Xanivar Field

Field: Privacy Policy

Effective date: 25 August 2026 Last updated: 11 October 2026

Final draft for review by Xanivar Labs' legal counsel prior to publication. Items in [brackets] are to be completed by Xanivar Labs.

This Privacy Policy explains how Xanivar Labs Pte. Ltd. (UEN 202607828N), a company incorporated in Singapore with its registered office at 160 Robinson Road, #14-04 Singapore Business Federation Center, Singapore 068914 ("Xanivar Labs", "we", "us", or "our"), handles personal data in connection with Field, our field-workforce management service available at field.xanivar.com and through our mobile applications for iOS and Android (the "Service").

We handle personal data in accordance with the Singapore Personal Data Protection Act 2012 ("PDPA") and, where it applies, the EU General Data Protection Regulation ("GDPR") and the UK GDPR.

1. Our roles, please read this first

Field is a business tool used by organisations ("Customers") to manage their field workforce. Personal data flows through Field in three different ways, and our responsibilities differ in each:

• When we act as a processor (on a Customer's behalf). Your employer's operational records in Field, jobs, schedules and rosters, timesheets, visits, quotes and invoices, their own customers' details, and the notes and media captured in the course of that work, are put into Field by the Customer. For that data, the Customer is the data controller and we act as their data processor. We process it only to provide the Service and on the Customer's instructions. If you are a worker and have questions about that data, contact your employer; their own privacy notice governs how they collect and use it, and this Policy is not a substitute for it.

• When we act as a controller. For some personal data we determine why and how it is processed, for example, data about the person who registers or administers a Customer account, visitors to our website, and people who contact us. For that data, we are the controller, and the rest of this Policy explains how we handle it.

• When we act as a controller of your own worker profile. Field gives each worker a profile that belongs to them rather than to any one employer: their identity and contact details, the credentials, licences and training records they hold, and their verified work record. That profile stays with the person as they move between employers, so we do not hold it on any employer's instructions, for that data we are the controller. It records the employer and the shape of the work (dates, hours, counts, and whether attendance was verified). It deliberately does not contain the employer's clients, the premises where work was done, or their pricing or commercial information. When you leave an employer your access to their records ends; your own profile does not.

Where we act as a processor, the relevant Customer's instructions and our Data Processing Addendum govern, and this Policy applies only to the limited extent described.

2. Personal data we collect

Depending on how you interact with Field, we may collect:

Account and organisation data, name, work email, phone number, job role, organisation name, and login credentials for account administrators and Authorized Users.

Worker Data (processed on a Customer's behalf), identity details, country/residency, right-to-work and credential documents, portfolio items, shift and roster data, clock-in/clock-out and time records, task and visit records, and media (such as photos) captured during visits. The Customer decides what to collect.

Location data, where a Customer enables location or visit features, the app may collect device location to record visits or clock-ins. On mobile, this happens only with the operating-system permission you grant, and you can turn it off in your device settings. We do not track location in the background unless the Customer's configuration and your permissions allow it.

Media and device-permission data, where you grant permission, the app may access your device camera and photo library (to capture or upload visit media), microphone (to let you dictate notes using voice-to-text), location (as above), and notifications (to send shift and operational alerts). You control these permissions in your device settings.

Voice / audio input, Field offers a voice-to-text dictation feature for creating notes. Depending on your device and browser, this works in one of two ways: (a) using your browser or device's built-in speech recognition (the Web Speech API), in which case your spoken audio is processed by your browser or operating-system provider (for example, Google for Chrome or Apple for Safari) under their own terms in order to return a text transcript; or (b) using an on-device speech-recognition model that runs locally in your browser, in which case the audio does not leave your device. In both cases, we use the audio only to produce the text for your note; we do not use it to identify you and do not separately store the audio.

Check-in method (QR codes and NFC tags), the Service may let workers clock in or confirm attendance at a site by scanning a QR code (using the camera) or tapping an NFC tag. Scanning or tapping simply records the associated clock-in or visit (for example, the time and, where the Customer has enabled it, the location); it does not collect any personal data beyond what is described above.

Documents and electronic-signature data. Where Field lets you create, send, or sign trade agreements electronically, we record the saved agreement terms and version, recipient email and user identity, typed signer name, consent, signing status, timestamps, and integrity fingerprints. We use our transactional email provider to send agreement notices and a copy of signed terms.

Usage, device, and log data, IP address, device and browser type, app version, pages/screens viewed, actions taken, timestamps, and diagnostic and crash information, collected to operate, secure, and improve the Service.

Third-party software components (SDKs). Our mobile applications may include third-party software components for functions such as crash reporting, diagnostics, analytics, and push-notification delivery. Where used, these may process device and usage data as described in this Policy. [Confirm and list any third-party SDKs actually used, so this and your App Store / Google Play data disclosures stay consistent.]

Support and communications data, information you provide when you contact us, and our correspondence with you.

