Field OP — Privacy Notice

Version: 0-draft — engineering's draft, written 15 September 2026 for counsel. Status: not in force. Not published, not legal advice, and not a version any customer has been asked to accept. Address: this document is served at /privacy and at /privacy/0-draft, and its wording is frozen at that address: a correction is the next version, never an edit of this one.

Read this first

This is a draft for counsel. It is not legal advice and it is not a published notice.

It was written by engineering so that counsel has something concrete to react to instead of a blank page. Every statement about what the platform does was checked against the code and the schema on 15 September 2026; where the master specification describes an intention that is not built, this draft says what is true today rather than what was meant.

Counsel's text replaces this document. It is not edited in place: the next version is a new version, because acceptance records name the version and the exact wording hash a person was shown (legal_acceptances, plan B.2).

Three kinds of marker appear below:

• [OPEN — counsel] a question this draft does not answer and must not guess at.
• [GAP — Product Owner] a fact only Bakir Alazawi can supply.
• [VERIFY BEFORE PUBLISHING] a sentence that is true only once work now in the launch plan has merged. Each one is listed again at the end.

1. Who we are

Field OP is a field platform for Canadian political campaigns. It is operated by Gestalt Communications Inc., a company incorporated federally in Canada, with its office in Toronto. Field OP is a product of Gestalt Communications Inc.; it is not a separate company. Where this notice says "we", it means Gestalt Communications Inc.

Each campaign, party association, advocacy organization or third-party advertiser that uses Field OP is a separate organization on the platform. Organizations cannot see each other's data. We call the organization "the campaign" below.

The most important thing to understand about this notice. For the records a campaign holds about members of the public — electors, supporters, the people it knocks on doors to speak to — the campaign decides what is collected and why. We only store and process it on the campaign's instructions. In the language of privacy law we are a service provider to the campaign, not the organization deciding what happens to your information.

That has a practical consequence, and section 11 sets it out: if you want to know what a campaign holds about you, or want it corrected or deleted, or want the campaign to stop contacting you, you ask the campaign, not us. We will help the campaign answer you, and we will tell you which campaign to ask if you write to us.

[OPEN — counsel] Whether Gestalt is a processor or a controller in its own right, and whether this is one notice or two (one for electors, one for campaign workers), is question 2 of the brief already with you. This draft is written as a single notice from Gestalt, describing both populations and routing individual requests to the campaign. If a campaign must issue its own notice, the product has to serve it, and engineering needs to know that.

[OPEN — counsel] Which statute or statutes bind a Field OP campaign, and whether the answer differs by campaign type. Brief §2. Federal parties sit largely outside PIPEDA; British Columbia's PIPA covers political parties; Québec's Law 25 has its own regime; Ontario has no equivalent. This notice does not name a statute anywhere, deliberately.

2. Two groups of people are in Field OP, and they are not alike

Members of the public. Electors and supporters a campaign may contact. You never signed up for Field OP. Your details reached the campaign from an electoral list, from a canvasser writing down a conversation at your door, or from you giving them to the campaign yourself.

People who work on a campaign. Administrators, managers, organizers, volunteers and candidates. You chose to work on the campaign and you hold an account.

Sections 3 and 4 cover the first group. Section 5 covers the second.

3. What a campaign holds about members of the public

A campaign decides which of these it uses. Field OP can hold all of it:

• Your name and basic details. Given, family and preferred names, an honorific, your language, your birth year.
• Ways to reach you. Email addresses and phone numbers, with a note of whether each has been verified.
• Where you live. Street address, unit, municipality, postal code, coordinates; which household you are part of, including past households with dates.
• How a canvasser gets into your building. Buzzer, concierge, key fob, and free-text notes about access.
• An identifier from the source. The elector number or equivalent from the list the campaign obtained.
• Every contact. Each door knocked and call made: the outcome, the volunteer's own written summary of the conversation, the time, and which script and survey version was used.
• What you said. Survey answers, including your level of support and your position on issues.
• Tags and custom fields. Whatever the campaign chooses to record in fields it defines itself.
• Consent. What you agreed to, per channel and purpose, with the exact wording you were shown, when, in which language, and when it expires.
• Do-not-contact instructions. Recorded as a hard rule, not a preference (section 9).
• Restricted details. Date of birth, and sex or gender. These are held apart under a separate permission and never leave the platform onto a volunteer's phone.
• Estimates a model produced about you. Section 7, which is the part of this notice to read most carefully.

What it is used for. One thing: helping a campaign decide who to speak to, speak to them, and record what they said. Field OP is not an advertising platform. Your details are not sold, rented or shared with anyone outside the campaign and the service providers in section 8.

