Privacy Policy

Fixier ("we") operates fixier.co and provides production audits, fixes, and builds for software products. For everything in this policy we decide why and how your data is used: we are the data fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act), and the controller under the EU and UK General Data Protection Regulation (GDPR) where it applies to you. You can reach us at admin@fixier.co.

What you submit. The audit-request form asks for your email address, and optionally a phone number, a repository or app URL, a description of your stack, and a description of your product. The question form on our company page asks for your name, email address, optionally your firm's name, which service you're asking about and your question; it is emailed to us and not kept in our database. If you email us instead, we receive whatever you choose to send.

What the infrastructure sees. Your IP address is used to rate-limit the form and the button counter below (an anti-abuse measure) and is deleted automatically shortly after — we keep no long-term record of it. The phone field prefills your country's calling code using Cloudflare's edge geolocation; that lookup is not stored. Cloudflare, which serves the site, generates short-lived operational logs of requests; these expire within days.

Which buttons get pressed. When you click one of the calls to action — "Book an Audit", "Request NDA", "Install GitHub App", and so on — we record that the button was pressed, which page it was on, the country Cloudflare places the request in, your browser's user-agent string, and the site you arrived from (the domain only, never the page or what you searched). Nothing identifying is attached and nothing is stored in your browser, so these are counts rather than a trail: nothing links two presses to the same person. The one exception is deliberate and visible to you — if you go on to submit the form, the buttons you pressed on that page are sent with it, so we know what you'd already looked at when we reply.

Commenting on a post. When you comment a keyword we've asked for on one of our posts, Instagram tells us your comment, your username, an account identifier, and which post it was on. We use it to send you one automated private reply: on most posts a payment link, and on some a question about your app that starts a short automated chat ending in a link to book a call at no charge. We also use it to know who a link belongs to when it's paid or opened.

Answering our questions. If you answer what those automated messages ask — what stage your app is at, its link, your email address, a short description of your idea — we store your answers with the conversation and use them to prepare for the call and send you its details. The answers, the messages exchanged, and where you are in the conversation are also copied into a Google Sheet (Google LLC, servers in the United States) that we use as our working list.

Messaging us directly. If you send our account a direct message, we store the message text, your username where Instagram provides it, and the same account identifier, so that a person can read it and reply. Instagram allows us 24 hours to answer, which is why the message is recorded rather than only read. Unless you're answering a question one of our automated messages has just asked, nothing is sent back to you automatically.

About that identifier. It is scoped to our app by Instagram: it identifies you to us and to nobody else, and it cannot be used to look you up on Instagram or anywhere on the internet. We never receive your email address, phone number, follower list, or anything else from your profile — only what you choose to type to us.

This is Meta Platforms' data, processed under their terms as well as this policy. You can end it at any time from Instagram's own settings, and see the deletion section below for removing what we already hold.

When you message our WhatsApp Business number, WhatsApp gives us your phone number, your WhatsApp profile name, what you send, and, if you came from one of our ads, which ad it was. The same automated chat as on Instagram answers: our offer, a short list of common questions you can tap, and the questions above. Anything else you type is read and answered by a person. Your messages are stored, kept and deleted exactly as Instagram messages are, and copied into the same Google Sheet. We use your number only to reply to you in that chat.

This reaches us through Meta Platforms (WhatsApp), under their terms as well as this policy. You can block the number at any time, and see the deletion section below for removing what we already hold.

The booking fee is collected by Razorpay, our payment gateway. The sale is ours — you are our customer — and Razorpay processes the payment on our behalf. You enter your details on their payment page, governed by their privacy policy.We never see or store your card number.

What reaches us is the amount, the currency, a payment reference, and the email and phone number you gave them — enough to know who paid and to raise your invoice. The amount depends on the country your connection is in when you click: India is billed in rupees, everywhere else in US dollars. Refunds and billing disputes are handled by us.

Invoices for the audit itself are raised by us, in Zoho Books, and carry the billing details you give us for that purpose.

If we sign a non-disclosure agreement through our signing page, we keep the signer's name, email and company, the signed PDF, and the evidence that makes an electronic signature hold up: the time, the IP address, browser user-agent, language setting and country at the moment of signing, and the exact text you agreed to. The signed copy is emailed to both sides through Resend.

When you install our GitHub App, GitHub tells us your GitHub username, account id and which repositories you chose, and we copy those repositories to storage we control (Cloudflare R2) so we can work on them. Engineers working on your project — the founders, or a freelancer bound by a written NDA — download it from there through a link that expires.

If your code or any environment you give us access to contains personal data about your own users, we handle that data only on your instructions, as your processor, under the data protection clause of our agreement with you — not under this policy. Please send masked or synthetic data where you can.

We keep a client record: your name, company, email, phone, job title and timezone, the meetings and messages we exchange, notes on the work, the documents we share with each other, and invoices and payments. It lives in our own dashboard. Freelancers working on your project can see the parts of it the work needs — never payment details or our fees.

