Privacy Policy

Last updated: September 2026

FieldSales ("we", "the platform") is committed to protecting the privacy of its customers, users and website visitors. This policy explains what data we collect, how we use and protect it, with whom we share it, and the rights you have under the Saudi Personal Data Protection Law (PDPL).

1. Who We Are

The FieldSales platform is operated by "مؤسسة تكامل الميدان للتجارة والإستيراد", registered under commercial registration no. 7040371671 and based in Riyadh, Kingdom of Saudi Arabia. It is the entity responsible for the personal data processing described in this policy.
Operational data that a subscriber company enters into its account is processed on that company's behalf and solely to provide the service to it.

2. Scope

This policy applies to all platform users (subscriber companies, their managers and users, and field reps), to visitors of our website fieldsa.net, to anyone who contacts us on WhatsApp, through our contact form or subscription request form, or by email, to FieldSales ambassadors, to anyone who makes a payment through an online payment link on the platform, and to the businesses we contact for marketing purposes.

3. Data We Collect

• Account data: company name, user name, email, phone number, and password (stored encrypted).
• Operational data entered by the company: customers, products, prices, orders, invoices, receipt vouchers, and account balances.
• Geolocation (GPS) data from the rep app, as described in Section 11.
• Technical data: device type, IP address, and usage logs, for security and performance, and the times the rep app is open and connected, from which the rep's working hours are calculated for their company, as described in Section 11.
• Public website browsing and ad measurement data, as described in Sections 5 and 6.
• WhatsApp conversation data when you message us, as described in Section 8.
• Contact form and subscription request form data from our website, and messages you send to our email: name, business name, email, mobile number, country, city, number of reps, and the message text or notes.
• Online payment data, when a subscription or an invoice is paid through a payment link: the amount, the payment description (such as the company name and invoice number), the mobile number for a new subscription requested on WhatsApp, and the payment status and reference at our payment gateway provider, Moyasar. Card details are entered on the payment page hosted by Moyasar, so they do not pass through our servers and we do not store them.
• FieldSales ambassador data: name, email, mobile number, city, password (stored encrypted), Mawthooq license number and expiry date and VAT number (if any), bank details for paying entitlements (the IBAN, stored encrypted, the account holder's name and the bank name), and a value derived from the IP address when the program terms are accepted; plus data about the businesses they refer: business name, commercial registration number, city, contact number, how the ambassador knows the business, and the ambassador's note.
• Data from integrations that the subscriber company enables with its own account keys at their providers, such as Hatif for work numbers (we receive the work numbers and call records: the numbers of both parties, time, duration, the recording link at the provider, and the transcript and summary if the provider sends them) and PetroApp (we receive the company's vehicles and their plate numbers, its drivers' names and phone numbers, and fuel, maintenance and car wash bills), and an ERP system at an address the company sets (at the company's request, we send it the company's customers, including their names, phone numbers, addresses and map locations, as well as its products, its invoices, including the rep's name and phone number, and its receipt vouchers). We process this data on behalf of the company and under its instructions, as described in Section 1.
• Publicly available business contact data about the businesses we contact for marketing, as described in Section 4.
• Data of the invoices you create with the free invoice generator on our website, as described in Section 4.

