Privacy Policy

1. Introduction

Fixiweb, LLC ("FixiWeb," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website monitoring and analysis service (the "Service").

Please read this Privacy Policy carefully. By accessing or using the Service, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.

If you do not agree with our policies and practices, please do not use the Service.

2. Information We Collect

2.1 Information You Provide Directly

Account Information - Name - Email address - Password (stored in encrypted form) - Phone number (for WhatsApp notifications, optional) - Company name (optional) - Billing address (for paid subscriptions)

Payment Information - Credit card details (processed securely by our payment processor, Stripe) - Billing history - Subscription preferences

Website Information - URLs of websites you submit for scanning - Configuration settings and preferences - Notes and annotations you add to reports

Communications - Support requests and correspondence - Feedback and survey responses - Marketing preferences

2.2 Information Collected Automatically

Usage Data - Features you use and actions you take - Scan history and results - Report views and downloads - Login times and session duration

Device and Browser Information - IP address - Browser type and version - Operating system - Device type and identifiers - Screen resolution

Cookies and Similar Technologies - Session cookies (to keep you logged in) - Preference cookies (to remember your settings) - Analytics cookies (to understand how you use the Service) - See Section 8 for more details on cookies

2.3 Information from Third Parties

OAuth Providers If you sign in using Google or other OAuth providers, we receive: - Your name and email address - Profile picture (optional) - Account identifier

Payment Processor From Stripe, we receive: - Confirmation of successful payments - Subscription status - Limited payment method information (last 4 digits of card)

2.4 Information About Scanned Websites

When you use FixiWeb to scan a website, we collect: - Publicly available information from the website - Technical data (response times, headers, SSL certificates) - Screenshots (for visual analysis) - Detected issues and their details

Important: We only scan websites you explicitly submit. We do not scan any website without your instruction.

2.5 WordPress Plugin Data

When you use the FixiWeb WordPress Plugin, the plugin:

• Syncs site configuration data and page information with the FixiWeb Service
• Receives and executes fix commands initiated from the FixiWeb dashboard
• Transmits plugin status, WordPress version, and active theme/plugin information for compatibility purposes

2.6 Domain Verification Data

When you verify domain ownership, we collect:

• DNS records or verification tokens associated with your domain
• Domain registration information (as publicly available via WHOIS or DNS lookups)
• Verification status and timestamps

2.7 Website Access Authorization

By adding a website to FixiWeb for monitoring, you authorize FixiWeb to:

• Analyze publicly accessible content, HTML structure, metadata, response headers, and technical configuration of the website
• Capture screenshots of publicly accessible pages for visual analysis
• Access linked resources (CSS, JavaScript, images) to the extent necessary for issue detection

By authorizing the Computer Use Agent to execute a fix, you additionally authorize FixiWeb to access your CMS administrative interface for the sole purpose of applying the specific fix you have approved. This access is temporary, session-bound, and does not extend beyond the approved action.

You confirm that you own or are authorized to manage any website you add to FixiWeb.

3. How We Use Your Information

3.1 To Provide the Service

• Create and manage your account
• Process website scans and generate reports
• Provide AI-powered recommendations
• Send notifications about scan results and issues
• Process payments and manage subscriptions
• Provide customer support

3.2 AI Processing

FixiWeb uses artificial intelligence to analyze website data and generate automated fixes. Specifically:

• AI Issue Detection: Scan data — including page content, metadata, HTML structure, response headers, and detected issues — may be processed by AI models to identify problems and generate recommendations.
• Third-Party AI Providers: This processing may involve third-party providers including OpenAI and Anthropic. Data sent to these providers is used solely to respond to our analysis requests and is not used for model training. We maintain data processing agreements with all AI providers.
• Computer Use Agent: Automated fixes normally run through your platform's own API, the FixiWeb connector, or a deterministic playbook. The Computer Use Agent is a separate path you start yourself: if you opt in to it, an AI agent (powered by Anthropic Claude) interacts with your website's CMS interface on your behalf and captures screenshots during the session as a record of what it did. Screenshots are stored in Cloudflare R2 encrypted storage and are accessible only through authenticated requests.
• AI Output Limitations: AI-generated recommendations and fixes may be incomplete or inaccurate. You are responsible for reviewing all AI outputs before approving any changes to your website.
• Data Minimization: We process only the minimum data necessary to deliver accurate analysis results.

