Draft for attorney review. This is a draft for a lawyer to review. It is not legal advice, and it is not in effect until counsel approves it and the operator replaces every value marked for completion.
Effective 2026-10-18.
This policy describes how North Crest Ventures LLC ("Fieldline," "we," "us") handles personal information in the Fieldline service. Fieldline is a multi-tenant, white-label lead-to-cash product for residential field-service shops (HVAC, plumbing, and similar trades). It is operated from the United States.
Two roles matter:
- Shop staff. For the account information of the people who sign in, Fieldline is the business.
- The shop's customers (homeowners and other occupants). The shop decides what is collected and why. Fieldline is a service provider, and a processor, for that information. We use it to provide the service to the shop, to secure it, and as the law requires. We do not sell it, and we do not use it for our own marketing.
The Terms of Service is the contract with the shop. This policy is the description of the data.
Information we collect
Shop staff. Name, email, phone if the shop enters one, role (admin, dispatcher, or technician), the shop or shops they belong to, a password hash, password-reset token hashes, refresh-token hashes, and an audit trail of who changed a record. The audit trail stores the keys that changed. It does not store the password hash, a signature image, or a photo data URL.
The shop. Business name, brand color, logo, phone numbers, time zone, trade, business hours, message templates, and, if the shop fills them in, a QuickBooks company name. A live QuickBooks connection is not active. See "Subprocessors."
The shop's customers and leads. Name, phone, email, service address (street, unit, city, state, ZIP), access notes, and notes the shop writes. Also the lead source (a missed call, a web form, a webhook, a manual entry, a reactivation, or the receptionist), and equipment the shop records (kind, brand, model, serial, filter size, install date).
Jobs and money. Schedules, job notes, photos of the work (stored with the job), checklists, signatures on estimates and job forms, estimate and invoice line items, amounts, tax, payment method (card, ACH, cash, check, or other), payment status, and a processor reference. We do not collect or store a full payment-card number, bank account number, or card security code. Card and ACH records are marked with a simulated processor until a live processor is connected.
Calls, texts, and email. Caller and shop phone numbers, call status, a link to a recording when the carrier provides one, the receptionist transcript, and a summary (intent, problem, equipment mentioned, urgency, sentiment, and follow-ups) for the dispatcher. SMS bodies, both directions. The content of email we send for the shop, such as an estimate, an invoice, or a review request.
Customer links. A person with an estimate link can view that estimate and submit a signature. A person with a customer-portal link can view that customer's estimates, invoices, and jobs. The link is the access. The shop chooses who receives it.
Files the shop uploads. Customer, job, price-book, or technician rows imported from a spreadsheet, including files exported from another field-service tool.
Automatic data. Access and refresh tokens, rate-limit keys that can include an IP address, and request logs (time, path, status, a request id). The dashboard stores the access token and the refresh token in the browser's local storage. We do not use advertising cookies, and we do not sell browsing activity. The host of the website may log IP addresses in its own access logs.
We do not ask for government ID numbers, and we do not collect precise device geolocation. A service address is the location of the job, not a GPS trail from a phone.
How we use it
We use personal information to:
- Provide the lead-to-cash workflow the shop asked for: leads, scheduling, estimates, jobs, invoices, payments the shop records, and the customer links.
- Sign staff in, separate one shop's rows from another's, and record an audit trail.
- Place and receive calls, store recordings and transcripts, and send or receive the shop's text messages.
- Send password-reset email, and email the shop asks the product to send (estimates, invoices, review requests, and shop-user invitations when that mail is turned on).
- Hold the receptionist conversation and search the knowledge base. Conversation text is sent to Anthropic. Text used for knowledge-base search is sent to OpenAI.
- Protect the service, debug failures, and meet law.
We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not use shop or customer content to train a model of our own. We do not use sensitive information to infer characteristics about a person for advertising.