4. How We Use Your Data

We use data only to:
• Operate the platform and provide its services to you.
• Provide technical support and communicate about your account.
• Answer your inquiries before and after you subscribe.
• Run the FieldSales ambassador program and calculate and pay ambassadors' entitlements.
• Contact businesses for marketing purposes, as described below.
• Understand which channels and pages bring us visitors, and measure and improve the effectiveness of our ads.
• Improve performance and security and prevent misuse.
• Meet legal and regulatory obligations.
We never use the operational data stored inside subscriber company accounts for any advertising purpose, and we do not sell any data to anyone.
The legal basis for processing account and operational data is performance of the subscription contract and compliance with legal obligations; for payment data, carrying out the payment you request; and for ambassador data, performance of the ambassador program terms. The legal bases for visit statistics, ad measurement and WhatsApp conversations are stated in their own sections.
From public sources such as maps, business directories, search engines and the businesses' own websites, and from map, search and business data providers, we collect publicly available business contact data about businesses: business name, activity, phone, email, website, address, city, country and map location. We use it to contact these businesses for marketing by email and WhatsApp, and we record their interaction with our messages, such as email opens, link clicks, replies and requests to stop messaging. Any business, and anyone this data relates to, may object and ask us to stop contacting them: the unsubscribe link in our emails stops our emails, replying to a WhatsApp message with a stop word stops our WhatsApp messages, and to stop contact through all channels, write to info@fieldsa.net.
When you download or print an invoice from the free invoice generator on our website, we store the seller business's name, VAT number, address and country, the buyer's name and VAT number, and the invoice total and currency, and we record the seller business as a sales lead. We use this data to improve the service and to contact the seller business for marketing. This data is entered by the user of the tool and is not publicly available. The seller business may object and ask us not to contact it using the methods described above.

5. Public Website Visit Statistics

When you browse our public website fieldsa.net (not the platform after login), our servers record the following for each page you visit:
• The page address, its language, and the referring website, if any.
• Your browser and device type, as sent by your browser.
• Your approximate country, region and city, obtained by sending your IP address to an external IP geolocation service.
• A value derived from your IP address with a hash function, which we keep instead of the address itself; since September 2026 we derive it with a secret key. This value is the same for every visit from the same IP address, so we use it to estimate the number of unique visitors.
• Campaign tags in the visit link, such as utm_source, utm_medium and utm_campaign.
• A random anonymous visitor ID, a session ID that expires after 30 minutes of inactivity, and the source of your first visit that came from a campaign or an external website, together with the first page you landed on.
These IDs are kept in your browser's local storage (localStorage), not in cookies, and remain there until you clear them or stop measurement with the button described in Section 7. These records do not include your name, email address or phone number, and we do not use device fingerprinting.
When you tap a WhatsApp button on our website, we record the tap, the page it came from and your visitor ID (if any), and we add a short reference code starting with "FS" to the pre-filled message. If you send the message with the code, we use it to link your conversation and phone number to your browsing history on our website from the same browser, to your first-visit source and to the campaign that brought you. You can delete the code before sending, and this link is then not made.
If you arrive through a referral link from a FieldSales ambassador, we keep the referral code in your browser so that your subscription can be credited to that ambassador when you sign up. We stop honoring it 365 days after it was saved and delete it from your browser on your first visit to our website after that period.
We use this data to understand which channels and pages bring visitors and conversations. Retention is described in Section 13.
Legal basis: our legitimate interest in understanding the performance of our website and marketing channels, while you keep the right to object to this measurement and stop it using the methods in Section 7.

6. Advertising Measurement with Google Ads

We advertise in Google search results and use the Google Ads tag provided by Google LLC on our public website only (not inside the platform after login). Its purpose is to measure whether a visit that came from our ads resulted in starting a free trial or starting a WhatsApp conversation with us.
This measurement involves processing:
• The ad click identifier that Google adds to the ad link.
• The pages of our public website where the tag runs.
• The conversion event itself (starting a free trial or starting a WhatsApp conversation).
• Technical data processed directly by Google, such as your IP address and browser and device information.
For this purpose, Google sets first-party cookies on our domain, such as _gcl_au and _gcl_aw.
Our commitments in this measurement:
• We have disabled ad personalization signals in the tag settings.
• We do not build remarketing audiences.
• We do not upload customer lists to Google, we do not enable the Enhanced Conversions feature in Google Ads, and we do not intentionally send Google your name, email address or phone number.
Purpose: to measure the effectiveness of our ads and direct our advertising spend.
Legal basis: our legitimate interest in measuring the performance of our ads with the minimum necessary data, while you keep the right to object to this measurement and stop it at any time using the methods in Section 7.
Google may process this data on servers outside the Kingdom of Saudi Arabia, in accordance with its own privacy policy: https://policies.google.com/privacy

