Legal
Privacy notice
Fieldcompass.org, an NGO based in Paris, France, is responsible for the personal data of the people who use Field Compass. It processes survey data only on behalf of the organisations that collect it.
Who we are
Fieldcompass.org, NGO, Paris, France. For anything about your data, write to privacy@fieldcompass.org.
Our two roles
- For your account (people who use the app or visit fieldcompass.org), we are the controller.
- For survey data that an organisation brings into Field Compass from KoboToolbox, we are a processor. We act only on that organisation's instructions, under a data processing agreement. The organisation is the controller.
If you were interviewed for a survey, please contact the organisation that interviewed you. If you write to us, we will pass your request to them.
What we hold about users, and why
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| Email, username, full name, and your password as a bcrypt hash (never the password itself) | To give you an account | Contract (Art. 6(1)(b)) | Until you delete your account |
| If you sign in with Google or Microsoft: which one, its ID for you, and the address it gave (never your password there) | To sign you in with it | Contract | Until you remove it or delete your account |
| Your Kobo server address and API token, the token encrypted | To read your surveys from KoboToolbox | Contract | Until you remove it or delete your account |
| AI provider connections you add: a label, an address, the API key encrypted, its last 4 characters | To run AI features on your own provider | Contract | Until you remove them or delete your account |
| Your settings, your reviewer notes, and who you share surveys with | To provide the features you use | Contract | With the survey, or until you delete your account |
| Links we email to confirm your address or reset your password, kept only as a hash, and when you confirmed your address | To check an address is yours before surveys are shared with it, and to let you back in if you forget your password | Contract | A link: a day after it expires (3 days after it is sent, or 1 hour for a password reset) or is used. The confirmation: until you delete your account |
| Invitations to a survey: the address invited, who invited it, the access offered, and when | To email the invitation and give access when it is accepted | Legitimate interest | Deleted when withdrawn; otherwise 30 days after it is accepted or expires (14 days after it is sent) |
| Usage records: sign-ups, sign-ins, days active, surveys created, deleted and shared, AI use per survey, and the campaign tags of the link you signed up from | To run the service, apply the monthly AI allowance and see how it is used | Legitimate interest (Art. 6(1)(f)) | 24 months. After your account is deleted they no longer name you. |
| Your IP address | To limit repeated sign-in and sign-up attempts | Legitimate interest | Up to an hour |
| Server logs: your user ID, what failed, and when | To keep the service running and secure | Legitimate interest | Overwritten as new logs arrive: at most 50 MB per service |
| Error reports: what failed, where in the code and when, with the log lines just before it, which can include your user ID | To find and fix what goes wrong | Legitimate interest | Up to 90 days, at Sentry |
In your browser, the app keeps your sign-in token, your profile and your display preferences in local storage. It sets no cookies and uses no tracking or advertising tools. Sign-ins last 2 hours.
What we process for organisations
When an organisation connects a KoboToolbox project, Field Compass stores:
- the form and the submissions, with their edit history;
- the time spent on each question, from Kobo's audit logs;
- transcripts of recorded answers, translations, and the findings of the quality checks, including AI review;
- review decisions and reviewer notes.
Recordings are read from Kobo when someone plays them or when they are transcribed, and are not kept. All of this is deleted when the organisation deletes the survey, or when its owner deletes their account. Copies in backups are gone within 97 days: weekly copies are kept 90 days, then 7 more as deleted copies. What Field Compass wrote back to Kobo (review decisions, transcripts, translations) stays in Kobo.
Visitors to fieldcompass.org
The website is hosted by Cloudflare. It counts visits with Cloudflare Web Analytics, which sets no cookies. It loads no fonts or scripts from other services.
Who receives data
Only our sub-processors, listed below with where they process data, and only to provide the service. We never sell data or use it for advertising. We do not use account or survey data to train AI models, and neither do our AI sub-processors.
