Privacy Policy

Effective date: July 12, 2026

Last updated: July 14, 2026

This Privacy Policy explains how InnOneWeb OÜ, an Estonian private limited company (OÜ), registry code 16826593, with its registered office at Sakala 7-2, 10141 Tallinn, Estonia, doing business as FieldCosts (“FieldCosts,” “we,” “us,” or “our”), collects, uses, discloses, and otherwise processes personal data in connection with the FieldCosts websites, web application, mobile applications, APIs, support, and related services (collectively, the “Service”).

1. Scope

This Privacy Policy applies when we process personal data as a controller or business for our own purposes, including data relating to:

• website visitors;
• prospects and business contacts;
• account owners, administrators, and Authorized Users;
• support contacts;
• billing contacts; and
• persons who communicate directly with us.

When a business customer submits information about its clients, employees, contractors, suppliers, jobs, receipts, invoices, or other persons to the Service (“Customer Content”), FieldCosts generally processes that information on behalf of the business customer. In that context, the customer is generally the controller or business, and FieldCosts is generally the processor or service provider. Requests relating to Customer Content should normally be directed to the customer that controls the relevant workspace.

This Policy does not apply to third-party websites, applications, or services that link to or integrate with the Service.

2. Controller and Contact Details

Controller:

InnOneWeb OÜ Registry code: 16826593 Registered address: Sakala 7-2, 10141 Tallinn, Estonia Privacy email: support@fieldcosts.com Support email: support@fieldcosts.com

Data Protection Officer: We have not appointed a Data Protection Officer because we are not currently required to do so.

3. Personal Data We Collect

The personal data we collect depends on how a person interacts with the Service.

3.1. Account and identity data

We may collect:

• name;
• business email address;
• phone number;
• job title or role;
• profile image;
• company name;
• workspace name;
• account identifier;
• authentication and login information;
• role and permission settings; and
• communication preferences.

3.2. Business and workspace data

We may collect:

• business address;
• company settings;
• timezone;
• currency;
• invoice prefix;
• tax settings;
• team structure;
• user assignments;
• account configuration; and
• subscription or plan information.

3.3. Customer Content

At a customer’s direction, the Service may process:

• client names and contact details;
• service and job addresses;
• job descriptions, schedules, assignments, notes, and statuses;
• employee and contractor names, contact details, roles, and assignments;
• receipts, receipt images, vendor details, dates, amounts, taxes, payment methods, and OCR output;
• expenses, approvals, rejection reasons, and reimbursement records;
• invoices, line items, payment status, and related documents;
• uploaded photos and files;
• internal notes and communications; and
• data imported from or exported to integrations.

Customers determine what Customer Content they submit. Customers are responsible for having a lawful basis and providing required notices to the people whose data they submit.

3.4. Payment and transaction data

If a customer purchases a paid subscription, we and our payment providers may process:

• billing name and address;
• tax or VAT information;
• payment method type;
• last digits and expiry information made available by the payment provider;
• invoices and transaction history;
• payment status;
• chargeback or dispute information; and
• subscription renewal and cancellation information.

FieldCosts does not ordinarily receive or store full payment-card numbers. Payment-card data is handled by Stripe under its own privacy and security terms.

3.5. Device, log, and usage data

We may automatically collect:

• IP address;
• browser type and version;
• device type and operating system;
• device and advertising identifiers, where permitted;
• language and timezone;
• referring and exit pages;
• pages, screens, buttons, and features used;
• dates and times of access;
• session duration;
• crash, error, performance, and diagnostic data;
• approximate location inferred from IP address;
• authentication, security, and audit logs; and
• cookie and similar-technology data.

3.6. Mobile application data

Depending on the features a user enables and device permissions granted, the mobile application may process:

• camera access for receipts, job photos, or documents;
• photo-library access;
• files and attachments;
• notifications;
• device information;
• approximate or precise location for supported location-based features;
• QR or camera-based login information; and
• offline and synchronization data.

The app requests camera or file permission when the relevant feature is used. Permissions can be managed in device settings. Authentication tokens are stored on the device for sign-in continuity and are revoked on logout, account closure, expiry, or security action.

3.7. Communications and support data

We may collect:

• support requests;
• email and chat content;
• call or meeting notes;
• feedback;
• survey responses;
• troubleshooting information; and
• files or screenshots provided to support.

