Field OP — Privacy Notice

Version: 1.0-draft Published at: /privacy and /privacy/1.0-draft Effective: not in force. A version that is not a draft takes effect on publication.

This version is engineering's, and it is not in force. It was corrected on 17 September 2026 by checking every sentence about what the platform does against the code that does it. No lawyer has reviewed it, nobody has been asked to accept it, and it stays a draft — the page carrying it says so before the text — until a version counsel has cleared replaces it.

1. Who we are

Field OP is a field platform for Canadian political campaigns. It is operated by Gestalt Communications Inc., a company incorporated federally in Canada, with its office in Toronto. Field OP is a product of Gestalt Communications Inc.; it is not a separate company. Where this notice says "we", it means Gestalt Communications Inc.

Each campaign, party association, advocacy organization or third-party advertiser that uses Field OP is a separate organization on the platform. Organizations cannot see each other's data. We call the organization "the campaign" below.

The most important thing to understand about this notice. For the records a campaign holds about members of the public — electors, supporters, the people it knocks on doors to speak to — the campaign decides what is collected and why. We only store and process it on the campaign's instructions. We are a service provider to the campaign, not the organization deciding what happens to your information.

That has a practical consequence, and section 11 sets it out: if you want to know what a campaign holds about you, or want it corrected or deleted, or want the campaign to stop contacting you, you ask the campaign, not us. We will help the campaign answer you, and we will tell you which campaign to ask if you write to us.

For the records we hold about the people who use Field OP — accounts, sign-ins, what somebody did in the platform — we decide what is collected and why, and you can ask us directly.

2. Two groups of people are in Field OP, and they are not alike

Members of the public. Electors and supporters a campaign may contact. You never signed up for Field OP. Your details reached the campaign from an electoral list, from a canvasser writing down a conversation at your door, or from you giving them to the campaign yourself.

People who work on a campaign. Administrators, managers, organizers, volunteers and candidates. You chose to work on the campaign and you hold an account.

Sections 3 and 4 cover the first group. Section 5 covers the second.

3. What a campaign holds about members of the public

A campaign decides which of these it uses. Field OP can hold all of it:

• Your name and basic details. Given, family and preferred names, an honorific, your language, your birth year.
• Ways to reach you. Email addresses and phone numbers, with a note of whether each has been verified.
• Where you live. Street address, unit, municipality, postal code, coordinates; which household you are part of, including past households with dates.
• How a canvasser gets into your building. Buzzer, concierge, key fob, and free-text notes about access.
• An identifier from the source. The elector number or equivalent from the list the campaign obtained.
• Every contact. Each door knocked and call made: the outcome, the volunteer's own written summary of the conversation, the time, and which script and survey version was used.
• What you said. Survey answers, including your level of support and your position on issues.
• Tags and custom fields. Whatever the campaign chooses to record in fields it defines itself.
• Consent. What you agreed to, per channel and purpose, with the exact wording you were shown, when, in which language, and when it expires.
• Do-not-contact instructions. Recorded as a hard rule, not a preference (section 9).
• Restricted details. Date of birth, and sex or gender. These are held apart under a separate permission and never leave the platform onto a volunteer's phone.
• Estimates a model produced about you. Section 7, which is the part of this notice to read most carefully.

What it is used for. One thing: helping a campaign decide who to speak to, speak to them, and record what they said. Field OP is not an advertising platform. Your details are not sold, rented or shared with anyone outside the campaign and the service providers in section 8.

Where it came from is recorded too. Every fact in Field OP is stored as an assertion carrying its source, who recorded it, when, and what it replaced. This is unusual and it is deliberate: when you ask "where did you get that", the campaign can answer.

4. What Field OP deliberately does not hold

Each of these is enforced in the software, not merely intended:

• No payment or financial information about members of the public. There is no donations module.
• No government identifiers beyond an electoral list's own elector number. No SIN, no driver's licence, no health card.
• No cross-site tracking, no device or cookie identity linkage, no commercial data enrichment. We do not buy data about you from anyone and we do not follow you around the internet. The console loads no third-party scripts, and its content-security policy permits only our own API and Google's sign-in service — no advertising, no analytics, no tag manager.
• No cookies. Field OP sets none. The console keeps your sign-in token and your display preferences in your own browser's storage, and neither is sent anywhere except back to our API as your sign-in.
• No voice recording. There is no call recording and no audio anywhere in the platform. Nothing records, stores or transcribes a conversation.
• No restricted details on a phone, ever. The list of fields a phone may carry is a hard limit in the database, and the app refuses and discards a bundle that contains a forbidden field.
• No automatic flow of campaign data into Gestalt's other products.

