Legal

Privacy Policy

Effective 27 May 2026

Last updated: 27 May 2026

This Privacy Policy describes how QFIELD PTY LTD (ABN 73 683 282 911) (“QField”, “we”, “us”, “our”) collects, uses, holds, discloses, and protects personal information when you use the QField mobile and web applications, our marketing site, and any related services (collectively, the “Service”).

QField is a construction quality management platform built for builders, subcontractors, clients, and consultants in the Australian building industry. The Service is offered to businesses and the individuals their businesses authorise to use it.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. What personal information we collect

We collect the following categories of personal information directly from you, from your employer (the company that invites you to QField), and automatically from your use of the Service.

1.1 Account and profile information

Email address (required for sign-in and notifications)
First name, last name
Phone number (optional)
Profile photo / avatar
Job role within your company and assigned permissions
Password (stored only as a one-way hash using an industry-standard password hashing algorithm — we never see or store your password in plain text)

1.2 Company information

When you create or are invited to a company on QField, we collect:

Company legal name and trading name
Australian Business Number (ABN)
Company email and phone
Company billing and physical address
Company logo
Named contact person

1.3 Work content you create on the Service

QField is a record-keeping tool, so most of what you put into it is content about your construction work rather than personal information. This includes:

Projects, project levels, and floor plans you upload
Inspection and Test Plans (ITPs), templates, and per-control evidence
Fire penetration installations, including the X/Y coordinate of each installation on a floor plan
Defects and defect resolutions, including descriptions and photos
Company documents, drawings, and reports
Messages exchanged with other users on the Service

This content may contain personal information if you choose to include it (for example, naming an individual installer in a defect description).

1.4 Photos and file uploads

When you upload a photo or file to the Service, we store it in our secure storage so it can be associated with the relevant project, inspection, defect, or installation. Photos and files may contain embedded metadata (EXIF and similar), which can include:

GPS coordinates of where the photo was taken
Date and time the photo was taken
Device make, model, and serial / identifier
Camera settings

We are progressively rolling out EXIF metadata removal across our upload paths so that this metadata is stripped before storage. The behaviour can vary between the mobile and web applications and may change as we improve the Service. If you are concerned about embedded metadata, you can remove it on your device before uploading.

1.5 Device and technical information

When you use the Service we automatically collect:

IP address
Device type, operating system, and version
Browser type (web)
Mobile push notification token (if you opt in to notifications)
Crash logs and error traces
Application usage events (which screens are viewed, which actions are taken)

1.6 Permissions we request on your mobile device

The QField mobile app requests the following permissions. Each is requested only when needed and can be refused or revoked through your device settings.

Permission	Why we request it
Camera	To take photos for ITP evidence, defect reports, fire penetration installations, and to scan QR codes when navigating floor plans.
Photo library (read)	To attach existing photos from your device to inspections, defects, and in-app messages.
Photo library (save)	To save photos you take with the in-app camera back to your device’s photo library so you keep a personal copy alongside the in-app upload. Requested only the first time you take a photo inside the app; can be denied or revoked at any time without affecting your ability to upload to QField.
Push notifications	To deliver task assignments, review outcomes, and message alerts.
Background app refresh (iOS) / Background tasks (Android)	To finish uploading work that you captured while offline — inspections, fire penetration installations, defect reports and resolutions, reviewer decisions, and photos — so your work reaches your team even if you close the app on site. See Section 1.7 for what runs in the background and what does not.

We do not request continuous location (GPS) access. Floor plan coordinates recorded against fire penetration installations are positions on a drawing, not real-world GPS coordinates.

1.7 Background processing and offline sync

The QField mobile app is designed to work on construction sites where mobile coverage is unreliable. When you mark an inspection complete, log a defect, or attach a photo while offline, the app stores that work on your device and queues it to upload when a network is available.

To finish that upload reliably — even when you have closed the app, locked your phone, or moved out of range of the site WiFi — the app uses your device’s standard background-task system (iOS Background App Refresh and Android background tasks). The operating system decides when to wake the app; the schedule is set by your device and your usage patterns and is typically no more often than every fifteen minutes. The interval can be much longer (or skipped entirely) if your device is in low-power mode, has not been unlocked recently, or has restricted background activity for the app.