The site sets no cookies and writes nothing to your browser's storage. The one exception is the payment page, which loads Razorpay's checkout so you can pay; Razorpay may set the cookies it needs to process the payment and prevent fraud, under its own policy. The site runs no third-party analytics, advertising, or tracking scripts of any kind — the button counter above is our own, first-party, and carries no identifier, so there is no profile to build and nothing that follows you to another site. There is no consent banner because there is nothing to consent to. If you never submit the form or email us, we hold no personal data about your visit.

To answer you, to do the work you hire us for, and to meet our legal obligations. We don't use your details for marketing lists, we don't add you to anything, and we don't sell or rent personal data to anyone. The legal basis for each:

When you get in touch (the form, an email, an Instagram comment or message): taking the steps you asked for before a possible contract, and our legitimate interest in replying to people who write to us. Under the DPDP Act, your consent, given by writing to us, which you can withdraw at any time.

When you pay, sign an NDA, give us code, or become a client: performing the contract with you, and keeping the records tax and accounting law requires.

The button counter, IP rate-limiting, and the evidence kept with a signature: our legitimate interest in knowing which pages work, stopping abuse, and being able to prove an agreement was signed. None of these is used to identify or profile you.

Our database and file storage are Cloudflare's (D1 in its Asia-Pacific region, R2), and Cloudflare serves the site. Form submissions and Instagram conversations are copied into Google Sheets (Google LLC, United States) that we use as our working lists — the same data, nothing extra — and the button-press counts go to a sheet and nowhere else. Emails go out through Resend (United States), and mail to our addresses is forwarded by Cloudflare to Gmail (Google LLC, United States). Calls are booked through Calendly (United States), which stores what you enter there. Instagram comments and messages, and WhatsApp messages, reach us through Meta Platforms. Payments are processed by Razorpay (India), invoices and accounting records are kept in Zoho Books, and code you share is held in Cloudflare R2 as described above. These providers process data on our behalf, except Meta and Razorpay, which also decide for themselves how they use what they hold and do so under their own privacy policies.

We are based in India, so your data is processed outside the EU and UK. Where the GDPR applies, transfers to these providers rely on the European Commission's standard contractual clauses in their data processing terms, or on the EU–US Data Privacy Framework where the provider is certified; email us for a copy of the safeguards. The DPDP Act permits the cross-border transfers involved.

Access is limited to the two founders, and to freelancers working on your project for the parts the work needs, each bound by a written NDA with a data protection clause.

These are deleted automatically, in both our database and our working sheets:

• An Instagram or WhatsApp conversation that never led to a payment or a booked call: 30 days after it last moved.
• Any other enquiry that never became work — the form, a booked call that went nowhere: 12 months.
• Instagram and WhatsApp messages in our inbox: 30 days.
• Code from a GitHub App install that never became a conversation: 30 days.
• IP addresses used for rate-limiting, and infrastructure logs: within days.

For clients, the client record and your code are kept for the engagement; your code is deleted when the engagement closes. A signed NDA and its evidence are kept for as long as the agreement can be enforced. Payment and invoice records are kept as long as tax and accounting law requires — currently eight years in India — because we cannot delete a record of money received; that obligation overrides a deletion request, and only for those records.

You can ask us what personal data we hold about you and for a copy of it, to correct it, to delete it, or to withdraw consent. Under the GDPR you can also ask us to restrict how we use it, to give it to you in a portable format, and object to processing based on our legitimate interests. Under the DPDP Act you can nominate someone to exercise these rights for you. Email admin@fixier.co — that address is also our grievance contact. We reply within one month.

If you're not satisfied, you can complain to the Data Protection Board of India, or, if you're in the EU or UK, to the data protection authority where you live or work. To delete what we hold, see the next section.

Email admin@fixier.co from the address you contacted us on, or tell us your Instagram username if that's how you reached us, and ask us to delete your data. You do not need an account, a form, or a reason. We delete everything we hold about you and confirm when it's done, normally within seven days.

That covers the form submission, our copies in the working spreadsheets, any Instagram comment or message we recorded, the record of which buttons were pressed alongside your submission, code you gave us access to, and your client record. The only things we cannot delete are a record of money actually received, which tax law requires us to keep, and a signed NDA while it can still be enforced — we will tell you if either applies to you and delete everything else.

To stop Instagram sending us anything further, remove our app from Instagram's own settings, under the apps and websites section of your account. That ends the connection at their end; email us as well if you want what we already hold removed.

The site is served exclusively over HTTPS, submissions are validated and rate-limited at the edge, and stored data sits in managed, access-controlled infrastructure. No system is perfectly secure — if a breach ever affects your personal data, we'll notify you and the Data Protection Board as the DPDP Act requires, and, where the GDPR applies, the competent data protection authority within 72 hours of learning of it.

Our services are for businesses and are not directed at anyone under 18. We don't knowingly collect children's personal data.

If this policy changes, the new version appears here with an updated effective date. Material changes to how we handle already-submitted data will be emailed to affected people first.