Privacy Policy

Who we are

FieldScribe ("we", "us", "our") provides voice-to-CRM automation software for commercial specialty contractors in the United Kingdom. For the purposes of UK GDPR and the Data Protection Act 2018, FieldScribe is the data controller for personal data we collect about you.

If you have questions about this policy or how we handle your data, contact us at: hello@fieldscribe.co.uk

What data we collect

Website visitors

• Contact form submissions (name, email, phone number, company name, trade, CRM in use, message)
• Basic analytics data (page views, referrer, browser type) via privacy-respecting analytics — no cross-site tracking

FieldScribe clients (business accounts)

• Account registration details (company name, billing contact, email address)
• Payment information — processed by Stripe; we do not store card numbers
• Configuration data (CRM API credentials, WhatsApp number, workflow settings)
• Usage data (number of voice notes processed, processing timestamps, error logs)

Technician voice notes (processed data)

When a technician sends a WhatsApp voice note through the FieldScribe system, the audio is:

• Received by a dedicated WhatsApp Business API number registered to your business
• Processed immediately by OpenAI Whisper for transcription
• Structured by GPT-4o for data extraction
• Deleted immediately after processing is complete — we do not store audio files

Transcripts are passed to your chosen CRM system and are not stored by FieldScribe beyond what is needed to confirm successful delivery.

Lawful basis for processing

We rely on the following lawful bases under UK GDPR:

• Contract performance — processing your account data to deliver the FieldScribe service
• Legitimate interests — product analytics, fraud prevention, and service improvement
• Legal obligation — retaining financial records as required by HMRC (typically 6 years)
• Consent — marketing communications, where we have your explicit consent

How we use your data

• To deliver and operate the FieldScribe service
• To respond to enquiries and demo requests
• To send service-related communications (account updates, system notifications)
• To improve our service through anonymised usage analytics
• To meet our legal and regulatory obligations

We do not sell your data to third parties. We do not use your data for automated decision-making that produces legal or similarly significant effects.

Who we share data with

We share data only with sub-processors required to deliver the service:

• OpenAI — voice transcription and data extraction (voice note content only; processed under OpenAI's enterprise terms)
• Make.com — workflow automation and CRM integration
• WhatsApp Business API (Meta) — receiving voice notes from technicians
• Stripe — payment processing
• Your chosen CRM (simPRO, ServiceTitan, etc.) — receiving structured job data as the end destination

All sub-processors are contractually bound to appropriate data protection standards. A full sub-processor list is available on request.

Data transfers outside the UK

Some sub-processors (including OpenAI and Make.com) are based in the United States. Data transfers to these processors are made under UK-approved transfer mechanisms, including the UK International Data Transfer Agreement (IDTA) where applicable.

Data retention

• Voice note audio — deleted immediately after processing (typically within 30 seconds)
• Processing transcripts — deleted within 24 hours of successful CRM delivery
• Account data — retained for the duration of your subscription plus 12 months
• Financial records — retained for 6 years as required by HMRC
• Contact form submissions — retained for up to 24 months

Your rights under UK GDPR

You have the right to:

• Access — request a copy of personal data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — ask us to delete your data (subject to legal retention obligations)
• Restriction — ask us to restrict processing in certain circumstances
• Portability — receive your data in a machine-readable format
• Object — object to processing based on legitimate interests
• Withdraw consent — where processing is based on consent, withdraw it at any time

To exercise any of these rights, contact us at hello@fieldscribe.co.uk. We will respond within one calendar month.

Data Protection Agreement (DPA)

If your business requires a formal Data Processing Agreement (DPA) — as is common where FieldScribe processes personal data on behalf of your clients — we provide one on request. Email hello@fieldscribe.co.uk with the subject line "DPA request".

Security

We apply appropriate technical and organisational measures to protect personal data, including:

• Encryption in transit (TLS 1.2+) and at rest
• Access controls limiting data access to authorised personnel only
• Regular security reviews of sub-processors
• Immediate deletion of sensitive audio data after processing

Cookies

This website uses only strictly necessary cookies required for site functionality. We do not use advertising cookies or third-party tracking cookies. Our analytics implementation is privacy-respecting and does not set persistent cross-site identifiers.

Complaints

If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO): ico.org.uk — 0303 123 1113.

We would appreciate the opportunity to address your concerns before you contact the ICO — please reach out to us at hello@fieldscribe.co.uk first.

Changes to this policy

We may update this policy from time to time. Material changes will be communicated to active clients by email at least 14 days before taking effect. The "last updated" date at the top of this page reflects the most recent revision.