3.3 To Improve the Service

• Analyze usage patterns to improve features
• Train and improve our AI models
• Identify and fix bugs and errors
• Develop new features and services

3.4 To Communicate with You

• Send service-related notifications
• Respond to your inquiries and requests
• Send marketing communications (with your consent)
• Notify you of changes to our Terms or Privacy Policy

3.5 For Security and Compliance

• Detect and prevent fraud and abuse
• Enforce our Terms of Service
• Comply with legal obligations
• Protect our rights and property

3.6 Legal Bases for Processing (GDPR)

If you are in the European Economic Area (EEA), we process your personal data based on:

3.7 Autonomous Operations Scope

FixiWeb provides automated monitoring and AI-assisted improvements, but the website owner remains fully responsible for the operation, content, legality, and compliance of their website at all times. FixiWeb acts as a service provider executing instructions you approve — it does not assume operational or editorial responsibility for your website. Enabling autonomous monitoring, approving automated fixes, turning on Autopilot or authorizing a specialist-assisted repair does not transfer any aspect of that responsibility to FixiWeb.

When a FixiWeb specialist helps complete a repair you requested or approved (Terms §2.2B), the specialist sees only the case details that repair needs — the finding, the affected pages and the proposed change — and never your credentials. Every specialist action is recorded with who acted, under which authorization, and what was changed.

4. How We Share Your Information

4.1 Service Providers

We share information with third-party vendors who help us provide the Service:

All service providers are contractually obligated to protect your data and use it only for the specified purposes.

4.1.1 WhatsApp Notifications (Twilio)

If you opt in to WhatsApp notifications, your phone number is shared with Twilio to deliver scan alerts, issue notifications, and scheduled reports via WhatsApp. You can opt out of WhatsApp notifications at any time through your account settings. When you opt out, your phone number is removed from the notification service.

4.1.2 Screenshot Storage (Cloudflare R2)

Website screenshots captured during scans and automated fix sessions are stored in Cloudflare R2 object storage. Scan screenshots are used for visual issue analysis. Where a fix changes something visible on the page, before-and-after screenshots are kept as evidence of the change; screenshots from a Computer Use Agent session you opt into record the actions it took on your behalf. Screenshots are encrypted at rest and shown in your dashboard only through authenticated requests. Captures of your website's public pages are also held at a permanent, unlisted address on our content-delivery domain and are not currently deleted on any schedule. Highlighted issue screenshots are deleted after 30 days, and fix-session recordings after 30 days (failed sessions) or 90 days (successful sessions). Screenshots stored under your account are deleted when you delete your account; captures of public pages that are stored by website address rather than by account are not.

4.1.3 AI Processing Providers (OpenAI and Anthropic)

Scan data, including page content and detected issues, may be sent to OpenAI and/or Anthropic for AI-powered analysis and recommendation generation. These providers process data solely for the purpose of responding to our API requests. Data sent to these providers is not used for model training, and we maintain data processing agreements with both providers to ensure compliance with applicable data protection laws.

4.2 Business Transfers

If FixiWeb is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have.

4.3 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., court orders, government agencies).

4.4 With Your Consent

We may share your information with third parties when you have given us explicit consent to do so.

4.5 Aggregated and Anonymized Data

We may share aggregated, anonymized data that cannot reasonably be used to identify you. For example, we may publish statistics about the most common website issues detected by our Service.

5. Data Retention

5.1 Retention Periods

5.2 Account Deletion

When your account deletion is processed, the data held under your account — including scan results, reports, fix history, monitoring history, notifications and records we hold under your email address — is deleted immediately, and we then re-check every collection to confirm it is gone. Your account is closed at that moment. About 30 minutes later a final pass runs: it removes anything our systems were still in the middle of writing when the deletion began, re-checks every collection again, and only then removes your login record and sends your confirmation. Your confirmation tells you exactly what, if anything, was not deleted and why: records we must keep by law (such as invoices) are retained, and a small number of records that cannot be attributed to a single account are named as such. Some information may remain in encrypted database backups until those backups expire under our database provider's backup schedule. Anonymized, aggregated data may be retained indefinitely.