Where it came from is recorded too. Every fact in Field OP is stored as an assertion carrying its source, who recorded it, when, and what it replaced. This is unusual and it is deliberate: when you ask "where did you get that", the campaign can answer.

4. What Field OP deliberately does not hold

Each of these is enforced in the software, not merely intended:

• No payment or financial information about members of the public. There is no donations module.
• No government identifiers beyond an electoral list's own elector number. No SIN, no driver's licence, no health card.
• No cross-site tracking, no device or cookie identity linkage, no commercial data enrichment. We do not buy data about you from anyone and we do not follow you around the internet. The console loads no third-party scripts, and its content-security policy permits only our own API and Google's sign-in service — no advertising, no analytics, no tag manager.
• No cookies. Field OP sets none. The console keeps your sign-in token and your display preferences in your own browser's storage, and neither is sent anywhere except back to our API as your sign-in.
• No voice recording. There is no call recording and no audio anywhere in the platform today. Nothing records, stores or transcribes a conversation.
• No restricted details on a phone, ever. The list of fields a phone may carry is a hard limit in the database, and the app refuses and discards a bundle that contains a forbidden field.
• No automatic flow of campaign data into Gestalt's other products.

5. If you work on a campaign

We hold your name, email address and phone number; your role and which campaigns you belong to; your shift sign-ups and availability; and an audit record of what you did in the platform — including, for volunteers who canvass, which doors you walked and when.

Two things worth saying plainly. First, the audit trail is comprehensive and cannot be edited or deleted; it exists so that a campaign can answer for what was done with people's data. Second, it is also a record about you. Field OP does not build volunteer leaderboards and the API has no way to ask for one, but the underlying records exist.

Your password and any second factor are held by Google Cloud Identity Platform, not by Field OP. See section 8; this is one of the four places data is handled outside Canada.

Location

Field OP does not track where volunteers are. The phone app can show you your own position on the turf map so you can find the next door. That position is drawn on your screen from your phone's own sensor. It is never sent to the campaign, never queued, never stored, and there is no endpoint in the platform that would accept it. Background location is switched off on both platforms. If you decline the permission, everything else works exactly the same.

The sentence the app shows you before the system asks is: "Field OP shows where you are on the turf map so you can find the next door. Your location stays on this phone and is never sent to the campaign."

If you sign up to help at a stall or through a public page

You are shown a short collection notice naming the campaign before you type anything, and what we keep is the exact version and wording you were shown, in the language you saw it, with the time. Sending the form is a request to help; a person at the campaign decides.

If you gave an email address, Field OP emails you for the campaign when they accept your offer, and again the day before a shift you are on. Those two messages are the only ones it sends you. If you gave a phone number instead, it sends you nothing at all — the platform does not text.

6. Volunteers, phones and copies of a list

A volunteer canvassing with the app downloads a bundle: a real copy of part of the campaign's data on a personal phone.

• The bundle carries only the fields the campaign opted into, from a fixed short list. Restricted details are never among them.
• Every copy is recorded in a register with who received it, so a campaign can count outstanding copies at any moment.
• A bundle expires at the end of the canvass window or after 24 hours, whichever is sooner, and the phone purges it 12 hours after that.
• Where the data came from an electoral list, the volunteer must first sign an undertaking that names the source's retention rule and its destruction date, in those words, before the bundle will build.

[OPEN — counsel] Brief §9.1. A bundle sits on a phone the campaign does not own, belonging to someone who is not an employee. What must an elector be told about that, and what must the volunteer undertake beyond the current five clauses?

7. Models, scores and inferred traits

This is the section that needs the most care, and the most honesty.

What the platform does

A campaign using Field OP may use models to help it decide who to speak to first and which version of an approved message a volunteer reads at a door. The estimate this section is mostly about is the one every campaign meets: a model reads a person's family name and produces a belief about their language, ethnic community or faith.

[CORRECTED 15 September 2026 — engineering, on moving this draft into the repository] This paragraph said the platform computes one kind of estimate. It computes two, and its vocabulary holds more. Beside the name model there is residency stability — a rules estimate of whether somebody has likely moved, drawn from what a door said, the person's own address history and a membership that ended — built in September 2026 and computed only for a campaign that switches it on. Contactability and gender are declared in the schema and in the database's own list of permitted kinds, and nothing computes them yet. Counsel is entitled to the whole list rather than the part that prompted the question. docs/legal/Findings.md, finding 2.

The model is our own. It runs inside our own systems and makes no external call. We do not use any third-party name-classification or demographic-inference service, and the platform forbids one.

