• Support and communications: anything you send us by email or in-app.

3.2 Information collected automatically

• Technical and security data: IP address, browser and device type, operating-system version, app version, request timestamps, pages or screens accessed, error reports and browser security (CSP) violation reports. The IP address and browser identifier used to sign in are also stored on your session and sign-in-token records for as long as those records exist.
• Activity records: who created or changed a job, visit, invoice or payment and when (the job activity feed, audit fields, and audit logs of permission changes and Portal support views).
• Location data: see Section 6.
• Push-notification subscriptions: if an End Customer enables Portal notifications, the browser push endpoint needed to deliver them.
• Device notifications in the App: the App may ask permission to show notifications on your device. Those alerts are generated locally by the App from records you can already see; nothing is sent to a push service and no subscription is stored.
• Contact details shown on screen: the App’s analytics records which elements were clicked, and a clicked element can carry the label and the link behind it. An End Customer’s name, email address and postal address — whatever the clicked element shows — can therefore reach the analytics provider when a staff user clicks a contact or a row on a customer or job screen. We remove telephone numbers before anything leaves the browser — the numbers behind call, text and WhatsApp links, and numbers written in full in page text or typed into a search box. It covers the number whether it is written plainly, with spaces, or with a country code, and it applies to the session recording as well as to the events. It is still a filter rather than a guarantee: it is tuned to leave dates, money amounts and reference numbers intact, so a fragment of a number, or one written unusually, can still reach the provider. Session replay of the App carries whatever is on the screen at the time, which on those screens includes End Customer contact details.
• Product-analytics events and session recordings: in the staff App used through a web browser — not in the iOS or Android apps, which are not instrumented — a third-party analytics provider (Section 8) records the pages visited, the elements clicked and scrolled past, and a replay of the session: the layout, text and interactions of the pages used, with the contents of form fields masked. One-time codes carried in a link — an invitation, an account-deletion cancellation, a card-payment return — are removed from page addresses and from the recording before anything is sent. These are linked to your name and work email address. This Site sends pageview and click data to the same provider that is not linked to an identified person, and no recording (Sections 8 and 11). If your browser sends a “Do Not Track” or Global Privacy Control signal, the App does not load the provider’s code at all: no analytics events and no session recordings are collected, you are not identified to the provider, and your browser makes no request to the provider’s servers.
• Device storage: see Section 7.

3.3 Information from third parties

• QuickBooks Online: when a Customer connects QuickBooks, we receive the accounting data described in Section 9, including change notifications (webhooks) that Intuit sends us.
• Stripe: payment status, dispute and payout events, and the type of payment method used (for example card or bank debit). We never receive full card numbers.
• Referrals and invitations: if another user invites you or refers you, we receive your name and email from them.

Other than the technician location described in Section 6 and the signature images described above, we do not intentionally collect sensitive categories of information (health, biometrics, government ID numbers, precise financial account numbers). Please do not enter them in free-text fields.

4. How we use information

• To provide, operate, secure and support the Services, including syncing data between devices and the server.
• To create and manage accounts, authenticate users, and enforce roles and location-scoped permissions.
• To process subscriptions and payments, send invoices and receipts, and prevent fraud.
• To deliver integrations you enable (QuickBooks Online, Stripe, maps, email, push).
• To send transactional and service messages: invitations, magic links, password resets, quote and invoice emails on behalf of the Customer, receipts, security alerts and important changes to the Services.
• To respond to support requests and to communicate with you about your account.
• To monitor, debug and improve performance, reliability and security, using logs and de-identified or aggregated statistics.
• To understand how the App is used and to decide what to build next, using product analytics and session replay that ARE linked to the signed-in staff user (Sections 3.2 and 8).
• To comply with law, enforce our agreements, and protect the rights, safety and property of GenAspect, our customers and others.
• To send marketing emails with your consent (Section 18).

We do not use Customer Data to train machine-learning or generative-AI models, to build advertising profiles, or for any purpose other than those above. We do not make decisions about you that have legal or similarly significant effects solely by automated means.

5. Legal bases

Where the GDPR, UK GDPR or a similar law applies, we rely on: performance of a contract (providing the Services to the Customer); our legitimate interests (security, fraud prevention, service improvement, and business communications, balanced against your rights); compliance with legal obligations (tax, accounting, responding to lawful requests); and consent, where required (for example marketing emails). Under Canadian law (PIPEDA and provincial equivalents), we collect personal information with consent that is express or implied by the circumstances, and we limit collection to what is reasonable for the purposes identified. The two forms of monitoring the Services carry out state their own basis: Section 6 for technician location, which your employer collects through us, and Section 6A for product analytics and session replay, which we collect as controller.

