Privacy Policy

FixWeb is operated by EGO HERO LLC (“we”, “us”), the data controller for the personal data described in this policy. For privacy questions, including data subject requests under GDPR, UK GDPR, or CCPA, contact privacy@fixweb.app. For anything else, write to support@fixweb.app.

• Account data

  Email address, OAuth identifier (if you sign in with Google or GitHub), and any name we receive from your OAuth provider. Used to authenticate you and contact you about your account. Retained while your account is active. Account deletion removes the account and owned-organization scan data; stored files are deleted shortly after. Some audit and billing records may remain when needed for legal, accounting, or tax purposes.

  lawful basis · Performance of contract — Art. 6(1)(b) GDPR

• Scan targets and findings

  The URLs you scan, the requests we make to those URLs, and the findings we produce. Free-tier account scans are kept for 7 days. A paid check-up report and its results are kept for 1 year. Unpaid anonymous scans are kept for 24 hours. Daily cleanup can make deletion lag by up to a day. Account → Privacy provides data export and account deletion; it does not provide a separate scan-history delete control.

  lawful basis · Performance of contract — Art. 6(1)(b) GDPR

• One-off check-up reports

  A one-off check-up costs $9 and includes a report, fix prompts, a PDF, and a report link kept for one year. If the check-up cannot run, we automatically refund the full payment.

  lawful basis · Performance of contract — Art. 6(1)(b) GDPR

• Anonymous scan sessions

  If you run a scan without signing in, we issue an HMAC-signed cookie (fixweb_anon_session) holding an opaque random ID. Unpaid anonymous scan records are kept for 24 hours. After a check-up purchase, the buyer's anonymous session can remain for 365 days so the report can be reopened; the paid report and results are kept for 1 year. Guest purchase records include the payer email, order, refund state, and delivery records and are kept as long as needed for accounting and tax records. If you sign up within those 24 hours, an unpaid scan can move into your account.

  lawful basis · Strictly necessary — ePrivacy Art. 5(3) exemption

• Billing data

  Stripe processes payments and stores card details on PCI-DSS infrastructure. FixWeb stores billing records including customer, order, payment-session, amount, currency, payer-email, subscription, refund, delivery, and webhook-event information. Guest purchase records are kept as long as needed for accounting and tax records. Card summaries and invoice links may be cached for 60 seconds by Upstash. See Stripe's privacy notice at stripe.com/privacy.

  lawful basis · Performance of contract — Art. 6(1)(b) GDPR

• Server logs and audit logs

  Short-lived API request logs may include IP address, user-agent, method, path, status, duration, request ID, user/org context, and error strings so we can debug the service and detect abuse. Request logs are automatically pruned after 72 hours; daily cleanup can make deletion lag by up to a day. Audit logs for security-relevant actions may include IP address, user-agent, and request metadata and are automatically pruned after 540 days (about 18 months), except where a longer period is required for legal process or a legal claim.

  lawful basis · Legitimate interest — Art. 6(1)(f) GDPR

• API tokens + MCP server (On call)

  On call includes API and MCP access. Tokens you create at Account → API tokens are stored as a SHA-256 hash, the first 8 plaintext characters for identification, the name you assigned, and created, last-used, and revoked timestamps. The plaintext is shown once and never persisted. The MCP server at /api/mcp uses the same tokens and exposes the API operations made available to your account.

  lawful basis · Performance of contract — Art. 6(1)(b) GDPR

• Analytics (optional, consent-gated)

  Browser analytics through PostHog loads only after you grant analytics consent and is proxied through our own domain. Session replay is switched off. You can withdraw consent via Cookie settings. Separately, our servers record service events such as a scan starting or finishing, with the scanned hostname and an internal account or session ID, to run and improve the service; these server events do not use cookies.

  lawful basis · Consent — Art. 6(1)(a) GDPR and ePrivacy Art. 5(3)

For some evaluations, we send page URLs, extracted page text and structure, and screenshots to AI providers including KIE and Google Gemini. We use this data to judge content, design, and answer readiness. Results are generated automatically and can be wrong. Page text and screenshots can contain anything the site publishes.

• We never sell your data.
• We don't use third-party ad-tech or fingerprinting, and session replay is switched off.
• We don't use your scan target URLs or finding evidence for advertising or third-party marketing. Evidence is stored in our database or file storage and may be sent to AI providers and transactional-email providers as described above.
• We don't share your data with third parties for their own marketing.