We do not intentionally collect special-category or sensitive data beyond what a Customer chooses to store (for example, in credential documents). We do not knowingly collect data from children (see Section 12).

3. How we collect it

We collect personal data: (a) directly from you when you register, use, or configure the Service; (b) from your organisation, when it adds you as an Authorized User or uploads data about you; (c) automatically through your use of the Service (usage, device, and log data); and (d) from service providers that help us operate the Service.

4. Why we use personal data (and our legal bases)

We use personal data to:

• provide, operate, maintain, and secure the Service;
• create and administer accounts and authenticate users;
• deliver the workforce features a Customer configures (scheduling, clock-in, visits, credentials, media);
• send administrative, security, service, and, where configured, operational messages;
• provide support and respond to enquiries;
• monitor, troubleshoot, and improve the Service, including diagnostics and analytics;
• prevent fraud, abuse, and security incidents, and enforce our terms; and
• comply with legal obligations.

Where the GDPR/UK GDPR applies to data for which we are the controller, our legal bases are: performance of a contract (to provide the Service you or your organisation requested); legitimate interests (to keep the Service secure, to prevent fraud and abuse, and to operate and maintain it, balanced against your rights, and recorded in a legitimate interests assessment we keep on file); consent (for anything optional, in particular our product analytics, which are never written to or read from your device unless you accept them, and certain communications and device permissions, which you can withdraw at any time in Settings → Privacy); and legal obligation. We do not rely on legitimate interests for optional analytics. Under the PDPA, we collect, use, and disclose personal data for purposes a reasonable person would consider appropriate, with consent (including deemed consent) or as otherwise permitted by law.

We do not sell personal data, and we do not use Customer or Worker Data to build advertising profiles or for third-party advertising.

5. How we share personal data

We share personal data only as needed to run the Service:

• With your organisation (for Authorized Users), and with other users within your organisation as the Customer configures.
• With sub-processors and service providers that help us deliver the Service, under contracts requiring appropriate protection. These currently include:
• Supabase, database, authentication, and hosting;
• Cloudflare (R2), object storage for media and files, and security/bot-protection (Turnstile);
• Postmark, transactional and notification email;
• and other infrastructure, analytics, or communications providers we may engage from time to time. We maintain a current list of sub-processors and will provide it on request; Customers may ask to be notified of changes.
• Payment providers, where you use the Service to issue invoices or take payments from your own customers, that payment is processed by a third-party payment provider; we do not collect or store full payment card details.
• For legal and safety reasons, where we reasonably believe disclosure is required by law, regulation, legal process, or a valid governmental or law-enforcement request, or is needed to protect the rights, safety, or property of Xanivar Labs, our users, or the public.
• In a corporate transaction, in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality.

We do not otherwise disclose personal data to third parties for their own purposes.

6. International transfers and data residency

We host the Service using infrastructure located in Singapore and may process or replicate data in other regions to provide the Service. Where Field offers a data-residency option (for example, storing certain personal data in the European Union), we process that data in the selected region according to the Customer's configuration.

Where personal data is transferred across borders, we use an appropriate safeguard where one is required by law, for example, standard contractual clauses for transfers subject to the GDPR/UK GDPR, and, under the PDPA, we take reasonable steps to ensure a comparable standard of protection for data transferred out of Singapore.

7. EU and UK representative

If we offer the Service to, or monitor the behaviour of, individuals in the European Economic Area or the United Kingdom while acting as a controller, Article 27 of the GDPR and the UK GDPR may require us to appoint a local representative. Our appointed representative and point of contact for data-protection matters is:

• EU representative: [TO BE APPOINTED, must be a person or entity established in an EU Member State where our users are; it cannot be Xanivar Labs or any of its officers]
• UK representative: [TO BE APPOINTED, must be established in the United Kingdom; a separate appointment from the EU representative]

You may contact the representative on any matter relating to our processing of your personal data. [Action: appoint an Article 27 representative, for example through a specialist provider, before serving EU/UK users, and insert the details here.]

8. How long we keep personal data

We keep personal data for as long as needed to provide the Service and for legitimate business or legal purposes.

• For Worker Data and other Customer Data, retention is directed by the Customer. When a Customer's agreement ends, the account becomes export-only for thirty (30) days so the Customer can export their records, and we then delete the data in the ordinary course, subject to legal retention requirements and to backups that are deleted on our normal cycle. We do not delete Worker Profile Data at that point, because it belongs to the individual rather than to the Customer (see Section 1). Reaching it still depends on being able to sign in: if you registered with a work email address and your employer disables it, and you have not added a personal address, you may lose access to your account even though we still hold the record. Add a personal backup email in Settings so that cannot happen.
• For data we control (account admin, website, support), we keep it while your account or relationship is active and for a reasonable period afterwards, then delete or anonymise it.

9. How we protect personal data

We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, authentication, monitoring, and least-privilege practices. No system is completely secure, but we work to protect personal data and will notify affected parties and regulators of a personal data breach where the law requires.

