Last updated: May 12, 2026
This Data Processing Agreement (“DPA”) supplements the Field Terms of Service (the “Agreement”) between Field.is LLC (“Field,” “Processor”) and the Operator who has accepted the Agreement (“Operator,” “Controller”). It governs Field's processing of Personal Data on behalf of the Operator in connection with the Operator's use of the Field platform.
Personal Data — any information relating to an identified or identifiable natural person, as processed under this DPA. Includes information about the Operator's clients and end users (Operator Client Data).
Processing — any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, and erasure.
Operator Client Data — Personal Data submitted to Field by the Operator about the Operator's end clients, including but not limited to email content, communication records, contact information, and AI-derived assessments.
Sub-Processor — a third party engaged by Field to process Personal Data on the Operator's behalf, as listed in Section 6.
Data Protection Laws — applicable data protection and privacy laws including, where relevant, the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), and equivalent laws in other jurisdictions.
Field acts as Processor on the Operator's behalf. The Operator acts as Controller for Operator Client Data and is responsible for establishing the lawful basis for processing, obtaining any required consents, and responding to data-subject requests from end clients.
Field does not determine the purposes or means of processing Operator Client Data. Field processes Operator Client Data exclusively to provide the services described in the Agreement and per the Operator's instructions documented in this DPA, the Agreement, and the Field platform's standard configuration.
Subject matter: Processing of Personal Data to provide practice-management services, including email triage, AI assessment, work tracking, billing, monitoring, and client communications.
Duration: For the term of the Agreement plus the retention periods set out in the Privacy Policy.
Nature and purpose: Storage, retrieval, structured analysis, transmission of communications, and incidental processing required to operate the Field platform.
Categories of data subjects: The Operator's end clients; the Operator's end clients' authorized contacts; and the Operator's own personnel where applicable.
Categories of Personal Data: Names, email addresses, business contact information, communications content, project notes, billing records, AI-derived assessments and classifications.
The Operator represents and warrants that:
Field will:
The Operator authorizes Field to engage the following Sub-Processors to provide the platform services:
*@in.field.is). Email content reaches Field through this provider before being parsed by the intake webhook.Field will provide at least 14 days' notice before adding or replacing a Sub-Processor. The Operator may object to a new Sub-Processor on reasonable grounds related to data protection; in that case the parties will work in good faith to resolve the objection, and absent resolution, the Operator may terminate the Agreement.
Field implements the following technical and organizational measures:
Field and its Sub-Processors are located in the United States. Where applicable, Operators in the European Economic Area, the United Kingdom, or other jurisdictions with cross-border transfer restrictions rely on the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, as supplemented by the security measures in Section 7, as the lawful basis for transfer. The SCCs (Module 2: controller-to-processor) are incorporated into this DPA by reference for Operators based in jurisdictions where they apply.
End-client data-subject requests (access, correction, deletion, portability, restriction) should be directed by the data subject to the Operator. The Operator is responsible for responding within the timeframes required by applicable law. Field will assist the Operator on request via privacy@field.is — export and deletion are currently handled as manual processes; Field will acknowledge requests within 5 business days and respond substantively within 30 days.
In the event of a Personal Data breach affecting Operator Client Data, Field will:
Field will make available to the Operator all information reasonably necessary to demonstrate compliance with this DPA. Operators may request, no more than once per year, a written summary of Field's security practices and applicable third-party audit reports of Sub-Processors. On-site audits are not generally available for a single-operator subscription; Operators with elevated compliance needs should discuss bespoke arrangements before subscribing.
Upon termination of the Agreement, the Operator may request that Field delete or return all Personal Data. Return and deletion are currently handled as manual processes — the Operator initiates the request to privacy@field.is within 60 days of termination, and Field will execute within 30 days of receipt. The following exceptions apply:
Inbound email content and AI-generated assessments are also subject to automated 18-month redaction during the term of the Agreement, as described in the Privacy Policy.
The liability of each party under this DPA is subject to the limitations of liability set out in the Agreement.
This DPA takes effect when the Operator first accepts the Agreement and continues for the term of the Agreement. Provisions that by their nature should survive termination — including confidentiality, breach notification for pre-termination breaches, and post-termination data handling — survive accordingly.
This DPA is governed by the same governing law and dispute-resolution provisions as the Agreement (Sections 12 and 13 of the Field Terms of Service).
For DPA-related inquiries, sub-processor notifications, or signed-copy requests:
privacy@field.is