We will not record calls without providing legally required notice or obtaining consent where required.

3.8. Data from integrations and third parties

We may receive data from:

• a customer’s administrators or colleagues;
• payment providers;
• identity and authentication providers;
• app stores;
• analytics and monitoring providers;
• accounting, scheduling, mapping, communication, and other integrations enabled by the customer;
• referral partners; and
• publicly available business sources.

4. How We Use Personal Data

We may use personal data to:

• provide, operate, host, and maintain the Service;
• create and administer accounts and workspaces;
• authenticate users and manage permissions;
• process receipts, expenses, jobs, approvals, reimbursements, invoices, reports, and exports;
• perform OCR and automated extraction;
• synchronize devices and integrations;
• process payments and subscriptions;
• provide onboarding, support, troubleshooting, and service communications;
• personalize settings and user experience;
• monitor performance, reliability, and product usage;
• secure the Service and detect fraud, abuse, malware, unauthorized access, and policy violations;
• maintain audit and activity logs;
• comply with legal, tax, accounting, regulatory, and contractual obligations;
• establish, exercise, or defend legal claims;
• improve and develop features;
• create aggregated or de-identified analytics;
• communicate about products, updates, security, and changes;
• send marketing communications where permitted; and
• support a merger, financing, acquisition, reorganization, or sale of assets.

5. Legal Bases for EEA and UK Processing

Where the GDPR or UK GDPR applies, we rely on one or more of the following legal bases:

5.1. Performance of a contract

We process account, subscription, support, and service data where necessary to provide the Service or take steps requested before entering into a contract.

5.2. Legitimate interests

We may process data where necessary for legitimate interests, including:

• operating and improving a B2B software service;
• securing accounts and systems;
• preventing fraud and abuse;
• providing customer support;
• managing business relationships;
• understanding product usage;
• enforcing agreements; and
• protecting legal rights.

We consider the nature of the data, the reasonable expectations of the individuals, and the impact on their rights.

5.3. Legal obligations

We process data where necessary to comply with tax, accounting, court, regulatory, law-enforcement, sanctions, and other legal obligations.

5.4. Consent

We rely on consent where required, including for certain cookies, marketing, device permissions, or optional processing. Consent may be withdrawn at any time, without affecting prior lawful processing.

5.5. Vital interests

In rare situations, we may process data to protect the vital interests of a person.

6. Customer Content and Our Processor Role

6.1. Business customers decide what Customer Content is submitted, why it is processed, and which users can access it.

6.2. When FieldCosts processes Customer Content on a customer’s behalf, we process it according to:

• the customer’s documented instructions;
• the Terms of Service;
• the applicable Order;
• the Data Processing Addendum; and
• applicable law.

6.3. We may process Customer Content for our own purposes only where legally permitted, such as to secure the Service, prevent abuse, comply with law, manage billing, or create aggregated or de-identified information that does not reasonably identify a person or customer.

6.4. A person seeking access, correction, deletion, or another right concerning Customer Content should contact the relevant business customer. We will assist the customer as required by applicable law and the Data Processing Addendum.

7. OCR, Automation, and Artificial Intelligence

7.1. The Service may use OCR, rules, machine learning, or other automated methods to extract or categorize information from receipts, invoices, files, and other content.

7.2. Automated output may be inaccurate and must be reviewed by an authorized user.

7.3. Unless expressly disclosed in the Service or an Order, FieldCosts does not use Customer Content to train a general-purpose artificial-intelligence model for the benefit of unrelated third parties.

7.4. The Service is not intended to make solely automated decisions that produce legal or similarly significant effects about individuals. Customers must not use automated output as the sole basis for employment, credit, insurance, eligibility, or similarly significant decisions.

8. Cookies and Similar Technologies

We may use cookies, local storage, software-development kits, pixels, and similar technologies for:

• authentication and session management;
• security and fraud prevention;
• saving preferences;
• essential Service functionality;
• performance and error monitoring;
• analytics; and
• marketing, where enabled and permitted.

Non-essential analytics is blocked until an affirmative analytics choice where consent is legally required.

Optional analytics is limited to public marketing pages and is loaded only after an affirmative analytics choice. FieldCosts does not run this analytics tracker inside authenticated customer workspaces or platform administration, and the first-party tracker does not capture page text, form values, full link destinations, cursor movement, or session replay.