Conversation text is sent to Anthropic, and text used for knowledge-base search is sent to OpenAI, under those providers' terms.
Cookies and local storage
Staff sign-in uses bearer tokens, not a cookie. The dashboard keeps the access token and the refresh token in local storage so an open tab can refresh the session. Access tokens last about 15 minutes by default. Refresh tokens last about 30 days by default, and are revoked on sign-out, on password reset, and if a revoked token is presented again. There is no advertising cookie and no third-party ad tag in the product.
Call recording
The carrier is SignalWire, for calls, any recording, and SMS. The default greeting tells the caller the call may be recorded. California is an all-party-consent state. The shop is responsible for getting every party's consent before recording, including when the caller is in California or the shop is in California, when a person at the shop answers, and when the greeting is changed. Fieldline stores the recording link, the transcript, and the summary with the shop's account. The audio file is held by the carrier.
Text messages, TCPA, and opt-out
Texts go through SignalWire under the shop's number when the shop has one. The shop must have the consent the Telephone Consumer Protection Act (TCPA) and applicable state law require, and must meet the carrier's A2P 10DLC registration rules, before automated or marketing texts. The product can be set voice-only so that nothing is texted.
Recipients can opt out by replying STOP (and the usual synonyms such as UNSUBSCRIBE, CANCEL, QUIT, and END). Some templates tell them to reply STOP. The shop must include an opt-out path where the law requires one. Fieldline stores the inbound message. It does not keep a separate do-not-text list. The shop must not send another text to a number that has opted out. The carrier may also filter or block traffic, including after an opt-out on a registered campaign.
Retention
We keep information only as long as the purpose, the shop's account, or the law requires.
- Access tokens. About 15 minutes, then they expire.
- Refresh tokens. About 30 days, or sooner if they are revoked. We store the hash, not the token.
- Password-reset tokens. About 30 minutes. We store the hash.
- Shop and customer records, jobs, estimates, invoices, photos, signatures, transcripts, recording links, texts, and the audit log. For the life of the shop's account.
- After the account ends. The shop can ask for an export as the Terms describe. Within 90 days after the account ends we delete the shop's rows from the production database. Copies in host backups remain only until the host's normal backup window ages them out, and those copies are not used to run the product.
- Payment records. Amounts, method, status, and references may be kept for up to seven years where tax or accounting rules require a record. Full card numbers are not stored.
- Security logs. Request logs and rate-limit entries are kept for operations and abuse prevention, not as a customer archive. A security investigation may keep the specific records it needs.
- Call recordings at the carrier. The carrier keeps the audio under its own retention. Deleting the shop's Fieldline row removes our link and our transcript. The shop that needs the audio removed from the carrier must tell us so we can pass that request on.
The shop may ask us to delete a particular customer record sooner, and we will delete it from the production database unless a legal hold applies. The shop is responsible for deciding that the request is valid before it instructs us, except where we must act directly under the law below.
Subprocessors
These vendors process personal information for us. We do not sell the information to them.
- SignalWire. Telephony and SMS. It places and receives calls, sends and receives text messages, and stores call audio and recording files. It receives phone numbers, call audio, recording links, and message content.
- Anthropic. AI processing for the receptionist conversation. It receives the conversation text needed to reply.
- OpenAI. AI processing for knowledge-base search. It receives the text that is embedded and searched.
- ElevenLabs. Voice. When a reply is spoken through ElevenLabs, it receives the text of that reply. Calls currently fall back to SignalWire's built-in voice.
- Railway. Hosts the service and the database. The service data is stored there.
- Vercel. Hosts the website and the dashboard. Browser requests for those sites, including IP addresses in the host's logs, go to Vercel. The database does not.
- Resend. Email. It receives recipient addresses and the content of messages we send, including password resets, shop-user invitations, estimates, invoices, review requests, and inquiries from this website.
