Privacy Policy

FIXARO (“we”, “us”, “our”) is the operator of the FIXARO platform at fixaro.pro and acts as the data controller for the personal data described in this Privacy Policy.

This policy explains what personal data we collect, why we collect it, the lawful basis for processing, how long we keep it, who we share it with, and what rights you have under the General Data Protection Regulation (GDPR) and other applicable EU data protection law.

This policy applies to all users of FIXARO — Clients, Service Professionals, and visitors to our website — regardless of which of our 10 supported languages you use to access the Platform.

If you do not agree with our practices, please do not use our services.

Data you provide directly:

• Account data: name, email address, password (stored as a salted hash), profile photo, and account type (client or professional)
• Professional profile data: service category, city / service area, hourly rate, bio, portfolio images, and availability
• Contact details: phone number (optional, used only if you choose to display it on your profile)
• Job data: job title, description, location, and any attachments you include in a job posting
• Messages:content of messages exchanged between Clients and Professionals via the Platform's messaging system
• Reviews and ratings: text and star ratings submitted after an engagement

Data collected automatically:

• Technical data: IP address, browser type, operating system, device type, and referring URL
• Usage data: pages viewed, search queries, features used, and click patterns — collected via PostHog and Plausible analytics (analytics-consent required; see Section 8)
• Session data: authentication tokens stored in HttpOnly cookies managed by Supabase Auth

We do not collect payment card details (the Platform does not process payments), government-issued IDs, or sensitive special-category data (GDPR Art. 9).

We process personal data under the following lawful bases set out in GDPR Art. 6:

• Contract (Art. 6(1)(b)): account creation and maintenance, displaying your profile to other users, operating the messaging system, and all other processing necessary to provide the Platform service you have signed up for.
• Legal obligation (Art. 6(1)(c)): retaining transaction and activity records where required by applicable EU or member-state law (e.g., tax record-keeping obligations).
• Legitimate interests (Art. 6(1)(f)): fraud detection and platform security; improving the Platform based on aggregated usage data; sending service-related notifications (not marketing); enforcing our Terms of Service. Our legitimate interests are balanced against your rights and freedoms — if you object, see Section 6.
• Consent (Art. 6(1)(a)): analytics cookies (PostHog, Plausible) and any future marketing communications. You can withdraw consent at any time — see Section 8 for cookies and Section 6 for your general rights.

We use your personal data to:

• Create and manage your account and authenticate your sessions
• Display your profile to other users of the Platform
• Match Clients with relevant Service Professionals
• Enable messaging between Clients and Professionals
• Send transactional notifications (e.g., new message, new job match, account security alerts)
• Detect and prevent fraud, abuse, and policy violations
• Improve the Platform based on aggregated, anonymised usage data
• Comply with legal and regulatory obligations
• Respond to your support requests and exercise or defend legal claims

We do not sell your personal data to third parties. We do not use your personal data for automated profiling that produces legal or similarly significant effects.

With other users. Profile information you choose to make public (name, city, service category, rating, bio, portfolio) is visible to other Platform users. Messages you send are visible only to the recipient.

With our sub-processors (data-processing service providers):

• Supabase Inc. (EU-Frankfurt region): database hosting, authentication, and storage. Your data is stored on servers in Frankfurt, Germany (AWS eu-central-1). Supabase processes data under a Data Processing Agreement compliant with GDPR Art. 28.
• Cloudflare Inc.: content delivery, DDoS protection, and edge compute. Cloudflare processes minimal request metadata (IP, headers) to serve and protect the Platform. Cloudflare is certified under EU-US Data Privacy Framework.
• PostHog Inc. (self-hosted, EU region): product analytics. PostHog is deployed on EU infrastructure and data does not leave the EU. PostHog is only initialised after you accept analytics cookies.
• Plausible Analytics (EU-hosted): privacy-friendly website analytics. Plausible does not use cookies and does not collect personal data — it processes only anonymised aggregated statistics. Loaded only after analytics-cookie consent.

