Privacy Policy
What we collect, why, who else touches it, and how to get it back or have it deleted.
Effective 31 August 2026
Who is responsible
Kartikeya Mishra (Sole Proprietor) operates FieldPilot and is the data fiduciary for the personal data described here, under India's Digital Personal Data Protection Act, 2023.
TODO: street address
TODO: city, TODO: state TODO: PIN
India
workmailkartikeya@gmail.com
What we collect
- Account data — name, work email, organisation name, role, and a hashed password. We never store your password itself.
- Operational data you create — assets, sites, incidents, measurements, procedures, work orders and outcomes.
- Voice data — audio is streamed to our speech provider during a live session and is not stored by us. The resulting transcript is stored against the session, because it is the record of what was said and why an action was taken.
- Usage and billing data — credits consumed, model calls, costs, and payment metadata such as an order reference and amount.
- Technical logs — request identifiers, timings, error codes. Account identifiers in analytics are salted-hashed, so our analytics tables contain no readable personal data.
We do not collect Aadhaar or any national identifier, and we do not ask for card details — those go to Razorpay directly and never reach our servers.
Why we process it
- To provide the service: identify assets, retrieve history, generate recommendations and record approved actions.
- To keep an audit trail of who did what, which is a core function of the product.
- To meter credits, process payments and prevent abuse.
- To keep the service secure and diagnose failures.
Our lawful basis is performance of the contract with you, together with your consent where the law requires it. We do not use your data for advertising and we do not sell it.
AI processing — stated plainly
When you speak to FieldPilot, audio is streamed to AssemblyAI for transcription. The transcript, the identified asset and a bounded set of that asset's related records are then sent to an AI model provider to generate a recommendation. We deliberately send the minimum context needed — never your whole database.
We do not use your confidential operational content to train general-purpose AI models. Your data is processed to answer your request and is retained under the periods below.
Who else processes your data
| Provider | Purpose | Data |
|---|---|---|
| AssemblyAI | Speech-to-text for live voice sessions | Audio streamed during a voice job, and its transcript |
| LLM provider (via AssemblyAI LLM Gateway) | Generating recommendations from retrieved context | The current transcript, the identified asset and its related records |
| Razorpay | Payment processing | Payment metadata. Card details go to Razorpay directly and never reach our servers |
| Hosting and database provider | Running the application and storing your records | All application data |
Some of these providers operate outside India, so your data may be processed abroad under contractual protections. We will not claim your data never leaves India, because that would not be true.
How long we keep it
- Live audio: not retained by us. It is streamed for transcription and discarded.
- Transcripts, operational records and outcomes: for as long as your account is active, because they are the record your work depends on.
- Audit and payment records: retained after deletion where we are required to keep them for legal, tax or accounting purposes.
- Technical logs: a short operational window, then discarded.
Your rights
Under the DPDP Act you may:
- Access the personal data we hold about you.
- Have inaccurate data corrected, and have data erased where we are not required to keep it.
- Withdraw consent where processing relies on it.
- Nominate someone to exercise your rights if you are unable to.
- Complain to us, and then to the Data Protection Board of India.
You do not need to ask us for a copy: FieldPilot exports your organisation's complete data in one click, with checksums, from inside the product. For anything else, contact our Grievance Officer, Kartikeya Mishra, at workmailkartikeya@gmail.com. We respond within 2 business days.
Security
- Passwords are hashed; sessions are signed and re-verified against the database on every request.
- Each organisation's data is isolated at the database query layer, not merely hidden in the interface.
- Provider API keys stay on our servers. Your browser only receives a single-use token that expires in about a minute.
- Every consequential action is written to an append-only audit log.
No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the Data Protection Board as required.
Children
FieldPilot is a workplace tool and is not directed at anyone under 18. We do not knowingly collect data from children.
Changes
We will update this page when our processing changes, and will notify you of material changes before they take effect.