Privacy, do-not-contact and rights requests

Two different things get confused here, so they are separated first. The campaign is responsible for the people in its file: what it collects, who may see it, and what it does when somebody asks to be left alone. Field OP is the software the campaign runs, and is responsible for the platform itself and for what it holds about the people who use it. The privacy notice is the full version — the app carries it too, under Settings → Privacy Notice, readable with no signal — and this page is what to do in the product.

Somebody asks not to be contacted

On a person's record, What they asked us not to do is where an instruction is recorded. Two kinds are offered:

Do not contact me at all.
Do not contact me on one channel — e-mail, text message, telephone, messaging, action updates, fundraising, volunteering, or in general.

Both ask for a reason, and the reason is kept.

The door is not on this panel, and that is the important part

A person-level instruction does not take a door off a walk list. The door belongs to the household, not to one resident, so the household's own state is shown first on the panel with a link to it. Somebody who says "do not knock here" is recorded against the door, and then the door is off every universe, every walk list and every phone.

What each instruction actually stops today

The product says this on the screen and it is worth repeating, because the honest answer is narrower than the words suggest:

Do not knock (on the household) — off every universe, every walk list and every phone.
Do not contact at all, and the safety, legal and deceased kinds — keeps the person out of any target list, and stops the shift confirmations and reminders Field OP sends. It does not stop a door being walked. If that is what somebody meant, record it on the household as well.
Do not contact by e-mail — target lists, plus those same shift messages.
Any other channel — keeps them out of a target list. Field OP sends nothing on those channels today, so nothing else changes yet.

Lifting one

Lifting an instruction needs the right to do it, a liftable row, and a written reason, and the console warns you first. Safety, legal and deceased instructions can never be lifted, and they can never be recorded from this panel either. A lifted row stays on the screen with who lifted it, when, and why — the history is not tidied away.

Someone asks what the campaign holds about them

There is no rights-request workflow in Field OP. No queue, no form, no timer. A campaign that receives an access, correction or deletion request handles it as its own obligation, using what the product does have:

The person's record shows everything held about them: the facts, where each came from, who last changed it, and the whole timeline of conversations.
Sources and changes answers "where did you get this?" for each fact.
Admin → Export produces a file for a named purpose, one set of columns at a time.
What they asked us not to do records the instruction that came with the request.
The audit log records what the campaign did about it. A tenant administrator reads it in the console or in the app under More → Admin → Audit log; either way an event shows who, when and the shape of the change, never the content of a record.

Deciding what the law requires, and answering inside the time it allows, is the campaign's. Field OP does not do it for you and does not pretend to.

What Field OP holds about the people who use it

If you sign in to the console or the app, Field OP holds your name, e-mail address and phone number; your role and which campaigns you belong to; your shift sign-ups and availability; and a record of what you did in the platform — including, if you canvass, which doors you walked and when.

That record cannot be edited or deleted. It exists so the campaign can answer for how people's data was handled, and it is also a record about you. You are shown all of this at your first sign-in, and you can read it again any time from Settings.

Your sign-in is held by Google Cloud Identity Platform, which processes it outside Canada. Field OP does not hold your password.

The mail Field OP sends

Field OP sends eight kinds of message itself: a staff invitation, the welcome to a new organization, a password-reset link an administrator asks for, a request to an administrator to approve a grant, a notice to administrators about the organization's billing, a confirmation and a reminder for somebody on a shift, and an alert to the people running a canvass when a volunteer on it asks for help. They go through Google's mail service, which handles them outside Canada, so a shift message takes the volunteer's address, the shift's time and meeting point and up to 500 characters of the shift's notes with it, and a call-for-help alert takes the volunteer's name, the time, and the campaign, canvass and turf — never what the volunteer wrote and never a location. Every message says it was sent by Field OP for your organization, why the person received it, and where to ask; a shift message also says how to stop them.

The call-for-help alert goes to the lead of the volunteer's canvass and to the campaign's managers, field leads and organizers, at the address each of them signs in with. It is not marketing and has no unsubscribe: it reaches them because they run the canvass. It is sent whatever instructions about mail anybody has given the campaign and whatever the organization's sending limit, and no more than twenty calls for help a day go to one address.

A message is not sent, and the reason is recorded, when the person has asked not to be contacted by e-mail; when their address came from an imported list and they have not themselves signed up at a stall for the campaign or agreed to e-mail — and, for now, whenever their address came from an imported list and they said yes to the shift in the app themselves, because the app cannot read their sign-up or their agreement on their behalf (when a manager records the same yes, both are read and the message goes if either is there); when the receiving mail server says the address does not exist — the address is then marked as bouncing and not tried again; or when your organization has reached its sending limit for the hour or the day. A billing notice and a request to approve a grant are sent even then, because they are the messages an administrator cannot miss; like everything else, no more than twenty a day go to one address. Admin → Who can sign in shows, beside each invitation and each member, whether the last message was handed to the mail service or why not. The shift roster shows whether a confirmation and a reminder went, and if one was not sent, why.

Questions about your own account go to privacy@fieldop.ca.

Where you are

Field OP does not track where anybody is. The app can draw your own position on the turf map so you can find the next door; it is drawn on your screen from your phone's own sensor, it is never sent to the campaign, it is never stored, and there is no part of the platform that would accept it. Decline the location permission and everything else works the same. The safety board a manager watches carries no location either.

Copies of the data, and who has them

Every copy the campaign makes is recorded: an export file, a printed walk sheet, a mission bundle on a volunteer's phone. Each one also records what kind of software took it — the phone app, a web browser, or the console — so that the register says where a copy went and not only that one was made. Admin → Custody is that register, and it leads with the copies held by somebody who never signed an acknowledgement. Closing out a source produces a certificate of what was outstanding and who held it — it records, it does not destroy, and the screen says so.

A restricted voters' list adds a signature before anybody touches it: the person running the import acknowledges custody in their own name, and a volunteer whose mission draws on that list signs an undertaking on their own phone before the mission will open. Nobody can sign either one on somebody else's behalf.

Cookies

The console sets no cookies and loads nothing from a third party, which is why there is no cookie banner anywhere in it. That is asserted by a test in a real browser on every change, not a promise somebody remembers to keep.

Next: Labels and what they mean · Billing and plans · Getting help