These are estimates. They are never facts.

A guess from a name is weakest precisely for the people most often misunderstood: adoptees, converts, people who married across a group, and families longest in the country. Accuracy is uneven between communities, and the platform's own accuracy report is ordered worst-community first and never reports a single averaged figure, because an average hides both ends. Faith is answered more cautiously than the others and usually shows a spread rather than one answer.

What you say about yourself outranks what the model guessed. If you tell a canvasser your language, that statement is recorded and it overrides the model's belief; the record keeps both, so anyone reading it can see that the model said something else.

A written legal opinion has been requested and has not yet been filed

Every label the platform writes carries the marker legal_opinion_pending. It means exactly what it says: the label was computed under the platform's default policy, a written legal opinion on this feature has been requested from counsel, and it has not arrived. The setting screen a campaign administrator sees says so too. There is also no privacy impact assessment, no published model card, and no bias evaluation against real data yet. All four are scheduled after launch.

This is a deliberate decision of the Product Owner, taken on 15 September 2026, recorded as decision 64 with its exposure written down rather than glossed.

What is on, and what a campaign can switch off

• Labelling is on by default for a new organization, as a matter of platform policy. A campaign administrator can switch it off at any time, and labels stop being produced immediately.
• [VERIFY BEFORE PUBLISHING] A Québec organization starts with labelling off, pending the Law 25 compliance questions in section 13.
• Only the kinds the platform enables may be written; the writer refuses any other kind.

Who can see a label

Reading a label is a separate permission from having an account. It requires the Restricted Data grant: issued by an administrator, approved by a second administrator who is neither the issuer nor the recipient, with an expiry and a written purpose, re-authenticated within the last five minutes, and recorded. A frontline role — a volunteer, a captain — can never see a label, grant or no grant. The database refuses, not just the application.

Low-confidence guesses are stored and never shown.

What a label is never used for

• No message is ever selected from a trait. A script variant may select only on fields the campaign explicitly opted into carrying, plus the language a person stated. Inferred traits are not on that list and structurally cannot be.
• No one is included in or excluded from contact on a score today. The rule language that would let a campaign build a target list from model output is switched off everywhere and matches nobody.
• Using inferred traits to exclude, discourage or suppress contact with a group is prohibited by the acceptable-use policy, as is presenting a score to anyone as a fact about them.

How you challenge one

Ask the campaign (section 11). A human can confirm, correct, reject or disable any label. A correction is written as a new record that supersedes the old one, carrying the model's own record with it, so a rejected guess never comes back from the same model version. Nothing is overwritten and the history stays readable.

[OPEN — counsel] Brief §6, all five questions, unchanged and still the sharpest thing in these documents. In particular: whether inferring ethnicity, religion or language from a name is special-category processing; whether it requires express consent, which for an elector who never signed up cannot be obtained; whether it triggers automated-decision-making provisions; and what this notice must say, in what terms, and where it must appear.

[OPEN — counsel] The accuracy figures. On synthetic data the model is right about roughly 88% of Urdu names and 62% of Hispanic ones. This draft describes the unevenness without the numbers, because they come from synthetic data and a real campaign cannot reproduce them. Tell us whether the notice should carry figures at all.

What the model learns from, across campaigns

When someone tells a canvasser their language and the model had guessed, the platform counts the pair — what the model said, and what the person said. These are counts only: no person, no name, no record identifier. By default those counts are pooled across every campaign on the platform so the model's calibration improves for everyone; a campaign can opt out and then learns only from its own counts. If a campaign leaves, its counts stay in the pool with nothing saying whose they were, unless it chose to have them deleted.

[OPEN — counsel] Brief §6 question 5. Is the pooled aggregate a processing of personal information at all, and if so on what basis; and does a departed campaign's unattributed contribution raise anything under retention or deletion obligations? This is the platform's one deliberate cross-campaign read and it should be named in the notice on counsel's terms, not ours.

8. Who else handles the data, and where

Everything in Field OP runs on Google Cloud in Toronto. The database, the API, the console and file storage are all in Canada. One Google timer service runs in Montréal because Google does not offer it in Toronto; it holds a schedule and a job name, and no data.

Our map is served from our own storage rather than a third-party tile service, on purpose: a map tile request would tell an outside company which neighbourhood a campaign is working.

Four exceptions, where data is handled outside Canada. Canadian data residency has been set aside through launch by a decision of the Product Owner (decision 61, 14–15 September 2026). The rule is not repealed; it is being spent deliberately, four times, and each one is named here:

None of these carries voter data. No elector, supporter or contact record is in any of them.