Specific technologies, providers, purposes, and durations are listed in our Cookie Policy.

A user can control cookies through our consent tool and browser settings. Blocking essential cookies may prevent the Service from functioning.

9. How We Disclose Personal Data

We may disclose personal data to the following categories of recipients.

9.1. Service providers and subprocessors

We may use providers for:

• cloud hosting and storage;
• database and infrastructure services;
• authentication;
• email delivery;
• customer support;
• monitoring and error reporting;
• analytics;
• OCR or document processing;
• payment processing;
• backups;
• security;
• mobile app distribution;
• maps and directions; and
• business operations.

The current provider list is published on our Subprocessors page.

9.2. Customer administrators and Authorized Users

Workspace administrators and users with appropriate permissions may access data within the customer’s account.

9.3. Integrations selected by the customer

When a customer enables an integration, we may disclose data to and receive data from that third party as directed by the customer.

9.4. Professional advisers

We may disclose data to lawyers, accountants, auditors, insurers, banks, and professional advisers where reasonably necessary and subject to confidentiality obligations.

9.5. Authorities and legal process

We may disclose data where we reasonably believe disclosure is necessary to:

• comply with law, regulation, court order, or lawful process;
• respond to lawful requests by public authorities;
• enforce agreements;
• investigate fraud, abuse, or security incidents;
• protect the rights, safety, and property of FieldCosts, customers, users, or the public; or
• establish, exercise, or defend legal claims.

Where legally permitted, we may notify the affected customer before disclosure.

9.6. Corporate transactions

Data may be disclosed in connection with financing, due diligence, merger, acquisition, reorganization, insolvency, or sale of all or part of our business or assets. The recipient may continue to process data subject to this Policy or a replacement policy provided as required by law.

9.7. With consent or direction

We may disclose data where the individual or customer consents or directs us to do so.

10. Sale and Sharing of Personal Information

FieldCosts does not sell personal information for money.

FieldCosts does not sell personal information or share it for cross-context behavioral advertising. We do not use authenticated workspace content for advertising.

We do not knowingly sell or share personal information of persons under 16.

11. International Data Transfers

FieldCosts is established in Estonia, and service providers or customers may be located in other countries.

Personal data may be transferred to and processed in countries whose laws may differ from those of the person’s country.

Where required, we use an approved transfer mechanism, such as:

• an adequacy decision;
• the European Commission’s Standard Contractual Clauses;
• the UK International Data Transfer Addendum or other approved UK mechanism; or
• another legally valid safeguard.

Information about applicable safeguards may be requested through support@fieldcosts.com.

12. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including providing the Service, maintaining security, complying with law, resolving disputes, and enforcing agreements.

Our operational retention schedule is:

• active workspace data, including clients, jobs, expenses, invoices, files, mobile synchronization data, and current WhatsApp conversations: for the subscription term;
• closed workspace data: a 30-day read-only export and cancellation period, followed by deletion from the application database and organization storage;
• application-generated database backups: a rolling 30-day period when the server backup task is enabled; hosting-provider snapshots follow the provider contract and are isolated from ordinary use;
• security and audit logs: 12 months;
• notifications: 180 days;
• closed support chats, including submitted screenshots: 24 months after closure;
• resolved WhatsApp conversations and media: 24 months after resolution; raw webhook and message payloads are scrubbed after 30 days;
• generated export files: 30 days;
• consented first-party public-site analytics: 90 days; short-lived quota counters are removed after 2 days;
• expired login tokens: removed after a 7-day cleanup window;
• FieldCosts' own billing, tax, consent, security, and legal-claim records: for the period required by applicable law or needed to establish, exercise, or defend claims.

A documented workspace legal hold pauses scheduled record cleanup and final workspace deletion. Retained data remains access-restricted and is not used for unrelated purposes. The scope and continuing need for the hold must be reviewed, and normal retention resumes when the hold is released.

We may retain aggregated or de-identified information that no longer reasonably identifies a person.

13. Security

We use technical and organizational measures designed to protect personal data, which may include:

• encryption in transit;
• access controls;
• role-based permissions;
• authentication controls;
• logging and monitoring;
• backups;
• vulnerability and patch management;
• separation between customer workspaces;
• confidentiality obligations; and
• incident-response procedures.

