Fieldy

GDPR overview

The GDPR is addressed explicitly, though the site never uses the compliance label itself. The privacy policy, effective 27 August 2026, grants rights of access, rectification, erasure, objection, restriction and portability to people in the EEA, the United Kingdom and California, exercised by email to hey@fieldy.ai, with a right to complain to the local supervisory authority. Voice profiles are treated as special category biometric data, processed on explicit consent under Article 9(2)(a) and withdrawable in the app at any time. Vendors are designated as processors under the GDPR and service providers under the CCPA, barred by contract from using the data themselves. A cookie banner runs where required, with no analytics or marketing cookies before consent, and a DPA is standard for organization accounts. Two gaps: no Article 27 EU representative is named, and transfers to the United States rely on unspecified appropriate safeguards.

Who owns the data?

Section 4 of the terms of service is explicit: you keep your rights to the content you record and create with the service. Fieldy takes only the limited licenses it needs to operate the service for you, namely storing, transcribing, indexing and processing that content. Transcripts can be exported from the app at any time, and the account can be deleted from Settings > Delete Account or by writing to hey@fieldy.ai. One exception deserves attention: where the device is used through an organization account, a separate agreement may give the employer access to both transcripts and audio recordings, although data drawn from Google services is never included in what is handed over.

Reuse rights

Users may reuse their own material freely, without asking permission: transcripts can be exported, copied, shared through a revocable link or pulled out through the public API. On Fieldy's side, the stated uses are narrow. Audio goes to transcription providers (ElevenLabs or Soniox) or to in-house models and is then deleted; the resulting text is processed by Anthropic, OpenAI and Google Vertex AI to produce summaries and answers, and by Cohere to build the embeddings behind the private search index. All of these act as service providers and are contractually barred from training or improving their own models on that data. The policy states plainly that personal information is not sold and is not used to train generalized AI models. Voice recognition profiles are treated as biometric data and created only after separate explicit consent in the app. Content from connected services such as Gmail, Calendar, Notion, Drive and Slack is used solely for features aimed at the user, never for advertising and never resold; IP addresses serve order fraud screening and currency conversion. Marketing emails require explicit opt-in and carry open-tracking pixels.

Data retention & training

Hosting summary

The privacy policy, effective 27 August 2026, is unambiguous: servers are currently hosted in the United States. Its hosting and infrastructure section names the providers behind that stack, namely Railway, Google Cloud, Neon, Cloudflare R2, Turbopuffer and Modal, covering cloud hosting, databases, object storage, search indexing and sandboxed compute, all located in the United States. Data is encrypted in transit and at rest. International transfers are acknowledged and said to rely on appropriate safeguards, but no mechanism is named: neither standard contractual clauses nor a Data Privacy Framework certification. The FAQ tells a different story, describing SOC 2 certified data centers in both the United States and the EU, with a region chosen by the user that the data never leaves. Both statements cannot be current at once, and the site offers no way to reconcile them. A buyer with residency requirements should obtain written confirmation before ordering. Note also that SOC 2 is invoked for the data centers, not for Fieldy itself.