10. Your rights and choices

If you are a worker or Authorized User: which party to ask depends on the data. For your employer's operational records, jobs, timesheets, visits, their customers, your employer is the controller, so direct requests to them and we will assist them as their processor. For your own worker profile, your identity, credentials, training records and verified work record, we are the controller, so you can bring those requests to us directly using the contact details in this Policy.

For data we control, and subject to applicable law, you may:

• Access the personal data we hold about you and ask how it has been used or disclosed (PDPA access right);
• Correct inaccurate or incomplete personal data;
• Withdraw consent to processing that relies on consent (this may affect our ability to provide certain features);
• where the GDPR/UK GDPR applies, additionally request erasure, restriction, portability, or object to processing based on legitimate interests, and lodge a complaint with a supervisory authority.

To exercise these rights, contact us at ops@xanivarlabs.com. We will respond within the timeframes required by law. We may need to verify your identity first.

Marketing. If we send you marketing communications, you can opt out at any time using the unsubscribe link in the message or by contacting us. We will still send essential service, security, and administrative messages.

Communications and permissions. You can opt out of non-essential messages (for example, replying STOP to texts). You can change or revoke device permissions (camera, location, notifications) at any time in your device settings.

11. How to delete your account and data

You can request deletion of your account and associated personal data at any time:

• Account administrators can delete their account and their organisation's data from within the Service, or by contacting us at ops@xanivarlabs.com.
• Authorized Users and workers: your account is managed by your organisation, so please ask your organisation to remove your access and data. You may also contact us and we will forward your request to the relevant Customer.
• You can also submit a deletion request by email to ops@xanivarlabs.com or via https://field.xanivar.com/delete-account.

When an account is deleted, we delete or de-identify the associated personal data within [30] days, except where we must retain it to comply with law, resolve disputes, or enforce our agreements, and except for backups that are deleted on our normal cycle.

This account-deletion route is provided to meet the Apple App Store and Google Play requirements for in-app account deletion. Ensure a working in-app deletion option and a public deletion request URL exist before launch.

12. Additional information for United States residents

If you are a resident of California or another U.S. state with a comprehensive consumer-privacy law, the following applies to personal data we control:

• We do not sell personal information or share website activity for cross-context advertising.
• Subject to law, you may request to know/access, correct, and delete your personal information, and you have the right not to be discriminated against for exercising these rights.
• We honour recognised opt-out preference signals, such as Global Privacy Control (GPC), where required by law.

To exercise these rights, contact us at ops@xanivarlabs.com. An authorised agent may submit a request on your behalf with proof of authorisation.

13. Children

The Service is intended for business use by people who are at least 16 years old (or the minimum working age in their jurisdiction, if higher). We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, contact us and we will take appropriate steps to delete it.

14. Cookies and similar technologies

Field uses cookies and similar device storage. Some of it is strictly necessary: to sign you in and keep you signed in, to keep your session secure, to protect against automated abuse, to remember the cookie choice you make, and to hold your work on the device while you are offline. Field cannot be provided without these, so we do not ask for consent for them.

We also keep aggregate page counts for operational and product-analytics purposes. These counts are recorded server-side only: we do not write cookies or any other storage to your device, we do not store IP addresses, and we do not retain full user-agent strings. The data is non-identifying and used to understand site traffic and search-engine indexing. This processing relies on our legitimate interests in operating and improving the Service.

Separately, we use our own first-party product analytics to understand and improve how Field is used. These are optional. We ask for your consent before any analytics are stored on or read from your device. You can change your choice in Settings, Privacy. Switching analytics off deletes the analytics storage. We do not use advertising tracking on our websites or share website activity with advertising platforms.

Some browsers send a Global Privacy Control signal. We treat GPC as a valid refusal of optional cookies and apply it automatically, without asking you again. Because there is no common industry standard for Do Not Track, we do not respond to DNT headers. Full detail of every cookie and storage item Field uses, what it is, why we use it, and how long it lasts, is in the Field Cookie Policy at https://field.xanivar.com/cookies.

15. Changes to this Policy

We may update this Policy from time to time. If a change is material, we will provide notice (for example by email or in-app notice) before it takes effect. The "Last updated" date above shows when it was last revised.

16. Contact us

If you have questions about this Policy or how we handle personal data, contact:

Xanivar Labs Pte. Ltd. 160 Robinson Road, #14-04 Singapore Business Federation Center, Singapore 068914 Data protection / privacy contact: ops@xanivarlabs.com Data Protection Officer: Yvonne Plaga, Director & Data Protection Officer, ops@xanivarlabs.com

Under the PDPA, organisations in Singapore must designate a Data Protection Officer and publish their business contact information.

This document should be reviewed and approved by Singapore-qualified counsel before publication. It is designed to support the Apple App Store "App Privacy" and Google Play "Data safety" disclosures; ensure those store questionnaires are completed consistently with this Policy, and keep the sub-processor list, SDK list, and data-residency details current.

Terms · Authorized User Terms · DPA · Cookie Policy · Privacy settings · Delete account