Deleting your account also cancels any subscription and, if a customer record was ever created for you at our payment processor, Stripe, deletes that record, including any saved payment method. We report it as deleted only when Stripe confirms the deletion. Invoices and payment records already issued are kept, by Stripe and by us, because tax and accounting law require them; they are the only billing records that remain.

When you approve FixiWeb on a WordPress site, we record the version of the approval wording you were shown, when, and how, and a short list of the setup actions we took on your site under it (such as switching on our plugin). You can see that list on the connection’s page in Settings, and it is removed when you disconnect or delete your account.

Access you granted on your own website or platform is separate from the data we hold. When you delete your account or remove a site, we first try to withdraw the two grants that let us do so ourselves — a WordPress application password and the FixiWeb Shopify app — and we report one as withdrawn only after checking that it no longer works. Everything else stays valid on your site until you remove it there: the FixiWeb WordPress plugin, a Wix app or connector, a Webflow API token, a website admin login you gave us, and any grant we could not confirm as withdrawn. Your confirmation email names each one with the step that removes it.

5.3 Inactive Accounts

We do not currently delete inactive accounts automatically. If we introduce inactivity-based deletion, we will update this policy and give 30 days' notice to the registered email address before deleting any account.

5.4 Landing-Page Scans

You can run a scan from our home page without creating an account. When you do, we keep a record of it: the address of the website you asked us to scan, the results of that scan, and technical details of the request — your IP address, your browser's user-agent string and the page you arrived from. (We keep two records of a landing scan; one holds your IP address in full and the other holds only a one-way hash of it.) If you also give us an email address — for example to have the report sent to you — we keep that too, alongside the scan.

We keep these records indefinitely. There is no automatic deletion date. We keep them because a scan tells us something durable about the state of the web that we use to improve the Service, and because an address you gave us so that we could contact you is not something we want to lose track of. The record that holds the hashed IP address — the one we treat as the prospect record — was previously deleted automatically after 90 days, and we have decided to stop doing that. Until that change reaches our database, a record of this kind may still be removed after 90 days. The other record has never had an automatic deletion date. This section is here to say so plainly rather than leave you to assume a window that does not exist.

This is not a marketing consent and we do not treat it as one. You can ask us to delete a landing-page scan record, including any email address attached to it, at any time and for any reason, by emailing privacy@fixiweb.ai with the website address you scanned. We will delete it within 30 days, and you do not need an account to ask.

6. Your Rights and Choices

6.1 All Users

Access: You can access most of your information through your account dashboard.

Update: You can update your account information at any time through the Settings page.

Delete: You can delete your account at any time from Settings → Security → Delete account. You confirm with your account email address and, if you signed up with a password, that password. You can also contact support@fixiweb.ai.

Export: You can download your data as a JSON file from Settings → Security → Download your data. Passwords, tokens and other secrets are withheld, and records shared with other customers are listed rather than included. If the file reports that it is incomplete, contact support to receive the remainder.

Marketing Opt-Out: You can unsubscribe from marketing emails at any time using the link in the email or through Settings.

Notification Preferences: You can customize your notification preferences in the Settings page.

6.2 European Users (GDPR Rights)

If you are in the EEA, UK, or Switzerland, you have additional rights:

Right to Access: Request a copy of all personal data we hold about you.

Right to Rectification: Request correction of inaccurate personal data.

Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data.

Right to Restrict Processing: Request that we limit how we use your data.

Right to Data Portability: Receive your data in a structured, machine-readable format.

Right to Object: Object to processing based on legitimate interests.

Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.

Right to Lodge a Complaint: File a complaint with your local data protection authority.

To exercise these rights, contact privacy@fixiweb.ai. We will respond within 30 days.

6.3 California Users (CCPA Rights)

If you are a California resident, you have the following rights:

Right to Know: Request information about the categories and specific pieces of personal information we have collected.

Right to Delete: Request deletion of your personal information.

Right to Opt-Out: Opt out of the "sale" of personal information. Note: We do not sell personal information.

Right to Non-Discrimination: We will not discriminate against you for exercising your rights.

To exercise these rights, contact privacy@fixiweb.ai or use our online form at fixiweb.ai/privacy/request.

