How We Protect Your Data

1 Introduction

Fixlify AI ("we," "our," or "us") operates the Fixlify mobile application and web platform (the "App"). This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our App.

By using Fixlify, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, do not use the App.

2 Information We Collect

2.1 Location Data

What we collect:

• GPS coordinates (latitude and longitude)
• Location accuracy, altitude, heading, and speed
• Timestamp of location capture

Why we collect:

• Track technician locations for job dispatch and routing
• Calculate travel distances and mileage
• Optimize job assignments based on proximity
• Provide real-time updates to dispatchers and managers

Your control: Background location tracking can be disabled in app settings. Disabling may limit certain app functionality.

2.2 Photos and Files

We collect photos and documents you upload to document jobs, attach to messages, or use for estimates and invoices. Files are stored securely in cloud storage and retained until manually deleted.

2.3 Device Information

We collect push notification tokens, device name, OS version, and device model to send notifications and troubleshoot technical issues.

2.4 Personal Information

Full name, email address, phone number (optional), organization affiliation, and role within your organization.

2.5 Business Data

Jobs, clients, invoices, estimates, messages, notes, time tracking records, and product/inventory data you create or access through the app.

2.6 Connected Advertising Accounts (Google Ads)

If you choose to connect your Google Ads account (Settings → Integrations), we collect and store, on your behalf:

• An OAuth refresh token and your Google Ads customer ID(s), used to act on your account through the Google Ads API;
• Click identifiers captured from your own website traffic (gclid, gbraid, wbraid) and UTM parameters;
• When a customer grants optional advertising-measurement consent, a one-way SHA-256 hash of the booking email and/or phone number. The raw email and phone are never sent to Google through this feature;
• Paid-invoice conversion details: conversion time, invoice total and currency, and a captured ad click identifier when available. Fixlify never sends card or bank details through this feature;
• Campaign performance metrics we read back from your account (cost, clicks, impressions, calls, conversions, and conversion value) to display your in-app advertising dashboard.

We use this data only to (a) upload offline conversions to your Google Ads account when a configured paid invoice becomes eligible for measurement, and (b) show you read-only performance reporting. We do not create or modify your campaigns, budgets, keywords, or ads. You can disconnect at any time, which deletes the stored token.

3 How We Use Your Information

• Service Delivery: Job dispatch, team coordination, customer management
• Communication: Push notifications, messages, system alerts
• Business Operations: Invoicing, mileage calculation, analytics
• App Improvement: Bug fixes, performance optimization, new features
• Security: Authentication, fraud prevention, legal compliance

4 Data Sharing and Disclosure

4.1 Third-Party Service Providers

We share data with trusted services that help us operate:

• Supabase: Database, authentication, file storage
• Mailgun: Email delivery
• Telnyx: SMS and voice communication
• Expo: Push notification delivery
• OpenAI/Anthropic/Google AI: AI-powered features
• Stripe: Payment processing (if applicable)
• Google Analytics: Website traffic and signup funnel measurement. On by default; you can turn it off at any time (see “Your Rights and Choices” below)
• Microsoft Clarity: Masked interaction analytics used to find usability problems. Runs only on our sign-in and signup pages, never inside your account or the client portal

Neither analytics tool receives form text, customer records, names, email addresses, or phone numbers. Both are switched off entirely on client-portal, invoice, invitation, and password-reset pages.

4.2 Within Your Organization

Your data is shared with other users within your organization according to role-based permissions.

4.3 We Do NOT Sell Your Data

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

5 Data Security

• All data transmitted is encrypted using HTTPS/TLS
• Data stored is encrypted at rest
• Role-based access control (RBAC) limits data access
• Row-level security (RLS) ensures organization data isolation
• Regular security audits and vulnerability assessments

6 Google User Data and Limited Use

Fixlify AI's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6.1 Google Ads

• We access Google Ads account data through the Google Ads API only to provide and improve the conversion-tracking and reporting features you explicitly authorize.
• We do not use or transfer Google user data for serving advertising, for retargeting, or for selling or transferring it to data brokers or any other third party.
• We do not use Google user data to train, develop, or improve generalized or transferable artificial-intelligence or machine-learning models.
• Humans do not read Google user data unless you give explicit consent for a specific support request, it is necessary for security or to comply with applicable law, or the data has been aggregated and anonymized.

6.2 YouTube API Services

The owner-operated Fixlify AI desktop publisher uses YouTube API Services only for the YouTube channel authorized by its owner. It accesses and locally stores:

• Channel identity and video data, including video IDs, titles, descriptions, tags, category, privacy and processing status, and scheduled publish time.
• A Google OAuth refresh credential and resumable-upload session data encrypted with Windows DPAPI, plus API read-back data in a local SQLite ledger.
• Data needed to verify the exact channel, upload operator-approved videos as Private, reconcile current YouTube state, apply explicitly approved metadata, and schedule explicitly approved releases.

This YouTube data stays on the authorized operator's Windows account and is not sent to Fixlify application servers. It is not shared with external parties except as necessary to send the operator's requested actions to Google and YouTube, and it is not used for advertising, profiling, data brokerage, or training generalized AI models. See the Google Privacy Policy.

The authorized operator can disconnect YouTube through the publisher's Disconnect YouTube command, which immediately requests programmatic revocation from Google and deletes the local YouTube API state. Access can also be revoked from the Google security settings. After revocation or a deletion request, locally stored YouTube Authorized Data is deleted as soon as possible and no later than 7 calendar days. While access remains active, other stored YouTube API data is refreshed or deleted within 30 calendar days.

Deleting the publisher's local data does not delete videos or other content stored by YouTube. The channel owner must use YouTube or YouTube Studio to delete content from YouTube.

7 Your Rights and Choices

• Access: View your personal information through the app
• Correction: Update your profile information anytime
• Deletion: Request account or stored-data deletion via care@fixlify.app
• Location Opt-out: Disable background location in settings
• Notifications: Disable push notifications in device settings
• Analytics: Change your analytics preference at any time

GDPR Rights (European Users)

Right to access, rectification, erasure, restrict processing, data portability, object to processing, and withdraw consent.

CCPA Rights (California Users)

Right to know, access, delete, and opt-out of sale (note: we do not sell personal information).

8 Children's Privacy

Fixlify is not intended for use by individuals under 13 years of age. We do not knowingly collect personal information from children under 13.

9 Data Retention

We retain your information for as long as necessary to provide our services. Upon account deletion, personal data is deleted within 30 days. Some records may be retained for legal or business purposes. The shorter YouTube API deletion and refresh periods described in Section 6.2 apply to YouTube data.

10 Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via in-app notification or email.

11 Contact Us

For questions or requests regarding this Privacy Policy: