The short version. Fielded is built by Recordo for professional inspectors. Inspection reports often contain client names, property addresses, photos of private homes, voice notes, and written findings. We use that content to run Fielded for you: capture the inspection, draft report updates, store report assets, generate PDFs, and serve report links you choose to share. We use OpenAI and Google Gemini through commercial API services to help draft reports, and we do not permit AI providers to use your content to train general-purpose models. We do not sell your personal data, we do not show advertising, and we do not share inspection content with data brokers. Read on for the details, and please contact privacy@recordo.app if anything is unclear.
This Privacy Policy describes how Recordo, a limited liability company organized under the laws of the Republic of Armenia ("Recordo," "we," "us," or "our"), collects, uses, shares, and protects personal data in connection with the Fielded mobile application, the getfielded.app website, the publicly shareable inspection-report links generated by the application, and related services (together, the "Service"). This policy is part of, and incorporated into, our Terms of Service.
For matters subject to the General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR"), Recordo is the controller of personal data described below, unless the policy says otherwise (in particular, see Section 14).
This policy covers personal data we collect from or about people who:
This policy does not cover websites, products, or services operated by anyone other than us, even if we link to them.
When you generate a public web link to share a report, recipients who open the link generate the following data: their IP address, the time they accessed the link, the User-Agent string of their browser, and the report they viewed. We use this in aggregate for security, anti-abuse, and to detect that links have been accessed.
We use the personal data described in Section 3 for the following purposes:
If you are in the European Economic Area, the United Kingdom, or another jurisdiction whose data-protection law requires us to identify a legal basis for each purpose, we rely on:
| Purpose | Legal basis |
|---|---|
| Provide the Service (account, sync, report asset storage, AI-assisted drafting, exports) | Performance of a contract (GDPR Art. 6(1)(b)) |
| Subscription administration and billing communications | Performance of a contract (Art. 6(1)(b)) |
| Security, abuse prevention, fraud detection | Legitimate interests (Art. 6(1)(f)): keeping the Service secure |
| Analytics and Service improvement | Legitimate interests (Art. 6(1)(f)): improving the Service. You can object to this processing; see Section 12. |
| Marketing communications (if any) | Consent (Art. 6(1)(a)), withdrawable at any time |
| Legal compliance, response to lawful requests | Legal obligation (Art. 6(1)(c)) and/or legitimate interests (Art. 6(1)(f)) |
The Service uses artificial intelligence to transcribe voice, inspect photos you submit for report drafting, classify observations, route findings to report sections, draft report text, structure punch lists, and answer in-product questions. AI requests may be routed through Vercel AI Gateway. We use the following AI providers, acting as our subprocessors:
Our commitments to you about AI processing:
AI providers operate on infrastructure they control (primarily in the United States). Your content is transmitted to them under transport-layer encryption. Their data-processing and retention practices are governed by their agreements with us and by the product terms for the API services we use; provider safety and abuse monitoring may still apply.
To run the Service we engage the following service providers (called "processors" or "subprocessors" under data-protection law). Each has a contract with us that limits how they may use your data.
| Provider | Role | Primary region |
|---|---|---|
| Vercel, Inc. | API hosting, serverless compute, and AI Gateway routing | United States |
| Supabase, Inc. | Database, authentication, file storage | United States |
| Google LLC (Firebase) | Push notifications, mobile analytics, crash reporting | United States |
| PostHog Inc. | Product analytics | United States |
| RevenueCat, Inc. | Subscription management | United States |
| Apple Inc. | App distribution and in-app purchase (iOS users) | United States |
| Google LLC (Play) | App distribution and in-app purchase (Android users) | United States |
| OpenAI, L.L.C. and Google LLC (Gemini) | AI processing - see Section 6 | United States |
We may add or change processors from time to time. Material changes will be reflected in a revised version of this policy.
We share personal data only in the limited circumstances described below.
Under contracts that require them to process the data only on our instructions and to protect it.
When you generate a public report link and share it, anyone with the link can view the report contents until you revoke or rotate the link. You decide whom to send a link to; we have no control over what a recipient does with the link or its contents.
We may disclose personal data when we believe in good faith that disclosure is required to comply with a law, regulation, legal process, or governmental request; to enforce our Terms of Service; to detect, prevent, or address fraud, security, or technical issues; or to protect against harm to our rights, property, or safety, or that of our users or the public.
If we are involved in a merger, acquisition, reorganization, financing, or sale of all or substantially all of our assets, personal data may be transferred as part of that transaction. We will require the recipient to honor this policy or give you notice and a chance to opt out of further processing.