7. Data Security

7.1 Security Measures

We implement industry-standard security measures to protect your data:

Technical Safeguards - TLS/SSL encryption for all data in transit - AES-256 encryption for data at rest - Secure password hashing (bcrypt) - Automated security testing and vulnerability scanning

Organizational Safeguards - Limited employee access on a need-to-know basis - Documented incident response procedures

Infrastructure Security - SOC 2 compliant hosting providers - Cloudflare in front of the service, including DDoS protection - A managed database replica set with automatic failover - Regular software updates and patching

7.2 Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will:

• Notify affected users within 72 hours
• Notify relevant data protection authorities as required by law
• Take immediate steps to contain and remediate the breach
• Provide information on steps you can take to protect yourself

7.3 Your Security Responsibilities

You are responsible for: - Maintaining the confidentiality of your password - Using a strong, unique password - Logging out of your account on shared devices - Notifying us immediately of any unauthorized access

8. Cookies and Tracking Technologies

8.1 What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They help us provide and improve the Service.

8.2 Types of Cookies We Use

Strictly Necessary Cookies - Required for the Service to function - Cannot be disabled - Examples: Session cookies, authentication cookies

Functional Cookies - Remember your preferences and settings - Examples: Language preference, display settings

Analytics Cookies - Help us understand how you use the Service - Examples: Google Analytics - You can opt out of these

Marketing Cookies - Used to measure advertising - Our home page loads the Meta, LinkedIn and X advertising pixels only after you choose "Accept all" in our cookie banner (see Section 4.1)

8.3 Managing Cookies

You can manage cookies through:

Browser Settings: Most browsers allow you to refuse or delete cookies. Check your browser's help section for instructions.

Our Cookie Preferences: Use the cookie settings in the footer of our website.

Opt-Out Links: - Google Analytics: https://tools.google.com/dlpage/gaoptout

Note: Disabling certain cookies may affect the functionality of the Service.

8.4 Do Not Track

Some browsers have a "Do Not Track" (DNT) feature. We currently do not respond to DNT signals because there is no industry standard for compliance.

9. International Data Transfers

9.1 Data Location

Our primary servers are located in the United States. If you are accessing the Service from outside the United States, your data will be transferred to and processed in the United States.

9.2 Transfer Mechanisms

For transfers of personal data from the EEA, UK, or Switzerland to the United States, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Processing Agreements with all service providers
• Additional technical and organizational measures

9.3 Adequacy

We ensure that any international transfers of personal data are subject to appropriate safeguards as required by applicable data protection laws.

10. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18.

If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information immediately.

If you believe we have collected information from a child under 18, please contact us at privacy@fixiweb.ai.

11. Third-Party Links and Services

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties.

We encourage you to read the privacy policies of any third-party services you access through the Service.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last Updated" date
• Sending an email notification for significant changes

We encourage you to review this Privacy Policy periodically.

13. Data Protection Officer

For GDPR compliance purposes, we have appointed a Data Protection Officer (DPO). You can contact our DPO at:

Email: dpo@fixiweb.ai

Address:
Fixiweb, LLC
Attn: Data Protection Officer
Newark, DE, USA

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

General Privacy Inquiries - Email: privacy@fixiweb.ai

Data Subject Requests (GDPR/CCPA) - Email: privacy@fixiweb.ai - Online Form: fixiweb.ai/privacy/request

Security Concerns - Email: security@fixiweb.ai

General Support - Email: support@fixiweb.ai

We will respond to all privacy-related inquiries within 30 days.

15. Jurisdiction-Specific Provisions

15.1 European Economic Area (EEA)

If you are located in the EEA, FixiWeb.AI acts as the data controller for your personal data. Our legal bases for processing are described in Section 3.5.

15.2 United Kingdom

For UK users, the UK GDPR and Data Protection Act 2018 apply. References to GDPR in this policy include the UK GDPR where applicable.

15.3 Delaware (United States)

Fixiweb, LLC is incorporated in the State of Delaware, USA. These Terms are governed by the laws of the State of Delaware.

15.4 California

For California residents, this Privacy Policy serves as our "Notice at Collection" under the CCPA. The categories of personal information we collect and the purposes for collection are described in Sections 2 and 3.

Categories of Personal Information Collected (CCPA categories): - Identifiers (name, email, IP address) - Commercial information (purchase history, subscription details) - Internet activity (usage data, browsing history on our Service) - Geolocation data (inferred from IP address) - Professional information (company name, job title)

We do not sell personal information as defined under the CCPA.

By using FixiWeb, you acknowledge that you have read and understood this Privacy Policy.