Transfers outside the EU
Field Compass is hosted in the EU: Microsoft Azure in Ireland, with backups in the Netherlands. Its emails are sent by Brevo, also from the EU. Its error reports are stored by Sentry in Germany; Sentry is a US company and may access them from the United States, under the EU–US Data Privacy Framework and the European Commission's standard contractual clauses.
When a survey uses AI review, translation or transcription on the allowance Field Compass provides, the answers or recordings concerned are sent to OpenAI or ElevenLabs. They may process them in the United States, under the European Commission's standard contractual clauses. A survey's owner can connect their own AI provider instead, or leave these features off.
Your rights
You can ask to see, correct, delete or receive a copy of your data, to limit its use, or object to uses based on our legitimate interest. You can delete your account yourself in Account settings; this also deletes the surveys you own and all their data.
Write to privacy@fieldcompass.org. We answer within one month. You can also complain to the CNIL: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr.
Security
Data is encrypted in transit and at rest, stored keys are encrypted again by Field Compass, and access is limited by role. The security annex to our data processing agreement lists the measures.
Changes
We will post changes here and tell account holders about important ones in the app. Last updated: 23 October 2026.
Sub-processors
Five companies process customers' personal data for Field Compass: Microsoft hosts everything in the EU, Brevo sends the app's emails from the EU, Sentry keeps the app's error reports in the EU, and OpenAI and ElevenLabs receive data only when a survey uses the AI allowance Field Compass provides.
| Sub-processor | What it does | Data it receives | Where | Safeguards |
|---|---|---|---|---|
| Microsoft Ireland Operations Ltd (Azure) | Hosts the app, its database and its backups | All account and survey data | North Europe (Ireland); backups copied to West Europe (Netherlands) | Processed in the EU; Microsoft Products and Services Data Protection Addendum |
| Sendinblue SAS (Brevo) | Sends the app's emails: address confirmations, a welcome, password resets and notices that a password changed, survey invitations and notices that a survey was shared | The recipient's address and the email itself: their name or the inviter's, the survey's name and a link. Brevo logs each email's delivery. No survey data. | EU: Google Cloud in Belgium, OVH in France and Germany | Processed in the EU; Brevo's data processing agreement |
| Functional Software, Inc. (Sentry) | Records the app's errors, so that we can find and fix them | What failed, where in the code and when, with the log lines just before it, which can include user IDs. We leave out what was sent with the request, cookies and the data being processed, and remove email and IP addresses before sending; an error message can still occasionally quote a value. Kept up to 90 days. | EU: Germany (Frankfurt) | Stored in the EU; Sentry's data processing addendum, with the EU–US Data Privacy Framework and standard contractual clauses for access from the United States |
| OpenAI Ireland Ltd | Reviews open-text answers, translates answers, drafts quality checks | The answers sent for review or translation, with their question labels; the form's structure for drafted checks | Mainly the United States | Standard contractual clauses. API data is not used for training; requests are kept up to 30 days for abuse monitoring. |
| Eleven Labs Inc. (ElevenLabs) | Transcribes recorded answers | The recordings sent for transcription | United States | DPA with standard contractual clauses. Our account is set so that recordings are not used to train ElevenLabs' models. |
We will tell customers 30 days before adding or replacing a sub-processor, so they can object.
Not sub-processors
| Service | Why it is not on the list |
|---|---|
| KoboToolbox (Kobo, Inc.) | The organisation's own processor. Field Compass reads from it with the organisation's own token. |
| An AI provider a survey's owner connects | Used under the owner's own contract with that provider. |
| Google and Microsoft, when you sign in with them | Your own account with them, which you choose to sign in with. They confirm who you are and tell us your name and email address; we send them nothing about your use of Field Compass. |
| Cloudflare | Hosts the marketing website and its analytics. Handles no account or survey data: the app's address is not routed through it. Listed in the privacy notice for website visitors. |
| GitHub | Holds the source code and the app's container images, no personal data. |
| Let's Encrypt | Issues the app's HTTPS certificates, and receives no personal data. |