5. If you work on a campaign

We hold your name, email address and phone number; your role and which campaigns you belong to; your shift sign-ups and availability; and an audit record of what you did in the platform — including, for volunteers who canvass, which doors you walked and when.

Two things worth saying plainly. First, the audit trail is comprehensive and cannot be edited or deleted; it exists so that a campaign can answer for what was done with people's data. Second, it is also a record about you. Field OP does not build volunteer leaderboards and the API has no way to ask for one, but the underlying records exist.

Your password and any second factor are held by Google Cloud Identity Platform, not by Field OP. See section 8; this is one of the six places data is handled outside Canada. If you sign in with "Continue with Google" or "Continue with Microsoft", the sign-in itself happens on Google's or Microsoft's own page and those are two more of the six.

Location

Field OP does not track where volunteers are. The phone app can show you your own position on the turf map so you can find the next door. That position is drawn on your screen from your phone's own sensor. It is never sent to the campaign, never queued, never stored, and there is no endpoint in the platform that would accept it. Background location is switched off on both platforms. If you decline the permission, everything else works exactly the same.

The sentence the app shows you before the system asks is: "Field OP shows where you are on the turf map so you can find the next door. Your location stays on this phone and is never sent to the campaign."

If you sign up to help at a stall or through a public page

You are shown a short collection notice naming the campaign before you type anything, and what we keep is the exact version and wording you were shown, in the language you saw it, with the time. Sending the form is a request to help; a person at the campaign decides.

If you gave an email address, Field OP emails you for the campaign when they accept your offer, and again the day before a shift you are on. Those two messages are the only ones it sends you. If you gave a phone number instead, it sends you nothing at all — the platform does not text.

6. Volunteers, phones and copies of a list

A volunteer canvassing with the app downloads a bundle: a real copy of part of the campaign's data on a personal phone.

• The bundle carries only the fields the campaign opted into, from a fixed short list. Restricted details and inferred estimates are never among them.
• Every copy is recorded in a register with who received it, so a campaign can count outstanding copies at any moment.
• A bundle expires at the end of the canvass window or after 24 hours, whichever is sooner, and the phone purges it 12 hours after that.
• Where the data came from an electoral list, the volunteer must first sign an undertaking that names the source's retention rule and its destruction date, in those words, before the bundle will build.

7. Models, scores and inferred traits

This is the section that needs the most care, and the most honesty.

What the platform does

A campaign using Field OP may use models to help it decide who to speak to first and which version of an approved message a volunteer reads at a door.

The platform computes more than one kind of estimate, and the full list is published in the Inferred Trait Schedule. The one every campaign meets is this: a model reads a person's family name and produces a belief about their language, ethno-cultural community or religion.

The model is our own. It runs inside our own systems on Canadian infrastructure and makes no external call. We do not use any third-party name-classification or demographic-inference service, and the platform forbids one.

These are estimates. They are never facts.

A guess from a name is weakest precisely for the people most often misunderstood: adoptees, converts, people who married across a group, and families longest in the country.

Accuracy is uneven between communities. On the test population the model is right about roughly 88% of names from one community and 62% from another. A single averaged figure would report seventy-eight percent and conceal both ends, so the platform's accuracy report is ordered worst-community-first and never reports one average. Those figures are measured on synthetic data built to be classifiable; a real population is read less accurately, not more.

Religion is answered more cautiously than the others and usually shows a spread rather than one answer. A name can suggest a community. It cannot tell you what somebody believes, or whether they believe anything.

What you say about yourself outranks what the model guessed. If you tell a canvasser your language, that statement is recorded and it overrides the model's belief; the record keeps both, so anyone reading it can see that the model said something else.

What is on, and what a campaign can switch off

Labelling is on by default for a new organization outside Québec, as a matter of platform policy; an organization that gives a Québec address when it signs up starts with it off and with no kind of estimate enabled at all. A campaign administrator can switch it off at any time, and labels stop being produced immediately. Only the kinds of estimate the organization has enabled may be written; the writer refuses any other kind.

Every label carries a marker recording the platform policy, the model and the model version under which it was computed, so that any label can be traced to the rules in force when it was written.

Gestalt does not represent that this feature is lawful in any particular jurisdiction.