7. How to Stop Measurement

• The "Stop measurement" button at the end of this page (fieldsa.net/privacy): it stops measurement on the browser you are using, so the Google Ads tag is no longer loaded; it deletes the cookies that the tag set on the fieldsa.net domain and clears the attribution data saved in the browser, such as the visitor ID, the session ID and the first-visit source. Cookies that Google sets on its own domains are managed through Google's settings and your Google account. You can resume measurement with the same button.
• Browser privacy signals: if you enable Do Not Track or Global Privacy Control in your browser, we treat it as stopping measurement.
• Blocking local storage: if your browser prevents our website from accessing local storage, we treat it as stopping measurement.
• Browser settings: you can block or delete cookies and clear the data our website has stored. Deleting or clearing on its own does not stop measurement: it removes the stored IDs together with the stop-measurement flag saved by the button, so we create new IDs on your next visit unless a browser privacy signal is enabled or local storage is blocked.
When measurement is stopped by one of the first three methods, we do not create the visitor ID or session ID, do not record campaign tags or the first-visit source, do not load the Google Ads tag, do not derive any value from your IP address, and do not send it to the geolocation service.
In that case we record only minimal visit statistics (page address and language, referrer, and browser and device type as sent by your browser), plus WhatsApp button taps with their reference code, none of them linked to a visitor ID.
Stopping measurement does not cover the referral code, which is needed to calculate ambassadors' entitlements.
Google's ad settings page (https://adssettings.google.com) controls the personalization of the ads Google shows you. It does not stop conversion measurement on our website.

8. WhatsApp Conversations

When you message us on WhatsApp, your messages may be answered by an AI-powered automated assistant that writes replies and sends them to you automatically, without prior human review. The conversation is passed to a member of our team when your request needs human attention.
We process your phone number, your WhatsApp display name (if any) and the content of your messages to answer your inquiries and follow up on your request. We send the conversation text to AI service providers, such as Anthropic and Google, which process it on our behalf to generate replies.
If you message us from the phone number registered in a subscriber company's settings, we use that number to retrieve a summary of the company's account (company name, subscription status, plan and expiry date, and number of reps) and, when you ask about your account figures, its activity indicators for the month (number of invoices, total sales and collections, number of customers and of customers with outstanding balances, and the latest invoice with its number and amount). We pass this summary to the automated assistant and the AI providers so that it can answer your questions. At your request, we also carry out limited actions, such as resetting a rep's password, deactivating or reactivating a rep, or creating a trial account with the name and email you give us, and we send you in the same conversation the names and usernames of the company's reps, to identify the rep concerned, and the temporary password or the new account's password.
If your first message contains an FS reference code, we link the conversation to your browsing history on our website and to the campaign that brought you, as described in Section 5.
Legal basis: responding to the request you started by messaging us, and our legitimate interest in following it up.
WhatsApp itself is subject to Meta's privacy policy.

9. Per-Company Data Isolation

Each subscriber company's data is stored in a logically isolated space (multi-tenant isolation), so no company can access another's data, and your data remains solely yours.

10. Data Sharing and Transfers Outside the Kingdom

We do not sell your data, and we do not share it with third parties except:
• Service providers acting on our behalf, only as needed to operate the service. They include our cloud hosting provider; GitHub, where we keep periodic backup copies of the database; our email delivery, receiving and forwarding providers; an IP geolocation service; a mapping service we use to match rep routes to roads; the AI providers used to answer WhatsApp conversations; Meta, the operator of WhatsApp, through which WhatsApp messages pass; our payment gateway provider, Moyasar; and the map, search and business data providers from which we obtain business contact data.
• Google LLC, for ad measurement on our public website, as described in Section 6, and when your browser loads the fonts of our website and platform, and the map tiles in the rep tracking screens, from Google's servers; Google then receives your IP address and the map area displayed. Stopping measurement does not stop these fonts from loading.
• Providers of integrations that the subscriber company enables, with which we exchange data at the company's request: we receive from Hatif and PetroApp the data described in Section 3, and we send customer, product, invoice and receipt voucher data to the ERP system whose address the company sets. That system may be located outside the Kingdom, depending on the company's choice.
• Where required by a legal obligation or a competent authority.
The platform and its database are hosted on servers inside the Kingdom of Saudi Arabia, and platform data, including account, operational and location data, visit statistics and WhatsApp conversations, is stored on those servers. None of this data is processed outside the Kingdom except what we transfer to the service providers and parties listed in this section.
GitHub, our email, geolocation, mapping, search and business data, and AI providers, Meta, and Google are located outside the Kingdom. We transfer to them only the data needed to provide the service and for the purposes described in this policy.

