Privacy Policy

1. Introduction and Scope

FixFlow by Dr. Fixit Mobile ("we", "us", or "our") is committed to protecting personal information in a manner consistent with applicable privacy legislation. This Privacy Policy explains how we collect, use, disclose, retain, and safeguard personal information when you use the FixFlow by Dr. Fixit Mobile platform and services ("the Service").

This policy applies to all users of the Service and is designed to comply with:

• Alberta's Personal Information Protection Act (PIPA)
• Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and its associated regulations, including mandatory breach reporting requirements
• Canada's Anti-Spam Legislation (CASL)
• The California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), for users located in California, USA
• Other applicable Canadian federal and provincial privacy laws

If you disagree with this policy, please discontinue use of the Service.

2. Who We Are / Privacy Officer

FixFlow by Dr. Fixit Mobile is operated from the Province of Alberta, Canada. Under Alberta's PIPA, we are accountable for personal information under our control. Our designated Privacy Officer can be reached at:

3. Information We Collect

3.1 Information You Provide Directly

• Account information: Business name, your name, email address, phone number, and password
• Customer records: Names, phone numbers, email addresses, and device information of your customers that you enter into the Service
• Repair ticket data: Device details, issue descriptions, technician notes, status updates, and repair history
• Payment data: Transaction amounts and payment methods. Credit card and banking details are handled directly by Stripe and are never stored on our servers.
• Team member information: Names, email addresses, and roles of team members you add to your account
• Inventory data: Parts, products, SKUs, costs, and stock levels you manage in the Service
• Communications: Messages or inquiries you send to our support team

3.2 Information Collected Automatically

• Log data: IP address, browser type and version, pages visited, time and date of access, referring URLs
• Device information: Operating system, browser, and screen resolution
• Usage data: Features used, session duration, and interaction patterns — used to improve the Service

3.3 Information from Third Parties

If you register or sign in using Google OAuth, we receive your name and email address from Google solely for authentication purposes, subject to your Google account privacy settings.

4. How We Use Your Information

We collect and use personal information only for purposes that a reasonable person would consider appropriate in the circumstances, including:

• Providing, operating, maintaining, and improving the Service
• Processing subscription payments and sending billing-related communications
• Sending SMS and email notifications to your customers on your behalf, as initiated by you
• Sending you service updates, security alerts, and support communications
• Authenticating your identity and maintaining account security
• Detecting, investigating, and preventing fraudulent or abusive activity
• Complying with applicable legal obligations
• Responding to your support requests and inquiries

We do not sell, rent, trade, or otherwise disclose your personal information or your customers' personal information to any third party for marketing or commercial purposes.

5. Legal Basis for Processing

We collect and process personal information based on the following legal grounds:

• Contractual necessity: Processing required to provide the Service you subscribed to
• Consent: Where you have given explicit consent (e.g., marketing communications)
• Legitimate interests: Security monitoring, fraud prevention, and Service improvement
• Legal obligation: Compliance with applicable laws and regulatory requirements

6. Data Sharing and Third-Party Service Providers

We share personal information with third-party service providers only to the extent necessary to operate the Service. All third-party providers are contractually required to protect personal information and use it only for the purposes we specify.

• Stripe (Payment Processing) — Used to process subscription payments. Credit card data is transmitted directly to Stripe and never stored on our servers. Stripe is PCI-DSS compliant. Stripe may process data in the United States. See Stripe's privacy policy at stripe.com/privacy.
• Twilio (SMS Notifications) — Used to deliver SMS messages to your customers as initiated by you. Phone numbers are transmitted to Twilio solely to deliver messages you instruct. Twilio may process data in the United States. See Twilio's privacy policy at twilio.com/legal/privacy.
• Email Provider (SMTP) — Used to deliver email notifications to your customers and transactional emails to you. Email addresses are used only for the delivery of messages you initiate.
• Railway (Cloud Hosting) — Our infrastructure and database hosting provider. Data is hosted on secure cloud servers. See Railway's privacy policy at railway.app/legal/privacy.
• Google (OAuth Authentication) — Used optionally for account sign-in. Limited to identity verification only.

We may also disclose personal information if required by law, court order, or lawful government authority, or where we believe disclosure is necessary to protect the rights, property, or safety of FixFlow by Dr. Fixit Mobile, our users, or the public.

7. Cross-Border Data Transfers

Some of our third-party service providers (including Stripe and Twilio) are located in the United States. As a result, your personal information may be transferred to, stored in, or processed in the United States or other countries outside Canada. When this occurs, we ensure that appropriate contractual protections are in place consistent with PIPEDA and PIPA requirements. By using the Service, you consent to the transfer of your information to these jurisdictions, which may have different privacy laws than your province or country.

8. Data Storage and Security

We implement industry-standard technical and organizational security measures to protect personal information against unauthorized access, disclosure, alteration, or destruction, including:

• HTTPS/TLS encryption for all data transmitted to and from the Service
• Bcrypt password hashing — we never store plain-text passwords
• JWT-based authentication with expiring tokens
• Role-based access controls limiting access to personal information
• Regular security reviews and updates

While we take reasonable and appropriate steps to protect your information, no system can guarantee absolute security. In the event of a security breach that creates a real risk of significant harm, we will notify affected individuals and the Office of the Information and Privacy Commissioner of Alberta (OIPC) as required under PIPA and PIPEDA.