Other companies appear in our sub-processor register but hold no personal data: GitHub holds our source code, and the phone app's build service holds the app's own source. Some destinations in the register are approved and not in use.

[VERIFY BEFORE PUBLISHING] — the engineering half is done; the confirmation is not. This gate read, until 15 September 2026: "The register carries rows for Identity Platform and the default mailer today… this notice must not go live naming four exceptions while the register names two." Both missing rows were written the same day, under story 0.12.2, so the register and this section now name the same four. What is still owed is the Product Owner's confirmation of the relay row's contents, because he is the person who set the relay up — B-42 — and counsel's view on whether a US processor of a customer's own commercial details (Stripe) belongs in the same list as a processor of campaign data at all.

[OPEN — counsel] Google's default and required log buckets are global rather than Canadian, and the launch plan's §C.5 lists "the global default log bucket" beside the four above. Operational logs are scrubbed of personal details before they are written — by field name and by value shape, so names, addresses, emails, phone numbers, postal codes and tokens are redacted wherever they appear — and a Toronto log bucket with a project sink is planned. Tell us whether this belongs in the table above, in a sentence of its own, or nowhere.

[OPEN — counsel] Brief §4. Whether a cross-border transfer disclosure applies and at what level of specificity, and whether a data processing agreement between Gestalt and each campaign must be referenced here.

What we do not do. We do not send campaign data to any general-purpose language model today — nothing in the platform calls one. When that is built, the approved destination is a Canadian region in Montréal with a machine-learning processing guarantee, and it will be listed here first.

9. Your choices

Do not contact me. A do-not-contact instruction is a hard rule in Field OP, not a preference. There is one definition of it in the platform and every place that decides contact shares it — when a target list is built, when a walk list is built for a phone, and on any message sent — and it carries to the household where that is what was asked. There is no override. Tell the campaign (section 11).

Consent. Where a campaign relies on your consent, what you agreed to is recorded with the exact wording you were shown and can be withdrawn. A withdrawal is a new record that supersedes the old one; nothing is quietly edited.

10. How long things are kept

We will not tell you that data is deleted on a schedule, because it is not. Here is what is actually true:

• Electoral lists carry their own retention rule and destruction date, taken from the source. Anyone who takes a copy signs an undertaking naming both.
• Every copy drawn from a source — an export, a printed walk sheet, a phone bundle — is recorded with who received it.
• Exports are downloadable once and expire after 24 hours. The record that the export happened outlives the file.
• Phone bundles: see section 6.
• Sign-in sessions end after 12 hours whatever you are doing.
• Deletion inside the platform marks a record deleted and keeps it. The application cannot hard delete: that permission is revoked at the database across the tables that hold campaign data.
• Some records can never be deleted, on purpose: the audit trail, custody undertakings and destruction certificates. They are the evidence that the rest was handled properly, and erasing them would destroy the accountability they exist to provide.

The honest gap. Carrying out a destruction is not built. The platform records the undertaking, tracks every copy, and can produce a certificate stating what was outstanding and who held it at a moment in time — and that certificate says in terms that it is not evidence anything was destroyed. Actually destroying copies and collecting each holder's written confirmation is a later release.

[OPEN — counsel] How the notice should describe the immutable records, and what a campaign must be told about the destruction gap. Brief §5 and §7 question 2.

11. Asking us, or asking the campaign

If you are a member of the public and want to know what is held about you, have it corrected, object to an estimate about you, ask not to be contacted, or ask for your record to be deleted — ask the campaign. They decide; we hold the data for them. There is no self-service portal for members of the public, and we will not answer for a campaign as though the decision were ours.

If you do not know which campaign to ask, write to us at the address in section 14 and we will tell you who to contact.

What the campaign can actually do, so you know what to expect. Campaign staff with the right permission can show you your record, every fact with its source, and your contact history; correct a fact, which writes a new entry and supersedes the old one; record a withdrawal of consent; record a do-not-contact instruction; reject or disable a model's estimate about you; and export your record. What they cannot do is erase the audit trail or the custody evidence.

If you work on a campaign, the same route applies for the records the campaign holds about you. For your sign-in account itself, write to us.

If you are a campaign and need us to act — an export, a deletion, a support question, or a request passed on from someone you contacted — write to us and we will act on your instructions.

[OPEN — counsel] The response-time commitment, and who answers. Brief §7 question 3. This draft states none.

[OPEN — counsel] Whether this notice must be shown somewhere other than our website: the public sign-up page shows it today, and the console and the phone app's sign-in are candidates.