Who can see a label

Reading a label is a separate permission from having an account. It requires the Restricted Data grant, which is time-boxed and dual-controlled: it names a second administrator, and the database itself refuses a grant that names the person who requested it or the person who receives it. It carries an expiry and a written purpose, the person issuing it has re-authenticated within the last five minutes, and it is recorded. Naming that second administrator is not the same as asking them: nobody is notified and nothing waits for an answer, and we would rather say so than let the word "approved" imply otherwise. A frontline role — a volunteer, a captain, a candidate — can never see a label, grant or no grant. The database refuses, not just the application.

Low-confidence guesses are stored and never shown. Estimates are never exportable: an export refuses a restricted or inferred class before any grant is considered.

What a label is never used for

• No message is ever selected from a trait. A script variant may select only on fields the campaign explicitly opted into carrying, plus the language a person stated. Inferred traits are not on that list and structurally cannot be.
• No one is included in or excluded from contact on a score. The rule language that would let a campaign build a target list from model output is switched off everywhere and matches nobody.
• Using inferred traits to exclude, discourage or suppress contact with a group is prohibited by the Acceptable Use Policy, as is presenting a score to anyone as a fact about them.

How you challenge one

Ask the campaign (section 11). A human can confirm, correct, reject or disable any label. A correction is written as a new record that supersedes the old one, carrying the model's own record with it, so a rejected guess never comes back from the same model version. Nothing is overwritten and the history stays readable.

What the model learns from, across campaigns

When someone tells a canvasser their language and the model had guessed, the platform counts the pair — what the model said, and what the person said. These are counts only: no person, no name, no record identifier. By default those counts are pooled across every campaign on the platform so the model's calibration improves for everyone; a campaign can opt out and then learns only from its own counts. If a campaign leaves, its counts stay in the pool with nothing saying whose they were, unless it chose to have them deleted.

8. Who else handles the data, and where

Everything in Field OP runs on Google Cloud in Toronto. The database, the API, the console and file storage are all in Canada. AI inference runs in Montréal. One Google timer service runs in Montréal because Google does not offer it in Toronto; it holds a schedule and a job name, and no data.

Our map is served from our own storage rather than a third-party tile service, on purpose: a map tile request would tell an outside company which neighbourhood a campaign is working.

Six exceptions, where data is handled outside Canada. The rule is not repealed; it is being spent deliberately, six times, and each one is named here:

None of these carries voter data. No elector, supporter or contact record is in any of them. The two sign-in providers began operating on 17 September 2026 and concern only people who work on a campaign: choosing one of them sends you to Google or to Microsoft to sign in, and sends them nothing about anybody else.

Other companies appear in our sub-processor register but hold no personal data: GitHub holds our source code, and the phone app's build service holds the app's own source. Some destinations in the register are approved and not in use.

Google's default log buckets are global rather than Canadian. Operational logs are scrubbed of personal details before they are written — by field name and by value shape, so names, addresses, email addresses, phone numbers, postal codes and tokens are redacted wherever they appear.

What we do not do. We do not send campaign data to any general-purpose language model. Nothing in the platform calls one. If that is ever built, the destination will be listed in the sub-processor register before it is used.

9. Your choices

Do not contact me. A do-not-contact instruction is a hard rule in Field OP, not a preference. There is one definition of it in the platform and every place that decides contact shares it — when a target list is built, when a walk list is built for a phone, and on any message sent — and it carries to the household where that is what was asked. There is no override. Tell the campaign (section 11).

Consent. Where a campaign relies on your consent, what you agreed to is recorded with the exact wording you were shown and can be withdrawn. A withdrawal is a new record that supersedes the old one; nothing is quietly edited.

10. How long things are kept

We will not tell you that data is deleted on a schedule, because it is not. Here is what is actually true:

• Electoral lists carry their own retention rule and destruction date, taken from the source. Anyone who takes a copy signs an undertaking naming both.
• Every copy drawn from a source — an export, a printed walk sheet, a phone bundle — is recorded with who received it.
• Exports are downloadable once, by the person who asked for the export and by nobody else, and expire after 24 hours. The record that the export happened outlives the file.
• Phone bundles: see section 6.
• Sign-in sessions end after 12 hours. Two things a phone does are exempt, by name and for a reason: uploading the conversations recorded at doors, and reporting a safety event. A volunteer who cannot re-authenticate from a basement must not lose a day's work, and a person in trouble is never asked to sign in again.
• Deletion inside the platform marks a record deleted and keeps it. The application cannot hard delete: that permission is revoked at the database across the tables that hold campaign data.
• Some records can never be deleted, on purpose: the audit trail, custody undertakings and destruction certificates. They are the evidence that the rest was handled properly, and erasing them would destroy the accountability they exist to provide.
• When a campaign's subscription ends, it has thirty days to export. After that we delete or de-identify its data within ninety days, except for the records above and anything subject to a legal hold.