9. Your Role as Data Controller for Customer Information

When you enter your customers' personal information (names, phone numbers, email addresses, device records) into FixFlow by Dr. Fixit Mobile, you act as the data controller for that information. FixFlow by Dr. Fixit Mobile acts as a data processor on your behalf. You are responsible for:

• Obtaining all necessary consents from your customers to collect, store, and process their personal information
• Complying with all applicable privacy laws in the jurisdictions where you and your customers are located, including PIPA, PIPEDA, CASL, TCPA, and CCPA where applicable
• Responding to your customers' requests regarding their personal information
• Only entering personal information you are authorized to collect

10. Data Retention

We retain personal information for as long as your account is active or as reasonably necessary to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. If you cancel your account, we will retain your data for 30 days to allow for export upon request, after which it will be permanently deleted from our systems, except where retention is required by law (such as financial records for tax purposes). Anonymized or aggregated data may be retained indefinitely.

11. Your Privacy Rights

11.1 Rights for All Users (PIPA / PIPEDA)

Under Alberta's PIPA and Canada's PIPEDA, you have the right to:

• Access — Request a copy of the personal information we hold about you
• Correction — Request correction of inaccurate or incomplete personal information
• Withdrawal of Consent — Withdraw consent to our collection, use, or disclosure of your personal information (subject to legal or contractual restrictions)
• Data Portability — Request an export of your account data in a machine-readable format (CSV)
• Deletion — Request deletion of your account and associated personal information
• Complaint — File a complaint with the Office of the Information and Privacy Commissioner of Alberta (OIPC) at oipc.ab.ca if you believe we have not handled your information appropriately

11.2 Additional Rights for California Residents (CCPA / CPRA)

If you are a California resident, you have the following additional rights under the CCPA and CPRA:

• Right to Know — Request disclosure of the categories and specific pieces of personal information we have collected about you
• Right to Delete — Request deletion of personal information we have collected, subject to certain exceptions
• Right to Correct — Request correction of inaccurate personal information
• Right to Opt-Out of Sale or Sharing — We do not sell or share personal information for cross-context behavioral advertising. No opt-out is necessary.
• Right to Non-Discrimination — We will not discriminate against you for exercising your CCPA rights
• Right to Limit Use of Sensitive Personal Information — We do not use sensitive personal information beyond what is necessary to provide the Service

In the past 12 months, we have collected the following categories of personal information: identifiers (name, email, IP address), commercial information (subscription and payment records), and internet or other electronic network activity (usage data). We have not sold or shared personal information with third parties for advertising purposes.

To exercise any of your rights, contact us at privacy@fixflowcrm.com. We will verify your identity before processing your request and respond within 30 days (or as otherwise required by applicable law). We will not charge a fee for reasonable requests.

12. Cookies and Local Storage

FixFlow by Dr. Fixit Mobile uses browser local storage (not traditional HTTP cookies) to maintain your authenticated session via a JWT (JSON Web Token). This token is strictly necessary for the Service to function and cannot be opted out of while using the Service.

We do not use tracking cookies, third-party advertising cookies, or cross-site tracking technologies. We do not participate in behavioral advertising networks.

13. Children's Privacy

The Service is not directed to individuals under the age of 18, and we do not knowingly collect personal information from minors. If we become aware that we have inadvertently collected personal information from a person under 18 without appropriate parental consent, we will take steps to delete that information promptly. If you believe a minor has provided us with personal information, please contact us at privacy@fixflowcrm.com.

14. Data Breach Notification

In the event of a security breach involving personal information that creates a real risk of significant harm to affected individuals, we will: (a) notify affected individuals as soon as reasonably practicable; (b) report the breach to the Office of the Information and Privacy Commissioner of Alberta (OIPC) and the Office of the Privacy Commissioner of Canada (OPC) as required under PIPA and PIPEDA; and (c) maintain a record of all breaches as required by law. Notifications will be made in plain language and will include information about what happened, what information was involved, steps you can take to protect yourself, and how to contact us.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. We will notify you of material changes by email to the address associated with your account and/or by displaying a prominent notice within the Service at least 30 days before changes take effect. The "Last updated" date at the top of this page indicates when this policy was last revised. Your continued use of the Service after the effective date constitutes your acceptance of the updated policy.

16. Regulatory Authorities

If you have concerns about our privacy practices that we have not resolved to your satisfaction, you have the right to lodge a complaint with the appropriate regulatory authority:

• Alberta: Office of the Information and Privacy Commissioner of Alberta (OIPC) — oipc.ab.ca
• Canada (Federal): Office of the Privacy Commissioner of Canada (OPC) — priv.gc.ca
• California, USA: California Privacy Protection Agency (CPPA) — cppa.ca.gov

17. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data handling practices, please contact our Privacy Officer: