Privacy Policy

Last updated: October 15, 2026

1. Who we are

Field Cost Tracker is operated by 999 Solutions (KvK number 42072621), with its postal address at Torenlaan 5, 1402AT Bussum, the Netherlands ("we", "us", "our").

For questions about this policy or your personal data, contact us at support@fieldcosttracker.com.

2. What data we collect

We collect and process the following categories of personal data:

• Account data — your name and email address. You provide these when you sign up with an email address and password, or we receive them from Google if you choose to sign in with Google. If a team member invites you, they provide your email address, and optionally your name, when sending the invitation. If you set a password, we store only a one-way cryptographic hash of it, never the password itself.
• Job and cost data — job names, client names, budgets, cost entries, and time entries you create in the app.
• Receipt and invoice files — photos, images and PDF files of receipts and supplier or subcontractor invoices you upload. These may contain vendor names, addresses, purchase details, payment information, invoice numbers, tax registration numbers, and bank details. Invoices usually also show your own business name and address as the customer.
• Usage data — your IP address, timestamps of your actions (e.g. when you last synced), device type, and browser information sent automatically with requests.

3. Why we collect it (legal basis)

We process your data on the following legal bases under GDPR:

• Contract performance (Art. 6(1)(b)) — processing necessary to provide the Field Cost Tracker service: storing your jobs, costs, receipts, invoices, and time entries.
• Legitimate interest (Art. 6(1)(f)) — usage analytics to improve the service, security monitoring, and fraud prevention.
• Consent (Art. 6(1)(a)) — where applicable, for optional features such as marketing communications. You can withdraw consent at any time.

4. How we use receipt and invoice files

When you upload a receipt or invoice, our server sends the file (a photo, image, or PDF) to a third-party AI service to extract structured data (document type, vendor name, invoice number, date, line items, taxes, totals). To tell the vendor apart from the customer, your business name is sent along with it. The file is transmitted securely and is used solely for this extraction. We do not use your receipts or invoices to train AI models. Our AI provider's data processing terms apply to this processing.

You can also have your own private email address for receipts and invoices, and forward supplier emails to it. An email sent there is read the same way as an upload: we take the attachment and send it to the same AI service. Nothing is recorded as a cost until you confirm it.

If you turn on forwarding of failed emails, an email we could not read is sent on to the account owner — and to admins, if you choose that option — at the email addresses on their accounts. The whole original email goes, including its attachments, because the point is to put it in a mailbox you can actually read. This is off unless you switch it on, and by default it switches itself off again after 3 days.

5. Service providers (data processors)

We use the following third-party service providers to operate Field Cost Tracker:

• Google (optional sign-in) — if you choose to sign in with Google, Google authenticates you via OAuth and shares your name and email address with us. Subject to Google's Privacy Policy. You do not need a Google account to use Field Cost Tracker.
• Email delivery provider (transactional email) — sends account emails on our behalf, such as email verification, password resets, and team invitations. Receives your email address and the content of those emails.
• AI processing provider (receipt and invoice processing) — processes receipt and invoice files to extract structured data. Bound by a data processing agreement that prohibits use of your data for model training.
• Cloud and hosting providers (infrastructure) — host the application, backend API, database, and stored files (including receipt and invoice files). Bound by data processing agreements as required by GDPR.

All service providers are bound by data processing agreements (DPAs) as required by GDPR Article 28.

6. Data storage and retention

• Account data — retained for as long as your account is active. Deleted within 30 days of account deletion.
• Accounts whose plan has ended — when a free trial or a subscription ends, the account becomes read-only. It is deleted, with everything in it, 90 days later. We email the account owner a week before, and subscribing in the meantime keeps everything.
• Job and cost data — retained for as long as your account is active. Soft-deleted data is permanently purged within 90 days.
• Receipt and invoice files — retained for as long as the associated job exists. Deleted when you delete the receipt or invoice, or your account.
• Unverified sign-ups and one-time links — if you start signing up but don't confirm your email address, the pending sign-up (name, email address and password hash) expires after 24 hours. Password reset links expire after 1 hour. Both are single-use and are deleted within 30 days.
• Emails you forward to your intake address — the original email is deleted as soon as we have finished reading it, normally within seconds. We do not keep a copy of it.
• Records of emails that produced no document — when an email can't be turned into a receipt or invoice, we keep a short record so you can see what happened: who sent it, the subject, when it arrived, the reason, the names and sizes of any attachments, and roughly the first 200 characters of the message. Attachment contents are never kept. These records are deleted after 30 days, along with the daily counts of mail refused at your account's limit.
• Where an emailed document came from — when an email does produce a receipt or invoice, the sender, subject and date it arrived are stored on that document and kept for as long as the document is, which outlives the 30 days above.

7. Data transfers outside the EU

Some of our service providers are based in the United States. Data transfers to the US are protected by the EU–US Data Privacy Framework (where the provider is certified) or by Standard Contractual Clauses (SCCs) included in our DPAs.

8. Your rights

Under GDPR, you have the right to:

• Access — request a copy of all personal data we hold about you.
• Rectification — correct inaccurate data.
• Erasure ("right to be forgotten") — request deletion of your data.
• Data portability — receive your data in a structured, machine-readable format.
• Restriction — restrict processing of your data in certain circumstances.
• Object — object to processing based on legitimate interest.
• Withdraw consent — where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at support@fieldcosttracker.com. We will respond within 30 days as required by GDPR.

9. Cookies and local storage

Field Cost Tracker does not use tracking cookies or third-party analytics cookies. We use browser local storage (IndexedDB) to enable offline functionality — this is strictly necessary for the service to work and does not require consent under the ePrivacy Directive. Authentication tokens (JWTs) are stored in local storage to keep you signed in.

10. Security

We protect your data with encryption in transit (TLS/HTTPS), encryption at rest for stored files, and access controls on all systems. Our application enforces multi-tenant data isolation — you can only access data belonging to your account.

Passwords are never stored in readable form: we keep only a salted hash (scrypt), so we cannot see or recover your password. Password sign-in attempts are rate-limited to protect against guessing. Changing or resetting your password signs you out on all your other devices.

11. Children

Field Cost Tracker is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children.

12. Changes to this policy

We may update this privacy policy from time to time. We will notify you of significant changes by email or through the application. The "last updated" date at the top of this page indicates when the policy was last revised.

13. Supervisory authority

If you believe we are processing your data unlawfully, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.