[NOT YET BUILT — 17 Sep 2026] The thirty days and the ninety days are the intention, not a description. There is no wind-down path in the platform at all: nothing marks a subscription as ended, nothing opens an export window, and nothing deletes or de-identifies an organization's data when it closes. The export itself is built and works today. The promise is kept here because it is meant, and marked because the mechanism behind it does not exist.

The honest gap. Carrying out a destruction is not built. The platform records the undertaking, tracks every copy, and can produce a certificate stating what was outstanding and who held it at a moment in time — and that certificate says in terms that it is not evidence anything was destroyed. Actually destroying copies and collecting each holder's written confirmation is the campaign's own responsibility.

11. Asking us, or asking the campaign

If you are a member of the public and want to know what is held about you, have it corrected, object to an estimate about you, ask not to be contacted, or ask for your record to be deleted — ask the campaign. They decide; we hold the data for them. There is no self-service portal for members of the public, and we will not answer for a campaign as though the decision were ours.

If you do not know which campaign to ask, write to us at the address in section 14 and we will tell you who to contact.

What the campaign can actually do, so you know what to expect. Campaign staff with the right permission can show you your record, every fact with its source, and your contact history; correct a fact, which writes a new entry and supersedes the old one; record a withdrawal of consent; record a do-not-contact instruction; reject or disable a model's estimate about you; and export your record. What they cannot do is erase the audit trail or the custody evidence.

If you work on a campaign, the same route applies for the records the campaign holds about you. For your sign-in account itself, write to us.

If you are a campaign and need us to act — an export, a deletion, a support question, or a request passed on from someone you contacted — write to us and we will act on your instructions.

How long we take. For records we are accountable for, we respond within thirty days of receiving a request, and will tell you if we need longer and why.

12. How the data is protected

Stated conservatively. Each of these is enforced and tested:

• Campaigns are separated at the database. A software bug cannot read across campaigns, because the database refuses, not because the code remembers to check.
• Permissions come from a closed list. A campaign cannot invent a permission level.
• Dangerous powers are separate, expiring grants, dual-controlled — the database itself refuses a grant that names the person who requested it or the person who receives it — and not part of anyone's role. Nobody is asked to approve one: the control is in who may be named, not in anybody's consent.
• Restricted details never reach a phone, by construction.
• Phone bundles are signed, and the app opens only a bundle whose signature checks out.
• Sensitive acts need a fresh sign-in. Exporting people, changing permissions and signing a destruction certificate each require re-authentication less than five minutes old.
• The audit trail records what changed, by whom, and the shape of the change — never the content. Not a name, not a contact detail, not what someone said at a door. This is checked automatically on every change to the software, over every audit record the system can write, and the build fails if a new one would carry content.
• Encryption in transit and at rest.

What we will not claim. There has been no penetration test. There is no SOC 2 or equivalent attestation.

If there is a breach. Where a breach of our security safeguards affects a campaign's data, we notify that campaign without undue delay and give it what it needs to meet its own obligations. We keep a record of every such breach. Where we are required to report to a regulator or to notify individuals directly, we do.

13. Benchmarks

We may produce de-identified aggregate benchmarks — how campaigns perform operationally, never who they support, never anyone's characteristics, never a campaign's strategy.

There is no benchmarking feature today. Nothing in the platform computes a benchmark and nothing shows one. This section reserves a permission; it does not describe something running. If we build it, it will require a minimum cohort and will suppress any cohort that could identify a campaign, and this notice will then say so as a description rather than an intention.

14. Contact

Questions about a campaign's use of what you gave it go to that campaign.

Questions about the platform, about this notice, or about which campaign to contact:

Gestalt Communications Inc. [Postal address] Attention: [Privacy Officer name and title] privacy@fieldop.ca

15. Changes to this notice

A new version of this notice is a new version, never an edit to this one. Versions are addressable and stay addressable, because records of what someone was shown have to keep meaning what they meant on the day.

Field OP is a product of Gestalt Communications Inc.