6. Technician location data

FieldValve includes a live-presence feature that shows a Customer's dispatchers where technicians currently are on a map. It works as follows:

• Location is collected from the App only while the App is open, and only when both (a) the technician has an open time entry (running or paused) or a visit assigned to them for that day that is not yet finished, and (b) either the device's location permission has already been granted to the App or the technician taps "Start travel" (labelled "Start drive" on the job screen) for a visit, which is what asks for that permission. The App does not collect location in the background. It also never captures location in a desktop browser: capture runs only in the mobile app, in an installed (home-screen) app, or on a touch device.
• The App sends the device's current position, its accuracy and the time it was taken to our server periodically (at most about once every 30 seconds). It sends nothing else — no heading, speed, altitude or battery level.
• We store only the latest position per user; each new report overwrites the previous one. We do not keep a location history or movement trail. One qualification, for completeness: a session recording of a dispatcher's screen (Section 3.2) can show technician pins moving over the length of that recording, and is held by our analytics provider for its retention period. Positions older than five minutes are treated as stale and are no longer shown on the map. The last reported position is deleted when your account is deleted, and when you are removed from or suspended in the account it is deleted within a day.
• Location is visible only to users of the same Customer account who hold the "See presence" permission (owners and managers by default), scoped to their location (branch), and to GenAspect platform staff for support.
• How to turn it off: deny or revoke the App's location permission in your browser or device settings, or close the App. The App does not currently have a separate in-app switch.
• Site addresses are a separate thing. Addresses a Customer enters for a job site are geocoded through a mapping provider (Section 8) so they can be shown on a map and used to estimate travel. That is not technician location data and is unrelated to live presence.

Live presence is a standard feature of the App: GenAspect decides how it works technically — when it captures, how often, and that only the latest position is kept — while the Customer (your employer) decides whether to act on it and is responsible for informing you and meeting its obligations under applicable employment and privacy law. A Customer that does not want its technicians located can ask us to switch the feature off for its account at support@fieldvalve.com. We do not rely on your individual consent for this collection. Your employer collects your work location in order to dispatch and coordinate field work, and directs us to process it on its behalf: in Canada this is employee personal information collected for purposes that are reasonable in the circumstances (section 5.3 of PIPEDA, and the employee-information provisions of Alberta's and British Columbia's Personal Information Protection Act); where the GDPR applies, the basis is your employer's legitimate interest in coordinating field work. You can still stop the collection at any time by revoking the App's location permission on your device; that switches off live presence and does not otherwise affect your use of the App.

6A. Monitoring of staff use of the App

Everything a signed-in staff user does in the staff App is recorded, in two forms: usage events (which screens were opened, which elements were clicked) and a replay of the session — a reconstruction of the App’s own screens that can be played back like video. This is not a sample of selected people: it applies to every signed-in staff user, and we do not exclude anyone from it. Recording begins a moment after the App loads, once it has fetched the provider’s configuration, so the very start of a session may not be captured. Section 3.2 lists what is captured and Section 8 names the provider. This Section explains who decided that it happens, on what basis, who can watch it, and how to stop it.