11. Location Tracking

The rep app collects location data in two ways:
• Route tracking: it runs only if the company manager enables it, and it records the rep's location every few seconds while the rep is signed in and the app is open on the device. The app does not limit it to working hours, so we advise reps to sign out or close the app outside working hours. The company manager can turn it off at any time, and it then stops for all of the company's reps.
• A point-in-time location, captured regardless of the tracking setting, when the rep records a field visit (as proof of arrival, together with the visit photos) or pins a customer's location on the map. The app also reads the current location, without saving it, to check proximity to a customer or to find the nearest fuel stations.
Route points are sent to a mapping service provider to match them to roads and show them on the map.
The rep app also records the times it is open and connected to our servers while the rep is signed in and the app is open, regardless of the tracking setting, so turning tracking off does not stop it. From these times, route points and visits, the rep's working hours and days present and absent are calculated and shown to the company's management.
The company uses this data for professional purposes such as organizing and verifying visits, improving coverage and measuring working hours. We process it on behalf of the subscriber company and under its instructions, as described in Section 1.

12. Data Security

We apply technical and organizational safeguards: encryption of the connection between your browser or app and our servers (HTTPS), password encryption, and permission controls. Despite our care, no system is 100% secure, so we advise you to protect your login credentials.

13. Data Retention

We retain your account and operational data for the duration of your subscription and do not delete it automatically when the subscription ends. Upon termination you may request an export of your data and then request its deletion.
We have not yet set an automatic deletion period for visit statistics, WhatsApp button tap records and WhatsApp conversations, so they are currently kept without automatic deletion.
To request deletion of your account or of any data that relates to you, write to help@fieldsa.net, as explained at fieldsa.net/delete-account/. We carry out the deletion within 30 days of verifying your request, except for data we are legally required to retain, such as tax invoices and accounting records, which we keep for the legally required period. If the company has posted accounting entries that we are legally required to retain, the data linked to those entries may not be deletable before the legal period ends; in that case we suspend the account and keep that data only for the legal period. Copies of deleted data remain in our backups until they are replaced in the normal backup cycle.
The visitor ID, session ID and first-visit source stay in your browser until you clear them or stop measurement with the button, as described in Section 7.

14. Your Rights

The Personal Data Protection Law grants you the right to:
• Be informed of the data we collect about you and of the purposes and legal basis of its processing, as set out in this policy.
• Access your data, obtain a copy of it, and export it.
• Correct, complete, and update your data.
• Request deletion of your data when it is no longer needed.
• Object to advertising measurement and stop it using the methods in Section 7.
• Object to our marketing contact with you and ask us to stop it, as described in Section 4.
• Withdraw your consent at any time where processing is based on consent.
To exercise any of these rights, contact us at info@fieldsa.net; for deletion requests, write to help@fieldsa.net as described in Section 13. You also have the right to lodge a complaint with the competent personal data protection authority in the Kingdom.

15. Cookies and Local Storage

• Cookies and data necessary to operate the platform and to save your login session and preferences.
• First-party measurement IDs, the referral code and the stop-measurement flag, kept in local storage, as described in Sections 5 and 7.
• Google Ads cookies, such as _gcl_au and _gcl_aw, and any data the tag may keep in local storage, on the public website to measure conversions, as described in Section 6.
We do not use cookies to personalize ads or to build remarketing audiences.

16. Children's Privacy

The platform is intended for business use and is not to be used by anyone under 18.

17. Changes to This Policy

We may update this policy from time to time and publish the updated version on this page with the update date.

18. Contact

For any privacy or data inquiry:
"مؤسسة تكامل الميدان للتجارة والإستيراد" (FieldSales), Riyadh, Kingdom of Saudi Arabia
info@fieldsa.net