The background task only runs the upload queue. We do not access your camera, microphone, photo library, contacts, location, or any other device sensor in the background. We do not collect any data in the background that we do not already collect when you are using the app. The work the background task uploads is the same work that you have already captured in the foreground (inspections, fire penetration installations, defect reports and resolutions, reviewer decisions, and the photos you attached to those records).

Background sync uses a small amount of battery and, when WiFi is not available, may use cellular data. The amount depends on how much work you have queued and is generally small. You can disable background sync at any time:

iOS: Settings → General → Background App Refresh → QField (off)
Android: Settings → Apps → QField → Mobile data and Wi-Fi → Background data (off), or use your device’s data-saver mode. The exact path varies by Android version and device manufacturer; on Samsung devices the equivalent is Settings → Battery and device care → Battery → Background usage limits → Restrict background apps → add QField.

If you turn background sync off, your offline work will still upload — it just won’t upload until you next open the app while online.

1.8 What we do not collect

We do not collect government identifiers other than your company’s ABN.
We do not collect health information.
We do not collect biometric data.
We do not collect children’s data — the Service is not directed at people under 16 and we ask you not to use the Service if you are under 16.

2. How we use your personal information

We use personal information to operate, secure, and improve the Service. Specifically:

To create and manage your account and your company’s account
To authenticate you and protect against unauthorised access
To enable the construction workflows the Service supports (inspections, defects, fire penetration tracking, messaging)
To send transactional emails and in-app notifications (verification, password reset, invitations, task assignments, review outcomes)
To process subscription billing through our payment processor
To respond to support requests
To monitor application errors and diagnose crashes
To analyse usage of the Service in aggregate so we can improve it
To comply with our legal obligations
To enforce our Terms of Service

We will not use your personal information for any purpose that is not related to one of the purposes above, unless we have your consent or are required or authorised by law.

3. Legal basis for collection (Australian Privacy Principles)

We collect personal information because it is reasonably necessary for our functions and activities as a software-as-a-service provider for the construction industry. Where consent is required, we rely on your acceptance of this Privacy Policy and our Terms of Service, or on a specific consent prompt at the point of collection (for example, when you grant a device permission).

We share personal information only with the parties below, and only as needed to operate the Service.

4.1 Other users of your company and connected companies

Information you put into the Service is visible to other authorised users of your company and, where relevant to a project, to users of companies your company has invited or is working with on that project (for example, subcontractors invited to perform work, or clients invited to review work).

4.2 Service providers (sub-processors)

We use third-party providers to operate the Service across categories that include cloud hosting and storage, payment processing, push notifications, error and crash monitoring, product analytics, server log aggregation, and (where your company chooses to enable it) integrations with external construction platforms. Each provider receives only the personal information necessary for its function and is contractually required to handle that information in line with applicable privacy laws.

The Service is hosted in Australia. Some sub-processors may store or process personal information outside Australia; see Section 5 (Overseas disclosure) below.

A current list of our sub-processors, including the categories of personal information shared with each, is available at /subprocessors. We update that list as our infrastructure evolves. Material changes are also reflected here in accordance with Section 11 (Changes to this Privacy Policy).

We do not sell your personal information and we do not share it with advertising networks. We do not use your personal information or content you upload to the Service to train or fine-tune machine learning or generative AI models.

4.3 Legal disclosures

We may disclose personal information if we are required to do so by Australian law, by a valid order of an Australian court or tribunal, or to enforce or protect our legal rights.

4.4 Business transfers

If QField is involved in a merger, acquisition, or sale of assets, personal information may be transferred to the acquiring entity. We will notify you and give you a chance to object before your personal information becomes subject to a different privacy policy.

5. Overseas disclosure

We host the Service in Australia. Some sub-processors listed at /subprocessors may store and process personal information outside Australia, including in the United States and the European Union. By using the Service you consent to this disclosure. We take reasonable steps to ensure these providers handle your personal information in accordance with the Australian Privacy Principles.