No method of transmission, storage, or processing is completely secure, and we cannot guarantee absolute security.

Customers are responsible for secure credentials, devices, user permissions, endpoint security, and lawful configuration of their workspace.

14. Data Breaches

We maintain procedures to assess and respond to personal-data incidents.

Where FieldCosts acts as processor, we will notify the affected customer without undue delay after becoming aware of a personal-data breach affecting Customer Content, as required by the applicable Data Processing Addendum and law.

Where FieldCosts acts as controller, we will notify the competent authority and affected individuals where required by law.

15. Privacy Rights

Depending on location and applicable law, a person may have rights to:

• obtain information about processing;
• access personal data;
• correct inaccurate data;
• delete personal data;
• restrict processing;
• object to processing;
• receive portable data;
• withdraw consent;
• opt out of certain marketing, sale, sharing, or targeted advertising;
• limit certain uses of sensitive personal information;
• appeal a denied privacy request; and
• complain to a supervisory authority.

Rights may be subject to legal exceptions and verification.

To exercise a right concerning data that FieldCosts controls, contact support@fieldcosts.com.

To exercise a right concerning Customer Content, contact the business customer that controls the relevant workspace.

We may request information reasonably necessary to verify identity and authority. An authorized agent may submit a request where permitted by law, subject to verification.

We will not discriminate against a person for exercising applicable privacy rights.

16. EEA, UK, and Swiss Rights

Individuals in the EEA, UK, or Switzerland may have the rights described above and may lodge a complaint with their local data-protection authority.

Because the controller is established in Estonia, the lead supervisory authority may be:

Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) Tatari 39, 10134 Tallinn, Estonia Website: https://www.aki.ee/

Individuals are encouraged to contact us first so that we can attempt to resolve the concern.

17. United States State Privacy Rights

Residents of certain U.S. states may have rights under state privacy laws, subject to legal thresholds and exceptions.

Where applicable, this section serves as a supplemental notice.

17.1. Categories collected

In the preceding 12 months, we may have collected the following categories:

• identifiers;
• customer records and business contact information;
• commercial and transaction information;
• internet, device, and network activity;
• approximate geolocation;
• professional or employment-related information;
• audio, visual, or electronic information submitted to support or the Service;
• account credentials and other sensitive information used for authentication; and
• inferences related to Service use and preferences.

17.2. Purposes

We use these categories for the business and commercial purposes described in Section 4.

17.3. Recipients

We disclose categories of personal information to the recipients described in Section 9.

17.4. Rights

Where applicable, residents may request access, correction, deletion, portability, or information about collection and disclosure, and may opt out of sale, sharing, targeted advertising, or certain profiling.

Submit requests to support@fieldcosts.com or the support page at fieldcosts.com/support.

If we deny an appealable request, instructions for appeal will be included in the response.

17.5. California metrics and updates

If FieldCosts becomes subject to the California Consumer Privacy Act, the Policy must be reviewed at least annually and updated to include all required disclosures, request methods, and applicable metrics or notices.

18. Marketing Communications

We may send marketing emails to business contacts where permitted by law.

A recipient may unsubscribe using the link in the message or by contacting us. We may still send non-marketing communications relating to accounts, security, billing, support, legal notices, and the Service.

Customers are responsible for ensuring that communications they send through or using data from the Service comply with applicable marketing, privacy, and telecommunications laws.

19. Children

The Service is intended for businesses and is not directed to children.

No person under 18 may create an account.

We do not knowingly collect personal data directly from children. If we learn that a child has submitted personal data without appropriate authorization, we will take reasonable steps to delete it.

Customers must not submit children’s personal data unless necessary for a lawful business purpose and permitted under applicable law and these Terms.

20. Third-Party Services

The Service may contain links to or integrations with third-party services. Their privacy practices are governed by their own policies.

We are not responsible for a third party’s collection, use, security, or disclosure of personal data.

21. Changes to This Privacy Policy

We may update this Policy to reflect changes in law, technology, providers, or the Service.

We will post the updated version and revise the “Last updated” date. If a change materially affects personal data or legal rights, we will provide additional notice where required.

22. Contact Us

Questions, requests, or complaints may be sent to:

InnOneWeb OÜ Sakala 7-2, 10141 Tallinn, Estonia Privacy email: support@fieldcosts.com Support email: support@fieldcosts.com