Ukrainian users. If you access FIXARO from Ukraine or provide a Ukrainian phone number or address, your personal data is still processed exclusively on servers in Frankfurt, Germany, within the EU. No personal data is transferred to servers outside the EU/EEA.

Business transfers. If FIXARO is involved in a merger, acquisition, or sale of assets, we will notify you before your personal data is transferred and becomes subject to a different privacy policy.

Legal requirements. We may disclose personal data if required by a court order, applicable law, or a government authority with jurisdiction, and only to the extent strictly required.

We implement technical and organisational measures appropriate to the risk level, including:

• Encryption in transit: all connections use TLS 1.2 or higher
• Encryption at rest: database volumes encrypted at rest by Supabase (AWS KMS)
• Row-level security: Supabase RLS policies ensure each user can only read their own data
• Authentication: passwords stored as bcrypt hashes; session tokens stored in HttpOnly cookies
• Access controls: production database access is restricted to authorised personnel

No system is completely secure. If you become aware of any security issue, please disclose it responsibly to security@fixaro.pro.

Under the GDPR, you have the following rights, which you can exercise free of charge by contacting us at privacy@fixaro.pro:

• Right of access (Art. 15): request a copy of the personal data we hold about you
• Right to rectification (Art. 16): correct inaccurate or incomplete data — most fields are editable directly in your account settings
• Right to erasure (Art. 17):request deletion of your personal data (“right to be forgotten”). Data export and account-deletion are available via your account settings (currently in development) or on request at privacy@fixaro.pro
• Right to restriction (Art. 18): ask us to restrict processing of your data in certain circumstances
• Right to data portability (Art. 20): receive your data in a machine-readable format. A data-export function is in development; meanwhile, request your data at privacy@fixaro.pro
• Right to object (Art. 21): object to processing based on legitimate interests or for direct marketing purposes
• Right to withdraw consent: withdraw analytics-cookie consent at any time by clearing your cookies or via your browser settings; withdraw consent for any other consent-based processing by contacting us
• Right to lodge a complaint: if you believe we have processed your data unlawfully, you have the right to lodge a complaint with your national data protection supervisory authority

We will respond to your request within 30 days. In complex cases, we may extend this by a further 60 days with prior notice.

We use only two categories of cookies and tracking technologies. For full details see our Cookie Policy.

• Essential cookies: required for authentication and session management. Lawful basis: contract. No consent required.
• Analytics cookies:PostHog (product analytics) and Plausible (website statistics). Lawful basis: consent (Art. 6(1)(a)). Only activated after you click “Accept all” in the cookie consent banner. You can withdraw consent at any time by clearing your browser cookies.

We do not use advertising, retargeting, or social-media tracking cookies.

FIXARO is not intended for users under 18 years of age. We do not knowingly collect personal data from children. If we discover that we have collected data from a child, we will delete it without delay.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us at privacy@fixaro.pro.

All personal data is stored on servers located in Frankfurt, Germany (EU). We do not transfer personal data to countries outside the EU/EEA in the ordinary course of operating the Platform.

Where a sub-processor (such as Cloudflare) processes metadata on infrastructure that may include non-EU nodes, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission and/or the EU-US Data Privacy Framework as appropriate transfer mechanisms.

We retain personal data only as long as necessary for the purpose it was collected for:

• Active account data: retained while your account is active
• After account deletion: most personal data is deleted or anonymised within 90 days of your deletion request, subject to legal holds
• Activity and transaction records: retained for up to 7 years where required by tax or other legal obligations
• Analytics data: PostHog event data is retained for 12 months; Plausible statistics are aggregated and do not contain personal data
• Log data: server and security logs retained for up to 90 days

After applicable retention periods expire, we securely delete or irreversibly anonymise your personal data.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email to your registered address and by a prominent notice on the Platform before the changes take effect.

The “Last Updated” date at the top of this page indicates when this policy was last revised.

For questions or requests relating to this Privacy Policy or your personal data, contact us:

Supervisory authority. If you are unhappy with our response, you have the right to lodge a complaint with the data protection authority of your EU member state or, if you are in Ukraine, with the Ukrainian Personal Data Protection Commissioner.