• What a replay contains. The layout and text of each screen you opened, your pointer movements, clicks and scrolling, and the timing of all of it. The App is a CRM, so the text on those screens is your employer’s business records: customer names and addresses, job notes, amounts, and the names of your colleagues. What you type into a form field is masked — the recording shows asterisks in place of your keystrokes — and the same telephone-number filter described in Section 3.2 runs over the recorded text AND over the links behind it, with the same limits. Other text that has already been saved and is displayed back to you is recorded as it appears on the screen.
• Where it runs. The staff App used through a web browser, including when you have installed it to your home screen from the browser. The FieldValve apps installed from the Apple and Google app stores send nothing to the analytics provider — no events, no recording, no identification. The customer Portal sends nothing to the analytics provider either.
• What is excluded. Signature pads are blocked: while a signature pad is open the recording is paused, and so is the collection of pointer positions for heatmaps, so neither the pad nor the pen movements that draw the signature are captured; both resume when the pad closes. A signature displayed back on a later screen is blocked in the same way, and so is the on-screen preview of a rendered invoice or quote, because the signature is part of that page image.
• You are identified by name. Each session is linked to your account identifier, your name, your work email address, your role, and the location you are working in. Section 8 lists exactly what the provider receives. A recording is not anonymous and we do not present it as one.
• Who can watch. The events and recordings are held by our analytics provider (Section 8) and can be viewed by GenAspect personnel with access to that project, for the purposes in Section 4. Your employer has no access to them. They are not part of your employer’s FieldValve account, and we do not give an employer a recording of an Authorized User’s session on request — including for a workplace investigation. The general exceptions in Section 8, for legal process and for protecting rights and safety, still apply. Retention is in Section 12.
• How to turn it off. Set your browser to send a “Do Not Track” or Global Privacy Control signal. When either is present nothing is collected: no events, no recording, no identifier stored in your browser, and you are not identified to the provider (Section 11). That signal is the only individual opt-out there is today, and most browsers do not send it unless you turn it on — some offer a setting, others need an extension. The App does not have an in-app switch, and there is no per-account switch: we cannot turn this off for one company and leave it on for others (Section 7.6a of the Agreement). Signing out ends the link between the recording and your name; the App keeps recording that browser tab until you close it.

This is our collection, not your employer’s — which is what makes it different from the location data in Section 6. We decide that it happens, what is captured and what it is used for; your employer cannot switch it on or off, cannot see the events or the recordings, and is not the organization accountable for them. GenAspect is the controller, so the rights in Section 15 run against us directly rather than through your employer. We do not ask you to consent separately, and we do not treat your employer’s acceptance of our Agreement as your consent. In Canada we rely on consent implied by the circumstances, resting on the notice in this Section, in Section 3.2, and in Section 7.6a of the Agreement, which every Authorized User accepts on first sign-in; and we limit the collection to what a reasonable person would consider appropriate for the purpose in Section 4 (section 5.3 of PIPEDA), which is why form fields are masked, telephone numbers are filtered out (with the same limits in Section 3.2), signatures are excluded, and no employer is given access. We do not rely on the employee-information provisions of PIPEDA or of the Alberta and British Columbia Personal Information Protection Act: those cover an organization collecting information about its own employees, and you are not our employee. Where the GDPR applies the basis is our legitimate interest in understanding how our own software is used, balanced against your rights (Section 5); Section 16.3 describes where we offer the Services.

Your employer has a separate duty, and ours does not discharge it. Recording a worker’s session is electronic monitoring under employment law. Section 7.9 of the Agreement makes the employer responsible for the notice that law requires of it — including, for Ontario employers at the statutory threshold, a written electronic-monitoring policy under the Employment Standards Act, 2000. That duty is about your workplace; ours is about our own collection, and this Section is how we discharge it. Some employers fall below that threshold and owe no written policy at all, which is one reason this Section is written to stand on its own. If you have not been given your employer’s monitoring policy, ask your employer for it; if you want to know what we hold about you, or want it deleted, write to support@fieldvalve.com (Section 15).

7. Offline storage on your device

The App is offline-first. To let field staff work without connectivity, it stores on your device a copy of the Customer Data you are authorized to see: customers, sites, jobs, line items, visits, comments, activity history, time entries, the price book, attachment lists, and a cache of attachment files (up to about 50 MB), pre-loaded from the jobs and service requests already synced to your device. It also keeps a queue of changes you made offline, including any photos you attached, until they are uploaded, plus your access credentials, your permissions, a directory of your co-workers, sync bookmarks and interface preferences. If you sign in with a password, the App also stores a salted, irreversible verifier derived from it so that you can sign in again while offline; the password itself is never stored on the device.

This data stays on the device until you sign out or clear the browser or app data. Signing out removes the local database, the attachment cache and your credentials; your permissions and a small number of preference, diagnostic and not-yet-uploaded change records remain until the browser or app data is cleared. Anyone with access to an unlocked device may be able to view local data, so please use a device passcode and keep the device secure. If the Customer revokes your access, the App stops syncing; because it is offline-first, a device that is not signed out keeps its local copy until it is signed out or its data is cleared, so Customers should sign out removed users and, if a device is lost, wipe it with their device-management tools.

8. Sharing, sub-processors and third-party links

We share personal information only as described here. We do not sell or rent personal information, and we do not share it for cross-context behavioural advertising.