12. How the data is protected

Stated conservatively. Each of these is enforced and tested:

• Campaigns are separated at the database. A software bug cannot read across campaigns, because the database refuses, not because the code remembers to check.
• Permissions come from a closed list. A campaign cannot invent a permission level.
• Dangerous powers are separate, expiring grants, approved by a second administrator, not part of anyone's role.
• Restricted details never reach a phone, by construction.
• Phone bundles are signed, and the app opens only a bundle whose signature checks out.
• Sensitive acts need a fresh sign-in. Exporting people, changing permissions and signing a destruction certificate each require re-authentication less than five minutes old.
• The audit trail records what changed, by whom, and the shape of the change — never the content. Not a name, not a contact detail, not what someone said at a door. This is checked automatically on every change to the software, over every audit record the system can write, and the build fails if a new one would carry content.
• Encryption in transit and at rest.

What we will not claim. There has been no penetration test yet. There is no SOC 2 or equivalent attestation. Breach notification procedures are being written.

[VERIFY BEFORE PUBLISHING] A penetration test is scheduled in the launch plan. If it has been done by the time this notice is published, the sentence above changes; if it has not, the sentence stays as written.

[OPEN — counsel] The breach procedure: statutory duties by jurisdiction, who notifies whom, and in what time. It is a skeleton in the repository and is yours to fill.

13. When Gestalt staff can see a campaign's data

Gestalt staff do not browse campaign data. When a campaign asks us for help and we need to look, a member of staff opens a time-boxed session in that campaign: it is a real membership with an expiry that the database itself enforces, read-only unless more is agreed, and the campaign's own administrator sees it in their access log. Opening one requires a fresh sign-in.

[VERIFY BEFORE PUBLISHING] This is decision 73 and it is not built yet. Today there is no platform-owner role in the permission vocabulary at all. This paragraph must not be published before the support-session work has merged.

We may also produce de-identified aggregate benchmarks — how campaigns perform operationally, never who they support, never anyone's characteristics, never a campaign's strategy — under rules requiring a minimum cohort and the suppression of any cohort that could identify a campaign. No benchmarking runs today.

14. Contact

Questions about a campaign's use of what you gave it go to that campaign.

Questions about the platform, about this notice, or about which campaign to contact:

Gestalt Communications Inc. Toronto, Ontario, Canada info@fieldop.ca

[GAP — Product Owner] The privacy officer's name, title and contact address. Nobody is named anywhere in the repository or in any document. Québec's Law 25 in particular has specific requirements about naming a privacy officer, and counsel's answer to section 1 may determine whether the campaign must name one too. This notice cannot be published with this blank.

[GAP — Product Owner] Confirm the postal address, and whether info@fieldop.ca is the right address for privacy requests or whether a dedicated one should exist.

15. Changes to this notice

A new version of this notice is a new version, never an edit to this one. Versions are addressable and stay addressable, because records of what someone was shown have to keep meaning what they meant on the day.

[OPEN — counsel] Whether existing users must re-accept a later version, and on what trigger. Engineering can build either; re-acceptance is its own piece of work after your text lands.

Appendix A — sentences that depend on work not yet merged

These must each be checked before this notice is published. Every other factual statement above was verified against the code on 15 September 2026.

Appendix B — everything left open, in one list

For counsel:

1. Processor or controller; one notice or two; who issues it.
2. Which statutes bind which campaign types, and whether provincial variants are needed.
3. Québec and Law 25: automated decision-making, the CAI notice duties, and the privacy officer.
4. The name-inference feature, brief §6 questions 1–4 — is it defensible at all, and on what terms.
5. Pooled calibration counts, brief §6 question 5.
6. Cross-border transfer disclosure, and the data processing agreement.
7. Whether the global default log bucket belongs in section 8.
8. What the notice says about immutable records and the destruction gap.
9. The response-time commitment and who answers.
10. Where the notice must appear beyond the public page.
11. Whether accuracy figures belong in the notice.
12. The breach procedure.
13. Re-acceptance of a later version.
14. Whether the consent wording currently shown at a stall sign-up is adequate — it is version-tracked and has had no legal review.

For the Product Owner:

1. The privacy officer's name, title and contact address.
2. The postal address and the right email address for privacy requests.
3. Which kinds of label are on by default (the design reviews differ: language, ethnicity and residency stability with faith off, or language alone) — one array in the code either way.

Draft prepared by engineering, 15 September 2026, from master §56, §56.1 and §56.2, the brief already with counsel, the launch decisions 59–79, the sub-processor register, and the code as it stands on main today. Counsel's text replaces it.