We rely on the following sub-processors to run FixWeb:

• Vercel Inc. (USA) — application hosting and edge network. Privacy notice: vercel.com/legal/privacy-policy.
• Supabase Inc. (USA) — Postgres database, authentication, file storage, Realtime. The FixWeb production database is in the AWS us-east-1 region. Privacy notice: supabase.com/privacy.
• Stripe Inc. (USA) — payment processing for one-off check-ups and monthly subscriptions. Privacy notice: stripe.com/privacy.
• Upstash, Inc. (USA, via the Vercel Marketplace) — rate limiting and short-lived caches. It receives request counters keyed by IP address, account, or token; usage counters; and 60-second caches of card summaries and invoice links. Privacy notice: upstash.com/privacy.
• PostHog Inc. (USA) — browser analytics only after consent, plus server-side service events such as scan started or finished with the scanned hostname and an internal account or session ID. Session replay is switched off. Privacy notice: posthog.com/privacy.
• GitHub, Inc. (USA) — sign-in, and repository access only if you connect it. Privacy notice: docs.github.com/site-policy/privacy-policies/github-general-privacy-statement.
• Resend, Inc. (USA) — all transactional email, including purchase receipts, report-recovery links, results, refund notices, and account emails. It receives your email address and message body plus delivery metadata. Privacy notice: resend.com/legal/privacy-policy.
• KIE (kie.ai) — AI analysis of pages we check, including page URLs, extracted page text and structure, and screenshots. Privacy notice: kie.ai.
• Google LLC (USA) — Gemini API as a fallback AI provider, using the same page data as KIE including screenshots; PageSpeed Insights and Chrome UX Report using page URLs; Google sign-in; and Search Console only when a verified site owner connects it. Privacy notice: policies.google.com/privacy.
• Zoho Corporation — bookkeeping records for each sale, including amount, currency, date, product, and the billing name and email on the payment. Privacy notice: zoho.com/privacy.
• Hostinger — hosting for the support@fixweb.app and privacy@fixweb.app mailboxes, including emails you send us. Privacy notice: hostinger.com/legal/privacy-policy.

Transfers of personal data outside the EEA/UK rely on the European Commission's Standard Contractual Clauses (or the UK's International Data Transfer Addendum), supplemented by the encryption-in-transit and encryption-at-rest measures described in “Security” below.

We will update this list and notify customers in-app if we add a new sub-processor that processes personal data on our behalf.

Under GDPR, UK GDPR, and equivalent laws (CCPA/CPRA, LGPD, PIPEDA, Australian Privacy Act etc.), you have the right to:

• access a copy of your data (you can do this self-serve from Account → Privacy);
• have your data corrected;
• have your data deleted (also self-serve);
• object to processing based on legitimate interests;
• withdraw consent for analytics at any time via Cookie settings;
• data portability — your export is in JSON;
• lodge a complaint with your local supervisory authority (EU/UK/EEA) or equivalent.

We respond to verifiable rights requests within 30 days. For requests we cannot satisfy via self-serve (rectification of a field we don't expose, restriction of processing, objection), email privacy@fixweb.app with subject line “Privacy request”.

We do not sell your personal information. We do not share personal information for cross-context behavioral advertising. Analytics through PostHog only runs after you grant consent in our cookie banner; you can withdraw that consent at any time via Cookie settings or by clicking Your Privacy Choices in the footer.

If you are a California resident, you also have the right to:

• know what personal information we collect, the sources, the purposes, and any third parties with which we share it (all detailed above);
• request deletion of your personal information (self-serve via Account → Privacy or by emailing us);
• correct inaccurate personal information;
• limit the use and disclosure of sensitive personal information where this right applies to your data;
• opt out of sale or sharing — not applicable since we do neither;
• not be discriminated against for exercising any of the above.

If you have not made an analytics choice, a browser Global Privacy Control (GPC) signal is treated as a refusal of analytics. It does not override a choice you already made, and we do not process a Sec-GPC request header on the server.

We force row-level security on every database table; users only see records belonging to organizations they are members of. Authenticated-scan headers, when supplied, are encrypted at rest with AES-256-GCM and purged after the scan completes. Stripe webhook payloads are HMAC-verified before processing. The service-role database credential is held only on the server runtime and is never exposed to the browser. All traffic between you and FixWeb, and between FixWeb and our sub-processors, uses TLS 1.2 or higher.

No operational program is perfect. If you believe you have found a weakness in FixWeb itself, please report it to support@fixweb.app.

If we make material changes — new sub-processors, new categories of data, new retention periods — we'll update the date above and notify you in-app. Minor wording fixes don't trigger a notification.

privacy@fixweb.app — replies usually within 5 business days, never longer than 30 days as required by GDPR Art. 12(3).