• Within the Customer's account. Customer Data is visible to the Customer's Authorized Users according to their roles and locations, and to End Customers through the Portal for their own requests, quotes and invoices.
• Service providers (sub-processors). These process data on our behalf under written contracts that limit them to processing personal information on our documented instructions and for the purpose stated in the table, forbid any other use, and require them to protect that information at least as well as this Policy describes, including confidentiality, security safeguards and prompt breach notification:

  Provider	Purpose	Data	Location
  Render Services, Inc.	Application hosting, managed PostgreSQL database, backups and platform logs	All Services data	United States
  Stripe, Inc. / Stripe Payments Canada Ltd.	Payment processing, connected-account onboarding, payouts, disputes, saved payment methods, fraud prevention	Customer business and owner identity details for onboarding; End Customer name, email, payment method and amounts; on a disputed payment, the invoice, the signature image and job photos submitted as evidence; the browser's IP address, because Stripe's scripts run in the App and the Portal	United States, Canada
  Intuit Inc.	QuickBooks Online accounting sync (only if connected)	See Section 9	United States
  Cloudinary Ltd.	Storage and delivery of photos and file attachments	Uploaded files and their metadata; the browser's IP address when a file is viewed	United States, European Union
  Resend, Inc.	Transactional and marketing email delivery; the newsletter subscriber list is held there	Recipient email, name, message content, delivery events	United States
  Mapbox, Inc.	Geocoding and address suggestions as an address is typed (in the App and the Portal)	Address text being typed, site addresses, and the IP address of the browser — or of our server, when we geocode stored addresses in bulk	United States
  CARTO	Map imagery (basemap tiles) in the App	The browser's IP address and map tile coordinates	United States, European Union
  PostHog, Inc.	Product analytics and session replay: which pages staff use and what they click in the staff App used through a web browser (not the iOS or Android apps, which are not instrumented), screen recordings of those sessions, and pageview and click data on the Site	Staff name, work email address, role, whether the account is a platform administrator, the staff user’s account identifier and their current location identifier, the pages and elements used, the browser’s IP address and technical details of the device and browser, and App session recordings with the contents of form fields masked. Because staff screens display End Customer records, an End Customer’s name, email address and postal address can appear in clicked-element data and in those recordings; telephone numbers are filtered out before transmission (Section 3.2 describes what that filter does and does not reach). On the Site, pageview and click data not linked to an identified person	United States
  Functional Software, Inc. (Sentry)	Error and crash reporting: when the software fails, a technical report is sent so that we can find and fix the fault. It covers the staff App used through a web browser, the iOS and Android apps, the customer portal and our servers. We do not use Sentry for analytics, performance monitoring or session recording	The error message and the stack trace (which lines of our code were running), the kind of page or route the error happened on, in the staff App the internal identifier of the record that was open (for example a job, an invoice or a customer record — not that of a staff member or of a company), the app version, technical details of the browser and device, and the IP address of the browser, device or server the report is sent from. Before a report leaves the browser, the app or our servers we remove the signed-in person’s identity, cookies, request headers other than the browser’s identification string, the contents and query string of the request, console output, text typed into fields and the labels of clicked elements in the portal; we cut web addresses down to their first segment; and we filter out email addresses and telephone numbers. The text of an error message is written by software, not by us, and can still contain a fragment of the record being processed — for example a name — that these filters do not recognise. A report produced by the operating system when an iOS or Android app stops unexpectedly is sent by the app’s native crash component: it contains the stack trace and device details, together with the route and the filtered trail of recent activity described above. The staff App — in a web browser and on iOS and Android — also reports when a session of use starts and ends, with the app version and browser or device details, and our servers report how many requests they handled and how many failed, so that failures can be counted against use; the customer portal sends no such report	United States
  Cloudflare, Inc. (Turnstile)	Bot protection: a check that a person, not an automated script, is asking to sign up, sign in, or request a password-reset or email-verification code in the App	The browser's IP address and the browser and device signals Turnstile reads to tell people from automated traffic, on the signup, sign-in, password-reset and email-verification pages only	United States
  Google LLC (Google Fonts)	Typeface delivery on the Site, App and Portal	The browser's IP address and browser details	United States
  Browser push services (Apple, Google, Mozilla)	Delivery of Portal notifications using the Web Push standard, if an End Customer enables them	Push subscription endpoint and notification content	United States

• Links that open other apps. The App and Portal offer buttons that open a customer's address in Google Maps, start a call or text message, or open a WhatsApp chat with a phone number. These open a third-party app or site on your device and pass it the address or number; that provider's own privacy policy then applies. Nothing is sent to those providers unless you tap the link.
• Professional advisers. Lawyers, accountants and auditors, under confidentiality obligations.
• Legal and safety. When required by law, subpoena, court order or governmental request; to enforce our agreements; or to protect the rights, property or safety of GenAspect, our customers or the public. Where lawful, we will notify the affected Customer before disclosing its data.
• Business transfers. In connection with a merger, acquisition, financing or sale of assets, subject to this Policy.
• With your direction. When you ask us to share data, for example by exporting it or connecting an integration.