What we do not do.
We keep personal data only for as long as we need it for the purposes described in this policy, or as required by law.
| Data category | Retention |
|---|---|
| Inspection photos and annotated images | Retained as private report assets while your account is active, unless you delete the photo, delete the inspection, or close your account. Public report pages use short-lived signed image URLs generated when a report is viewed. |
| Voice recordings | Processed in memory or short-term storage and deleted after transcription where technically feasible; the transcribed text is retained as part of your report content. |
| Structured report content (text, observations, status pills, property details) | Retained while your account is active. You can delete an inspection from the app. |
| Public report links | Remain active until you revoke or rotate the link, delete the inspection, or close your account. |
| Account profile and credentials | Retained while your account is active. On account closure, deleted within 30 days, except where we are required to retain it for legal, accounting, tax, or fraud-prevention purposes. |
| Usage analytics in identifiable form | Up to 24 months from collection. After that, aggregated or anonymized. |
| Crash and security logs | Up to 12 months. |
| Subscription / billing records | As required by applicable tax, accounting, and consumer-protection law (typically up to 7 years). |
| Support communications | Up to 24 months after the matter is closed. |
| Backups | Cycled out as part of normal backup rotation, typically within 30-60 days. |
Recordo is based in the Republic of Armenia. Our service providers (Section 7) operate primarily in the United States. When you use the Service, your personal data is transferred to, stored in, and processed in the United States, and may be accessed by us from Armenia.
Where required by applicable law, we put in place safeguards for these transfers. In particular:
You can request a copy of the safeguards we rely on by writing to privacy@recordo.app.
We use technical and organizational measures intended to protect personal data against unauthorized or unlawful processing and against accidental loss, destruction, or damage. These include:
No system is perfectly secure. If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify you and, where required, the relevant supervisory authority, in line with applicable law.
Depending on where you live, you may have some or all of the following rights with respect to personal data we hold about you:
To exercise any of these rights, write to privacy@recordo.app. We will respond within the time limits required by applicable law (typically within one month for GDPR / UK GDPR requests, 45 days for CCPA requests). We may need to verify your identity before acting on your request; we will use reasonable methods proportionate to the sensitivity of the request.
This section provides additional information for California residents under the California Consumer Privacy Act / California Privacy Rights Act ("CCPA").
In the past 12 months, and on a going-forward basis, we collect the categories of personal information described in Section 3 of this policy. We collect these categories directly from you, automatically from your device when you use the Service, and from our service providers (Section 7). We use this information for the business and commercial purposes described in Section 4.
In the past 12 months, and on a going-forward basis, we have disclosed each category of personal information described in Section 3 to the service providers listed in Sections 6 and 7, for the business purposes described in Section 4.
We do not sell personal information, and we do not share personal information for cross-context behavioral advertising, as those terms are defined under the CCPA.
We do not use or disclose sensitive personal information for purposes other than those permitted by Cal. Civ. Code ยง1798.121(a) (e.g., to provide the Service that you requested).
To exercise these rights, contact privacy@recordo.app. If your request is denied, you can appeal by replying to our response.
The Service is designed for inspectors and similar professionals who capture content about real property, and sometimes about people present on the property, in the course of their work. Where you use the Service to collect or process personal data about other people (e.g., voice recordings that capture a homeowner, photos that show a third party, names of contractors you list in a punch list), you are the controller of that personal data under European data-protection law and any equivalent regime.
In that scenario:
The Service is intended for adults engaged in professional or commercial activity. You must be at least 18 years old to use the Service. We do not knowingly collect personal data from anyone under 18. If you believe we have collected personal data from a child, please contact us at privacy@recordo.app and we will take appropriate steps to delete it.
We may update this Privacy Policy from time to time to reflect changes to our practices, to the Service, or to applicable law. When we make material changes, we will:
We encourage you to review this policy from time to time.
If you have questions, requests, or complaints about this Privacy Policy or our handling of your personal data, please contact us:
We aim to respond to privacy requests within 30 days.
If you are in the EEA, you can also lodge a complaint with the data-protection authority in the EU member state where you live or work, or where you believe the alleged infringement occurred.
If you are in the UK, you can lodge a complaint with the Information Commissioner's Office (ico.org.uk).
If you are in Canada, you can contact the Office of the Privacy Commissioner of Canada.
If you are in Australia, you can contact the Office of the Australian Information Commissioner.