Privacy Policy

1. Who we are

NetField (“NetField”, “we”, “us”) operates net-field.com and the workspace at app.net-field.com. We are the data controller for the personal data described below.

The service is operated by Net Field. For anything in this policy, including any request under section 8, write to info@net-field.com.

2. What we collect

2.1 Your account

When you create an account we store your email address, the name you choose to give (optional), a one-way hash of your password, the date you registered and the date you confirmed your email address. We never store your password itself, and it cannot be recovered from the hash.

2.2 If you sign in with Google

Signing in with Google gives us the account identifier Google assigns you, the email address on that Google account, whether Google has confirmed that address, and the display name on it. We store the identifier and the address so that the next sign-in reaches the same NetField account. We do not receive your Google password, and we ask Google for nothing beyond those details — no contacts, no calendar, no files.

An account created this way has no NetField password until you set one. You can disconnect Google from the account page at any time, provided you have set a password first, because otherwise there would be no way left to sign in.

2.3 What you build

Projects and everything in them: project names and descriptions, address ranges, VLANs, device names and models, IP allocations, topology, the configuration NetField generates and any configuration you paste in to be validated.

This is usually not personal data, but it is almost always commercially sensitive — it is a map of a real network. We treat it as confidential, we do not use it to train anything, and we do not look at it except where you ask us to for support or where we have to in order to investigate abuse or keep the service running.

2.4 The AI assistant

If the AI features are enabled on your account and you use them, the prompt you write and a bounded summary of the project it is about — its VLANs, devices, allocations and topology — are sent to Cloudflare’s Workers AI service to produce a reply. We store the conversation, any generated draft and a counter of how much you have used, so that the conversation persists and the usage limits work.

Do not paste credentials, keys or passwords into it. This is worth saying plainly because network configuration frequently contains them.

2.5 Documentation you send to other people

When you email generated documentation from a project, you give us the recipients’ email addresses and we pass them and the document to our email provider for delivery. We do not keep the recipient list or the document afterwards, and we do not contact those recipients for any other reason.

2.6 Technical records

Our servers and our hosting providers record the ordinary things a web service records: IP address, browser user-agent, the page or endpoint requested, timestamps and error traces. These keep the service available and are how abuse, brute-force attempts and outages are detected.

3. Why we hold it, and on what basis

Where the UK or EU GDPR applies, these are the lawful bases we rely on. We do not rely on consent for anything today, because nothing here is optional marketing or analytics.

4. Cookies and browser storage

NetField sets two cookies, both strictly necessary, and neither used to track you across sites. There is no advertising, no analytics and no third-party tracker anywhere on this site or in the workspace. That is why you have not been shown a consent banner: under the ePrivacy rules, strictly necessary cookies do not require consent, and we do not set any other kind.

Separately, the following are stored in your own browser and are never sent to us: your light or dark theme preference, whether you have seen the product tour, the width and open state of the assistant panel, and a flag marking that the landing animation has already played this session. Clearing your site data removes them.

5. Who else processes it

We use the following providers to run the service. They process personal data only to provide their service to us, and for no purpose of their own. We do not sell personal data, and we do not share it for anyone else’s marketing.

We will also disclose data where we are legally required to, and where it is necessary to establish or defend a legal claim.

6. International transfers

The providers above are largely based in the United States, so your data is transferred outside the UK and EEA. Those transfers rely on the safeguards in each provider’s data-processing terms — for these providers, the European Commission’s Standard Contractual Clauses together with the UK Addendum, and the EU–US Data Privacy Framework where the provider is certified under it.

7. How long we keep it

• Your account and projects — for as long as the account exists. Deleting your account removes them immediately, as described below.
• Technical records — held by our hosting providers for their standard retention windows, which are measured in days to weeks, not years.
• Email delivery records — kept by our email provider for a short period so that delivery failures can be diagnosed.

8. Your rights

If the UK or EU GDPR applies to you, you have the right to obtain a copy of your data, to have it corrected, to have it erased, to restrict or object to how we use it, and to receive it in a portable format. Similar rights exist under other laws, including for residents of California.

Deleting your account is self-service. The account page has a delete option. It is a real deletion, not a flag: the account row and everything attached to it is removed from the live database at once, and you are signed out. There is no recovery window, so export anything you want to keep first.

For everything else — a copy of your data, a correction, a restriction, or an objection — email info@net-field.com from the address on your account. We will respond within one month. There is no charge, and you do not have to give a reason.

You can also complain to a supervisory authority. In the UK that is the Information Commissioner’s Office; in the EU it is the authority for the country you live in. We would rather you came to us first, but the right does not depend on that.

9. How it is protected

Traffic is encrypted in transit with TLS. Passwords are stored only as salted hashes using Django’s default algorithm. Session cookies are HTTP-only and marked secure, and every state-changing request carries a CSRF token. Every project belongs to an organisation, and queries are scoped so that one account cannot reach another’s data. Sign-in, registration and email endpoints are rate-limited.

No system is perfectly secure, and we will not claim otherwise. If you believe you have found a vulnerability, please report it to info@net-field.com rather than disclosing it publicly, and we will work with you on it.

10. Children

NetField is a professional tool and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has created an account, tell us and we will remove it.

11. Changes to this policy

This is version 1.0, in effect from 22 September 2026. If we change it materially — a new processor, a new purpose, a new category of data — we will raise the version and email account holders before the change takes effect. Smaller corrections are made in place.