We will update this list when we add or replace a sub-processor. Customers who need notice of sub-processor changes may request it at support@fieldvalve.com.

9. QuickBooks Online integration

FieldValve offers an optional integration with Intuit® QuickBooks® Online. This Section explains exactly what happens when a Customer connects it. Intuit and QuickBooks are registered trademarks of Intuit Inc. FieldValve is an independent application and is not affiliated with, endorsed by or sponsored by Intuit Inc.

9.1 Authorization

• Connection uses Intuit's OAuth 2.0 authorization flow. We never see or store your Intuit username or password. We request a single scope, com.intuit.quickbooks.accounting; we read your company name through the Accounting API so we can show which QuickBooks company is connected.
• The resulting access and refresh tokens are encrypted at rest with AES-256-GCM under keys held separately from the database, are never written to logs or returned to a browser, and are used only to call the QuickBooks API for your company file.
• Only the account owner can connect, disconnect or reset the integration — the "connect QuickBooks" permission is reserved to the owner role and cannot be granted to other roles — and each FieldValve location (branch) connects to exactly one QuickBooks company.

9.2 Data we read from QuickBooks

We read: company information and preferences (name, currency, tax settings); the chart of accounts (income and deposit accounts); items and services; classes, if class tracking is used; customers; employees; and estimates, invoices and payments. We read this data to map your FieldValve records to your books and to detect and reconcile differences; invoices and payments are read across your company file for the period being reconciled, not only the records FieldValve created. If you run the optional one-time import, we also copy your QuickBooks customers, items and invoices for a period you choose into FieldValve, where they are then held as Customer Data and retained under Section 12. Intuit also sends us change notifications (webhooks) for your company; we verify their signature and keep the notification payloads, for up to 90 days, to process them and to diagnose sync problems.

9.3 Data we write to QuickBooks

We write: customers and their addresses and contact details; estimates (from quotes); invoices and invoice lines; payments; refund receipts; deposits mirroring Stripe payouts; employees and time activities, if time sync is enabled; classes mirroring your business units, if class tracking is used; and items and services mirroring your price book, plus two FieldValve service items used for lines that have no matching item. We write only records derived from your FieldValve data and the sync options you enable. Some writes are triggered by an event rather than by a person — for example a deposit created when Stripe reports a payout — and the two FieldValve service items are created by us so that lines with no matching item can be posted.

9.4 How QuickBooks data is used and shared

• QuickBooks data is used solely to operate the synchronization you configured, to show you sync status and errors, and to support you when you ask. It is not used for advertising, profiling, model training, benchmarking or any purpose unrelated to your sync.
• QuickBooks data is not sold, rented or shared with any third party other than the hosting sub-processor that stores all FieldValve data (Section 8), and is not transferred to any other integration. The only other circumstances in which it could be disclosed are the ones in Section 8 that apply to all data: where disclosure is required by law or legal process, to establish or defend a legal claim, to our own professional advisers under confidentiality obligations, or to a successor in a business transfer. We do not disclose QuickBooks data for any other reason.
• Access within GenAspect is limited to personnel who need it for support or engineering, under confidentiality obligations. Diagnostic logs may include error responses from QuickBooks, which can echo the field values that were submitted; these logs are kept for up to 12 months, in line with Section 12.