6. How we store and protect your personal information

Passwords are stored only as one-way hashes using an industry-standard password hashing algorithm; we never see or store your password in plain text.
Tokens for email verification and password reset are time-limited and single-use.
Documents and photos are stored in private, access-controlled cloud storage and served only through short-lived, scoped access URLs.
Network traffic to and from the Service is encrypted in transit using current industry-standard transport encryption.
Access to production systems is restricted to a small number of authorised personnel on a need-to-know basis and is logged.

No internet-based system can be guaranteed 100% secure. If we become aware of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth).

7. How long we keep your personal information

We retain personal information for as long as your account is active and for as long as reasonably necessary afterwards to:

Comply with our legal, accounting, and tax obligations
Resolve disputes
Enforce our agreements
Allow construction project records to be maintained for the periods required by Australian construction industry obligations (including the National Construction Code, the Building Code of Australia, and applicable state building, warranty, and limitation-of-actions legislation, which can require records to be retained for several years after project completion)

When you delete your QField user account through the app or the web, we permanently anonymise your account. Specifically:

Your email, name, phone number, profile photo, and password are removed and cannot be recovered.
Your account status is changed to “Deleted” and all sessions are signed out across every device.
You receive a confirmation email at the address that was on the account.

The deletion is permanent — we do not offer a grace period during which you can restore the account.

Records you contributed to a company’s projects (for example, photos you uploaded to ITPs, defects you logged, inspection sign-offs) remain on those projects after your account is deleted, with your identity removed (for example, an inspection record may show “Deleted user” instead of your name). This is necessary because the company that owns the project is required by Australian construction-industry record-keeping obligations (including the National Construction Code, the Building Code of Australia, and applicable state building, warranty, and limitation-of-actions legislation) to retain construction records for the period prescribed by law, often several years after project completion.

If you are the only administrator of your company on QField, you must promote another administrator before you can delete your own account. This is to prevent your company from being locked out of its own records.

Application server logs and error reports are retained according to the retention policies of our service providers (typically 30 to 90 days). Product analytics events are retained for up to 24 months.

8. Your rights

Under the Privacy Act 1988 (Cth) you have the right to:

Access the personal information we hold about you
Correct personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading
Complain about how we have handled your personal information
Withdraw consent to optional uses of your personal information (for example, push notifications, product analytics)
Request deletion of your account

You can delete your account at any time without contacting us:

Mobile app: open your Profile → tap Delete account at the bottom → follow the on-screen confirmation steps.
Web app: sign in → open Profile → expand Account management → click Delete account, or go to qfield.com.au/account/delete for step-by-step instructions.

For all other rights described above, contact us at support@qfield.com.au. We will respond within 30 days. If we cannot meet a request (for example, because we are required to retain certain records by law or under construction industry obligations described in Section 7), we will explain why.

8.1 Opting out of product analytics

We use product analytics to understand how the Service is used and to improve it. You can opt out by:

Mobile app: turning off Analytics in the in-app Privacy settings
Web app: turning off Analytics in your account Privacy settings, or by enabling Do Not Track / Global Privacy Control in your browser, which we honour

Opting out of analytics does not opt you out of essential operational logging (for example, error reports and security audit trails) which we rely on to keep the Service running and secure.

9. Cookies and similar technologies

The QField web application uses cookies and similar technologies to:

Keep you signed in (session cookies)
Remember your preferences
Measure aggregate usage of the Service

You can disable cookies in your browser, but parts of the Service may stop working if you do.

10. Children

The Service is intended for use by adults working in the construction industry. We do not knowingly collect personal information from anyone under 16. If we become aware that we have collected personal information from a person under 16 without verified parental consent, we will delete it.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and / or in the Service before the changes take effect. The “Last updated” date at the top of this page indicates when the policy was last revised.

12. Contact us

If you have a question about this Privacy Policy or a complaint about how we have handled your personal information, contact:

QFIELD PTY LTD Email: support@qfield.com.au

If you are not satisfied with our response to a complaint, you can refer your complaint to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.