Not in this list today. QuickBooks (Intuit) is a simulated sync. Customer and invoice data is not sent to Intuit. A card processor is not connected, and card numbers are not collected. Either one will be added here, by name, before data is sent.
The shop's own tools that the shop connects, and the carriers that deliver a text to a handset, also see the content required to complete that delivery.
Security
We use measures that fit a multi-tenant application:
- HTTPS for the dashboard and the API.
- Database connections use TLS when the host URL requires it. On the host's private network the connection may be inside that network.
- Passwords hashed with bcrypt. Refresh tokens and password-reset tokens stored as hashes.
- Short-lived access tokens. Reuse of a revoked refresh token revokes that user's sessions.
- Forced row-level security so a query with no shop selected sees no tenant rows, and one shop's request does not read another's.
- Signed webhooks for the carrier, and a shared secret on the lead webhook.
- Rate limits, including on sign-in.
- Security headers on API responses, and an audit log that omits password hashes and signature images.
- Production startup refuses placeholder secrets, an open cross-origin setting, a database role that bypasses row-level security, and a legal identity that still contains a fill-in marker.
No method is perfect. The shop should send portal and estimate links only to the right person, and staff should sign out on shared devices.
Sale and sharing
We do not sell personal information. We do not share personal information as those words are defined in the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). "Share" there means sharing for cross-context behavioral advertising. Subprocessors above are service providers. They are not a sale and not a share.
We do not offer a financial incentive for personal information.
California privacy rights
This section is for California residents. It covers shop staff, whose business we are, and the shop's customers, whose information we hold as a service provider.
Subject to the law and to verification, a person may:
- Know the categories and specific pieces of personal information we hold about them, the sources, the purposes, and the categories of service providers.
- Delete personal information, subject to exceptions (for example, a record we must keep for tax, security, or a legal claim).
- Correct inaccurate personal information.
- Opt out of sale or sharing. We do not sell and we do not share, so there is no sale or share to turn off. Saying so here is how we honor the right.
- Limit use of sensitive personal information. The sensitive information we hold is account credentials (as hashes), the contents of text messages and email we send, and call audio, recording links, and transcripts. We use it only to provide the service the shop asked for and to secure accounts. We do not use it to infer characteristics. A request to limit that use will be honored. Because we already limit it to the service, the product will work the same way after the request.
- Non-discrimination. We will not deny the service, charge a different price, or provide a different quality because someone exercised a privacy right. A shop's unpaid fees are not a privacy penalty.
How to ask. Email arnold_morales@icloud.com with the subject "California privacy request." Include the name, the email or phone on the record, whether the person is shop staff or a customer of a shop, and the shop's name if known. We will verify the request to a reasonable degree, which may mean matching the request to the account or asking the shop to confirm a customer request. An authorized agent may submit a request with proof of authority; we may still ask the person to confirm.
We respond within 45 days. If we need another 45 days, we will say so in the first 45, with the reason.
Customers of a shop. The shop is the business for that information. The customer can ask the shop directly, and the shop can tell us what to delete or correct. If the customer emails us, we will help the shop complete the request, or we will act ourselves when the law requires a service provider to do so. We will not punish a shop because its customer made a request.
We do not knowingly sell or share the personal information of anyone under 16.
Children
Fieldline is a tool for field-service businesses and their staff. It is not directed at children under 16, and we do not knowingly collect personal information from them. The shop must not create a customer record about a child. A household address that belongs to an adult customer is not, by itself, a child's record. If we learn we have information from a child under 16, we will delete it. Email arnold_morales@icloud.com if you believe we have.
Changes to this policy
We will post changes on this page and change the effective date. If a change materially changes how we use personal information, or materially reduces a right described here, we will notify shop admins by email or in the product before the new date, when we have an email on file. A shop that does not agree should stop using Fieldline and ask for the export described in the Terms.
Contact
North Crest Ventures LLC
Email arnold_morales@icloud.com with privacy requests and questions about this policy. The Terms of Service is on this site.