9.5 Disconnecting and deleting QuickBooks data

• You can disconnect at any time from FieldValve (Settings → Integrations → QuickBooks → Disconnect) or by disconnecting FieldValve from inside QuickBooks (Intuit's "My Apps"). On disconnect we ask Intuit to revoke the access and refresh tokens, and we stop all sync, pause any queued writes and delete the stored credentials immediately. When you disconnect from inside QuickBooks, Intuit revokes the tokens itself and sends your browser to FieldValve; we confirm the revocation with Intuit and then delete our copy in the same way. If Intuit revokes our access for any other reason (for example an expired authorization), the credentials are deleted as soon as we learn of it.
• The "Reset connection" action in FieldValve removes the remaining connection record. Sync mapping records that link FieldValve invoices, payments, customers and other records to their QuickBooks counterparts, the integration's activity log and its configuration are retained for the single purpose of keeping your history consistent and preventing duplicates if you reconnect; they are deleted when the Customer's account is deleted or on request.
• You may request deletion of all QuickBooks-derived data we hold, including credentials and mapping records, by emailing support@fieldvalve.com; we will complete it within 30 days, subject to legal retention obligations.

Your use of QuickBooks itself is governed by the Intuit privacy statement and Intuit's own terms.

10. Payments through Stripe

Card and bank payments, including a payment a technician collects on site through a payment link, are processed by Stripe. When a Customer enables payments, Stripe collects the business and owner identity information it needs for onboarding and compliance directly through Stripe-hosted pages; we receive only the resulting account status. When an End Customer pays, card details are entered into Stripe-hosted elements and go straight to Stripe; FieldValve stores only the amount, status, payment-method type and Stripe identifiers. If a payment is disputed, we may submit the related invoice, the End Customer's signature image, job photos and the Customer's written explanation of the charge to Stripe as evidence on the Customer's behalf. Stripe's processing of personal information is described in the Stripe Privacy Policy. Stripe may also act as an independent controller for fraud prevention and regulatory purposes.

11. Cookies, tokens and similar technologies

• Site (fieldvalve.com): sets no cookies. Our analytics provider’s script (Section 8) stores an identifier in your browser’s local storage so that repeat visits can be recognized; screen recording is off on the Site. The only other third-party request the Site makes is to Google Fonts.
• App: uses strictly necessary technologies to keep you signed in and working offline: a secure, HttpOnly refresh-token cookie, a copy of the refresh token in the browser's local storage (or, on a mobile device, the app's own storage) so you can re-open the App offline, short-lived access tokens held in memory, and browser storage and caches for the offline data described in Section 7.
• Portal: a secure, HttpOnly refresh-token cookie, a copy of that refresh token in the browser's local storage (or, in the mobile app, the app's own storage) so the Portal can restore your session, a short-lived session token held only in memory, and browser storage holding your name, email address and phone number so the Portal can recognize you, an identifier used to remember a payment device, and your display preferences.
• Product analytics (App and Site): in the App, our analytics provider (Section 8) stores an identifier in browser local storage so that events from the same person can be grouped, and the Site stores the same kind of identifier. It is not an advertising cookie and is not shared with any advertising network; it is removed when you clear the browser or app data.
• The sign-in and offline technologies above are essential and cannot be switched off while using the Services. We do not use advertising cookies or fingerprinting, and we do not track you across other companies’ sites. Product analytics and session recording are not essential, and our analytics provider is configured to honour your browser’s “Do Not Track” and Global Privacy Control signals: when either is set, no analytics events or recordings are collected, no identifier is stored in your browser, and you are not identified to the provider. For staff using the App that browser signal is the only individual opt-out there is today — Section 6A explains how to send one and what the App does not yet offer. Those signals do not change the essential processing needed to sign you in and keep the Services working.

