Privacy Policy

Who we are

This policy explains how Fixray handles personal data, both on this website and in the Fixray app. Fixray is operated by Fixray Ltd, a company registered in England and Wales under company number 17347585. Fixray Ltd is the data controller for personal data collected through our website and for account sign-ups. Where your organisation uses the Fixray app to log and resolve maintenance issues, your organisation is the controller for that data and Fixray Ltd acts as its processor. If you have any question about your data, or want to exercise any of the rights below, email hello@fixray.app and we'll come back to you.

The two roles we play

Who is responsible for your data depends on how you're using Fixray:

• Our website, demo bookings, downloads and sign-ups. Here Fixray decides how and why your data is used — we're the controller, and you can contact us directly about it.
• Maintenance data inside the app. Here your organisation decides what gets recorded and why, so your organisation is the controller and Fixray acts as its processor — we only handle that data on their instructions, under a data processing agreement. For that data, speak to your organisation's Fixray administrator. If you're not sure who that is, ask us and we'll point you in the right direction.
• The account records we keep about app users. Even if you never visited this website — because your manager invited you — we keep a record of your name, email and which organisation you belong to, including in our own customer system, so we can administer accounts and support the organisations we work with. We're the controller for that, we got those details from your employer, and you can contact us about it directly.

What we collect

• Account and profile — your name, email address and role (reporter, fixer, manager or admin).
• Maintenance content — the issues you and your colleagues log, plus any photos, videos and voice notes attached to them. These can include other people's personal data if someone appears in a photo or is named in a report.
• Device tokens — so we can send you push notifications.
• Demo requests and downloads — the details you enter on those forms.
• Your IP address, briefly — when you use our demo, download or site sign-in forms, we hold your IP address in memory for a short time (scrambled, on the public forms) to rate-limit automated abuse. We don't write it to our database or our application logs. Our hosting providers do keep their own standard network logs, which is normal for any website.
• Usage and analytics data — how the service is used, so we can keep it working and improve it. On our website this only happens with your consent; in the app it's cookieless. See our Cookie Policy for the detail.

Why we use it, and our legal basis

Where we rely on legitimate interests, we've weighed our interest against your privacy, and we'll share that assessment if you ask. Where we rely on consent, you can withdraw it at any time — that won't affect anything we did before you withdrew it.

AI features

To save you time, Fixray can transcribe voice notes, suggest an issue description, category and likely cause, match an issue to the right asset, and write the summary in your weekly report. To do that, the relevant content is sent to our AI provider — OpenRouter, which routes it to Google's Gemini model — purely to generate that output. For asset matching, your organisation's asset list (names, types, makes and models) is sent along with the issue so the right match can be found.

Every suggestion is a starting point for a person to review and change. No decision with legal or similarly significant effect is ever made about you by AI alone.

Who we share data with

We don't sell your data. We share it only with the service providers who help us run Fixray, under contracts that require them to protect it and to act only on our instructions:

• Supabase — hosting, database and file storage (UK/EU region)
• Cloudflare — content delivery, security and anti-abuse, and storing our encrypted off-site backups
• Resend — sending email
• Google Workspace — our business email. It handles mail you send us, and mail we send you from a person's address rather than from our automated sender
• HubSpot — our customer records, covering both marketing contacts and a record of app account holders and the organisation they belong to
• Sentry — error monitoring and crash diagnostics (EU region). We strip out email addresses, IP addresses and cookies before reports are sent — and any email address or access token that appears in the text of the error message itself. What remains is the technical error plus reference numbers for the account, organisation and site. Those aren't your name or email, but we can link them back to your account — that's what lets us trace a fault to the right place. We do not record or replay your session.
• OpenRouter and Google — the AI features described above
• PostHog — product and website analytics
• Apollo — recognising which companies visit our marketing site, to inform our sales outreach. This runs only on our public website and only if you allow analytics cookies; it is never used inside the app. Apollo is also where we obtain business contact details, and one of the ways we send the emails described in If we've contacted your business — in that role Apollo decides for itself how it collects and sells that data, so it is not acting only on our instructions
• Anthropic — the AI assistant that runs the business-prospect outreach described below. It processes the contact's details and any reply they send. It is not used for the AI features inside the app
• Slack — our own internal workspace, where summaries of that outreach appear. It holds no app or customer data
• Stripe — payments and subscriptions
• GitHub — hosting our source code and running the automation that produces those encrypted backups
• Apple, Google and Mozilla — delivering push notifications to your device

We may also disclose data where the law requires it, or where we need to protect our rights or someone's safety.

Sending data outside the UK

Your account and maintenance data is hosted in the UK/EU. Our encrypted off-site backups are held by Cloudflare, which may store them outside the UK/EU. Some of our providers also process data outside the UK. When data goes outside the UK we rely on a UK-approved safeguard — the International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses — which those providers' data processing agreements put in place.

How long we keep it

• Account and maintenance data — for as long as your organisation uses Fixray. When an administrator deletes a user, we replace the name, email and photo on their profile with anonymous placeholders, and we either delete their sign-in account or, where their maintenance records reference it, irreversibly anonymise it so it can no longer be used to sign in. Two things deliberately survive that: the maintenance records they created — including photos, videos and voice notes — stay in your organisation's account, and we keep an internal audit record of the deletion which includes the original name and email for 12 months, after which those identifiers are removed automatically. Their record in our customer system is removed when their account is deleted. When you close your organisation's account, or ask us to delete its data, we delete it from the live service within 30 days.
• Marketing contacts — until you unsubscribe or ask us to delete them. Business contacts we approached but who never replied are deleted after 12 months either way; see If we've contacted your business.
• Analytics — up to 12 months.
• Backups — copies in our encrypted backups are removed as those backups age out, within a further 90 days after deletion from the live service.

If you want a full erasure rather than the standard deletion described above, ask us and we'll carry it out.

How we protect it

Data is encrypted in transit using HTTPS, and files are held in encrypted storage. Access is restricted by authentication and role-based permissions, and each organisation's data is kept logically separated so one customer can't see another's.

Your rights

Under UK data protection law you can ask us to:

• Access a copy of your personal data
• Correct anything that's wrong
• Delete it
• Restrict or object to how we use it
• Port it to another provider
• Withdraw consent, where consent is what we relied on

You can also object to marketing at any time — email hello@fixray.app, reply to any email a person at Fixray sends you, or use the unsubscribe link where an email carries one. If we emailed you at your business about Fixray and you've never used it, see If we've contacted your business below.

For website, marketing or account data, email hello@fixray.app. For data your organisation holds in the app, contact your organisation's Fixray administrator. We'll respond within one month.

Complaints

If you're unhappy with how we've handled your data, please tell us first at hello@fixray.app. You have the right to complain directly to us — we'll acknowledge your complaint within 30 days and let you know the outcome.

You also have the right to complain to the UK regulator, the Information Commissioner's Office, at ico.org.uk — though we'd appreciate the chance to put things right first.

Children

Fixray is a workplace tool and isn't aimed at children. We don't knowingly collect data from anyone under 16.

Cookies

For how we use cookies and similar technologies, see our Cookie Policy.

Changes to this policy

We may update this policy from time to time. We'll update the "last updated" date at the top, and for significant changes we'll take reasonable steps to let you know.