Privacy Policy

Kevin Ventures LLC
[POSTAL ADDRESS]
New York, United States

Email: hello@getfieldpacket.com. We read that inbox and will answer a privacy question from it.

Our website. Anyone can read https://www.getfieldpacket.com. We decide what happens to the little data a visit creates.

The app. A contractor company (our customer) puts its own business and customer data into FieldPacket. That company decides what goes in, who at the company may see it, and when it is deleted. We handle it on that company's instructions to run the service for them. If your home was worked on by a contractor who uses FieldPacket, the contractor is the right first place to ask about your data — and we will help them answer you.

• Website visits. No analytics, no advertising tags and no third-party trackers run on our marketing pages. If you email us or book a demo, we keep that correspondence.
• Accounts. Name, work email, phone (if given), role, and which company you belong to. Passwords are handled by our authentication provider and stored hashed — we never see or store your password.
• What a contractor enters about a job. Customer name, service address, phone, email, utility account numbers, utility bills, invoices, equipment details, load-calculation reports, measurements, program application answers, signed program forms, and job photos (photos taken in the app carry the time and location of capture).
• Program portal logins. Two kinds, both encrypted before they are stored and never written to logs. A company's own login for the NYSERDA or Con Edison contractor portal is decrypted only on the machine that fills the application, and is never shown back to a browser. A customer's own login — NYSERDA issues one customer portal account per application, so a three-family home has three — can be shown back to the people at the company who have access to that job, because they are the ones who have to use it; every time one is revealed it is recorded in that company's security log.
• Use and security records. Who did what in the app, when a file was generated, and security-sensitive events (an access change, a credential being revealed). Server error logs are written without customer data, file links or tokens in them.

We use cookies for exactly two jobs: keeping you signed in, and remembering choices you made (which company you are working in, the language you chose, light or dark, a screen layout, and a referral partner's booking link). There are no advertising cookies and no cross-site tracking, and we do not run an analytics product. Blocking the sign-in cookie means you cannot sign in; the preference cookies are safe to clear.

The app also keeps data on the device it is used on, so a crew with no signal can keep working: photos and answers wait on the phone and upload when the signal returns, recently opened pages are saved so they still open with no service, and small settings are remembered there. Signing out deliberately does not throw away photos that have not uploaded yet, so a day's work is not lost; clearing the browser's data for the site removes everything held on the device, those photos included.

• Read bills, invoices, reports and photos so the application fields fill themselves.
• Check a job against the program's required list and tell the company what is still missing.
• Build the packets and forms a program asks for.
• Fill a company's application in the program's own portal using that company's credentials. A person at the contractor always reviews it and presses Submit — we never submit an application and never sign anything for a customer.
• Send the messages a company asks us to send (an appointment confirmation, a form to sign). Those go out through that company's own connected email or e-signature account, as that company.
• Keep accounts secure, provide support, invoice, and keep records we are required to keep.

We do not sell personal information, we do not share it for advertising, and we do not use a customer's data to build profiles for anyone else.

Documents and photos uploaded to the app are sent to Anthropic's Claude API so their contents can be read into the right fields — the bill, the invoice, a nameplate, a load-calculation report. That processing happens for the contractor who uploaded the file, under Anthropic's commercial terms, and we do not grant anyone the right to use your data to train AI models. The app flags what it read so a person can correct it; it never invents a figure to make a job look eligible, and it never creates or alters a photo to make a job look like something it was not. (The app does draw the time, date and location onto a photo taken in the app — that stamp is added when the picture is taken, which is what makes it evidence.)

These are the providers that process data for us so the service can work:

• Supabase — database and sign-in, hosted in the United States.
• Vercel — application hosting.
• Cloudflare — storage for photos and documents (Cloudflare R2), and an anti-abuse check on the two public forms a homeowner can be sent a link to.
• Anthropic — the AI reading described in section 6.
• Google — the mailbox we send account alerts from, when we have to tell a company's owner that something in their account needs them. An alert like that can name a job, so a copy of it sits in that mailbox.
• Public address and property records — a service address (and nothing else about the job) is sent to public services to find the address, its position and the public record of the building: New York City's address service and open-data records, New York State's address and tax-parcel service, the U.S. Census geocoder, and an OpenStreetMap-based suggestion service.
• The rebate programs and permit authorities — NYSERDA and Con Edison receive the application a contractor files with them, in their own portals; a permit filing goes to the city or county that issues it.

We keep this list current as the app changes. If you need the exact list as of a date, ask us.

A company can also switch on connections to services it already uses — Housecall Pro, Google Drive, a customer-messaging account, e-signature, or its phone system. Those are the company's own accounts and are off until that company connects them; when it does, data flows to that service under the company's agreement with it.

Job data stays as long as the contractor's account is active — program records are often needed for years after a job. Most of what a person deletes in the app goes to a 30-day trash, can be restored by an owner or admin during that time, and is then permanently removed, files included. When a company's account ends, it can export its applications, photos and packets; we delete its data after a short wind-down period, or sooner on request, keeping only what we must for legal and accounting reasons.

• Each company's data is separated from every other company's in the database itself, not only on the screen.
• Photos and documents are private. Nothing is public; a file opens through a link that expires quickly — minutes for most, and at most a couple of hours for a photo being uploaded from a basement with no signal.
• Portal passwords and connection tokens are encrypted before storage.
• Every person has their own login and a role — field crew, for example, see their jobs and photos but not prices or customer finances.
• Security-sensitive actions are recorded, and the account owner is alerted to them.
• Data is hosted in the United States, encrypted in transit and at rest by the providers above.

Our own staff can reach a company's account to support it and to set up its programs, and the portal filling runs on our machine with the company's own credentials. Opening a company's account to look at what a member sees is look-only — it cannot change anything — and it is recorded in that company's security log.

No service can promise that nothing will ever go wrong. If a breach affects your data we will tell the affected company promptly and give it what it needs to notify the people involved.

If you use FieldPacket at work, your company's owner or office admin can change or remove your account and the data in it. If your personal data is in FieldPacket because a contractor entered it, ask that contractor to correct or delete it; they can, and we will help if they need us to. You can also write to us at hello@getfieldpacket.com and we will pass a request to the right company and confirm when it is done. We never ask for payment to handle a request like this.

FieldPacket is a tool for businesses. It is not directed at children, and we do not knowingly collect data from anyone under 13.

If we change this policy we will post the new version on this page and move the effective date. This policy is governed by the laws of the State of New York. It takes effect on [EFFECTIVE DATE].

See also our Terms of Service.