12. Data retention and deletion

• Customer Data is retained for as long as the Customer's account is active. Records that users delete in the App are soft-deleted: they are marked as deleted so that offline devices can sync the deletion, are hidden from all users, and remain in our database as deletion markers until the Customer's data is deleted under this Section or on request. Deleting a photo or file removes it from view; the stored file itself is deleted 30 days later, and immediately when the Customer's account or location is deleted.
• Attachment files: files attached to a job or a service request are deleted from storage 30 days after the attachment itself is deleted. The delay lets field devices that were offline finish syncing the deletion.
• Backups are retained by our hosting provider for up to seven days and then overwritten; data deleted from active systems may persist in backups for up to that period.
• Unfinished signups: 12 months after your last activity on the signup, we remove your name, email address, business name and phone number from it, along with the per-link campaign details; the answers that remain no longer identify you and are kept only for aggregate statistics. If you finish signing up, your answers become part of your account and are kept under the rules above; you can ask us to delete an unfinished signup at any time.
• Early-access workspaces are kept like any other account while early access lasts. Before it ends we will tell account owners by email what changes, with time to export their data or close the workspace.
• After termination or cancellation, we keep Customer Data for 60 days so the Customer can export it or reactivate, then delete it from active systems, except where we must keep it for legal, tax or accounting reasons (for example, records of payments and invoices, which are retained in restricted-access form for the period required by tax and accounting law, generally 6 to 7 years).
• Location data: latest position only, overwritten on each report. It is deleted when your account is deleted, and within a day of your being removed from or suspended in the account.
• Security data: platform and application logs are kept for up to 12 months. Sign-in records (IP address and browser identifier) live with the session or sign-in-token record they belong to: those sessions and tokens stop working after at most 30 days, and the record itself is deleted within 30 days of the session or token expiring or being revoked.
• Product-analytics data is held by our analytics provider (Section 8); we keep no separate copy, and nothing of it is held in our own systems. Session recordings of the App are deleted 30 days after they are recorded. Usage events and heatmap data are kept for the period our plan with that provider sets, which is currently at least one year; the provider may move older data to archival storage rather than delete it at that point. You can ask us to delete your analytics record at any time (Section 15), which we do irrespective of the retention period.
• Site form submissions: contact-form submissions are kept in our database until you ask us to delete them. Newsletter subscriptions are not kept in our database at all: they are held by our email provider (Section 8) until you unsubscribe or ask us to delete them.
• Portal links and sessions: sign-in magic links expire after 15 minutes and can be used once; guest payment links expire after 45 minutes (scanned in person) or 7 days (sent by email); a Portal session ends after 7 days without use. Expired links stop working at once, and their records, which include the IP address that created them, are deleted within 30 days, or within 90 days for a link that was used.

Customers can remove users from their organization and delete customers, jobs and attachments from within the Services. You can delete your own account from Settings → Profile in the app (or the More tab on a phone); fieldvalve.com/delete-account explains what each kind of account deletion removes and how long it takes. If you cannot sign in, email support@fieldvalve.com from the address on the account. Either way we complete deletion within 30 days, subject to the legal-retention exceptions above.

Deleting your personal information does not delete your employer's business records. Time entries, job comments, photos and activity history that you created belong to the Customer whose account you worked in, who is required to keep them; after your personal information is erased those records remain and show as "Deleted user". Records we must keep for legal, tax or accounting reasons — invoices, payments and refunds — are retained in restricted-access form for the period the law requires, generally 6 to 7 years, and are no longer linked to your name, email address or phone number.

If you are the last owner of a company account, deleting your account deletes that whole company account — its customers, sites, jobs, visits, quotes, invoices, price book, attachments and connected integrations — for everyone in it. Nothing of it is retained, including its invoices, payments and refunds: the legal-retention exception above applies to accounts we close at the end of a subscription, not to a deletion you ask for yourself. The app tells you which of the two applies to you before you confirm anything.

13. Security

We use administrative, technical and physical safeguards appropriate to the sensitivity of the information, including TLS encryption for all connections, encryption at rest by our database and storage providers, encryption of integration credentials with keys held separately from the database, argon2id password hashing, role-based access control with location scoping, short-lived access tokens, request rate limiting, security headers on all three surfaces with a strictly enforced content-security policy on the Site and the Portal, and stripping of secrets from request data before it can reach application logs. Our Trust & Security page describes current measures and our roadmap; roadmap items are not commitments. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach of security affecting your personal information, we will notify the affected Customer without undue delay and, where required, individuals and regulators, in accordance with applicable law.

14. International transfers

GenAspect is located in Canada. Our primary hosting and most sub-processors are in the United States, and some providers operate in the European Union. Personal information you provide is therefore stored and processed outside your province or country, where it may be accessible to local law-enforcement and national-security authorities under local law. We rely on contractual safeguards with each provider (including standard contractual clauses where required) for these transfers, and before communicating personal information outside Quebec we carry out the privacy impact assessment required by Quebec law. Our Privacy Officer (Section 20) can answer questions about these transfers.

15. Your rights and choices

Depending on where you live, you may have the right to access the personal information we hold about you, to correct it, to have it deleted, to receive a portable copy, to object to or restrict certain processing, to withdraw consent, and to complain to a privacy regulator. To exercise these rights, email support@fieldvalve.com. We verify requests by confirming that they come from the email address on the account (or, for an End Customer, the address the Customer holds for you) and, where necessary, by asking for details only the account holder would know. We respond within 30 days (or the period required by law) and will not discriminate against you for exercising your rights. You may use an authorized agent where the law allows; we will ask for proof of the authorization.

If your information is held in a Customer's account (you are an employee or an End Customer of a business that uses FieldValve), the Customer is responsible for handling your request; we will forward it and assist as its service provider. Product-analytics events and session recordings are the exception: we are the controller for them (Sections 2 and 6A), so send those requests to us and we will act on them ourselves rather than forwarding them to your employer. You can update most of your own account and profile details directly in the App. Customers can export jobs and invoices as CSV from the App and can request a full account export from support.

16. Region-specific disclosures

16.1 Canada

We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and substantially similar provincial laws, including the Act respecting the protection of personal information in the private sector (Quebec) and the Personal Information Protection Act of each of Alberta and British Columbia. The person accountable for our compliance is our Privacy Officer, who can be reached at support@fieldvalve.com. You may lodge a complaint with the Office of the Privacy Commissioner of Canada or your provincial commissioner. For Quebec residents: Section 6 describes the technology that allows a technician to be located and how to deactivate it, and Section 6A describes the session recording of staff use of the App and the browser signal that deactivates it; Section 14 describes transfers outside Quebec; we do not make decisions based exclusively on automated processing.

16.2 United States (including California)

We collect, and in the preceding 12 months have collected, the categories of personal information listed in Section 3 (identifiers, commercial information, internet activity, geolocation, professional information, and the signature images described in Section 3.1) from the sources described there (you, the Customer whose account you are in, your device, and the integrations in Section 3.3), for the purposes in Section 4, and disclose them to the service providers in Section 8. We retain each category for the periods in Section 12. We have not sold or shared (for cross-context behavioural advertising) personal information and we do not knowingly collect personal information of consumers under 16. Precise geolocation is sensitive personal information under the CPRA. We collect it in two ways: technician location for live presence (Section 6), and, in the limited cases described in Section 3.1, location metadata embedded in an uploaded photo. We collect it solely to provide the service the Customer requested and do not use it to infer characteristics about you. California residents have the rights to know, delete, correct, and to non-discrimination described in Section 15, and may use an authorized agent. We operate exclusively online and have a direct relationship with the people whose information we collect, so requests may be submitted by email. For data held in a Customer's account we act as a "service provider" under the CCPA/CPRA and process it only for the Customer's business purposes — except for the product analytics and session recordings described in Sections 3.2, 4 and 6A, for which we are the business and which we use to improve the Services.

16.3 European Economic Area, United Kingdom and Switzerland

The Services are directed at businesses in Canada and the United States. We do not offer them to individuals in the EEA, the UK or Switzerland, and we do not monitor the behaviour of individuals in those regions; on that basis we have not appointed a representative under article 27 of the GDPR. If we begin offering the Services in those regions we will appoint one and name it here. Where the GDPR or UK GDPR applies, the legal bases in Section 5 apply, you have the rights in Section 15, transfers rely on the safeguards in Section 14, and you may complain to your local supervisory authority.

17. Children and age

The Services are for business use and are not directed to children. Users of the App must be at least 18 (Section 3 of the Agreement). We do not knowingly collect personal information from anyone under 16 through the Portal or the Site. If you believe a child has provided us information, contact us and we will delete it.

18. Marketing emails

We send marketing emails (such as the newsletter) only with your consent as required by Canada's Anti-Spam Legislation (CASL) and CAN-SPAM. Every marketing email includes an unsubscribe link and our contact details; you can also opt out at support@fieldvalve.com. Opting out does not affect transactional or service emails, which are necessary to operate your account. Emails that the Services send to End Customers on a Customer's behalf (quotes, invoices, appointment notices) are sent at the Customer's direction; End Customers can manage those preferences through the unsubscribe link in each message or by contacting the Customer.

19. Changes to this Policy

We may update this Policy from time to time. We will post the new version at fieldvalve.com/privacy with an updated date and, for material changes, notify account owners by email or in-app notice before the change takes effect. Where a change introduces a new purpose for which the law requires your consent, we will obtain that consent before the change applies to you. Continued use of the Services after the effective date otherwise means you accept the updated Policy.

20. Contact

GenAspect Inc. (operating as FieldValve)
A-239 Sunnyside Ave, Ottawa, Ontario K1S 0R4, Canada
Privacy, security, legal and support enquiries all reach us at support@fieldvalve.com. Mark a privacy request "Privacy" in the subject line and it goes to our Privacy Officer.