This Privacy Policy explains how Fixovio processes personal data of everyone who uses Fixovio: drivers and guests of the Fixovio app, workshops and their team members using Fixovio Biz, visitors of our websites (app.fixovio.com and the Fixovio Biz web panel at biz.fixovio.com), people who report content or contact us, and people whose data reaches us through others. It is our information under Articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR").
This document is a translation of the official Polish text, which is the binding version. In the event of any discrepancy, the Polish text prevails.
1. Controller and contact
1.1. The controller of your personal data is SABTECH spółka z ograniczoną odpowiedzialnością, ul. Góralska 5, 53-610 Wrocław, Poland, KRS 0001271091, NIP 8971980459, REGON 545903540 ("Fixovio", "we").
1.2. For anything concerning your data, write to contact@fixovio.pl or to our postal address above.
1.3. We have not appointed a data protection officer, because the law does not require us to. The contact details above apply to all data protection matters.
2. Summary
- We collect only what we need to run Fixovio: your account, your bookings, your vehicles and your car checks.
- We do not sell your personal data. We do not use advertising networks or third-party analytics. We collect limited first-party usage statistics to measure views and interactions with Workshops, as described in section 6.3.
- Workshops see your name, phone number, vehicle, notes and attached car check only when you book with them.
- After a visit, the workshop may record what it found. We use this to make the car check more accurate (section 3 and 4).
- Engine recordings are shared only if you agree. Before any use beyond our own sound analysis, they are made fully anonymous.
- Your location is used to find nearby workshops and is not stored on our servers for this purpose.
- Workshop subscriptions are sold and paid through Stripe Managed Payments; Stripe is the seller. We never receive card numbers.
- You can download your data and delete your account in the app at any time.
3. Drivers and guests
| Data | Why we use it | Legal basis | How long we keep it |
|---|---|---|---|
| Email address; Apple or Google account identifier; sign-in codes; session data (including IP address and device information) | Creating your account, signing you in, keeping you signed in, securing the account | Contract (Art. 6(1)(b) GDPR); security: legitimate interest in protecting accounts and the Service (Art. 6(1)(f)) | Account data until account deletion; codes 10 minutes; sessions 30 days after last use |
| Name, phone number (optional), language, avatar (optional) | Your profile; showing your name and phone to workshops you book with; your public review name | Contract (Art. 6(1)(b)) | Until account deletion |
| Statement that you are 18 or older; proof of age confirmation and acceptance of the Terms, with date, shortened IP address and device information | Proof of age confirmation and acceptance | Legitimate interest in verifying compliance with the minimum age requirement and keeping evidence of acceptance of the Terms of Service, including to establish, exercise or defend claims (Art. 6(1)(f)) | Until account deletion; then a record of the acceptance (document, version, date, shortened IP address and device information), linked only to a pseudonymised form (keyed hash) of your email address, is kept for 3 years, the limitation period for possible claims |
| Location (precise or approximate, only if you allow it) and the map area you view | Showing nearby workshops, distances and directions | Contract (Art. 6(1)(b)) | Not stored by Fixovio: used only for the search request |
| Vehicles: make, model, year, fuel, licence plate (optional), mileage, insurance, inspection and oil dates | "My vehicles", reminders, bookings, car checks | Contract (Art. 6(1)(b)) | Until you delete the vehicle or your account |
| Car checks: your answers, notes, vehicle, result, sound-analysis result | Giving guidance; pre-filtering workshops; sharing with a workshop if you attach it to a booking | Contract (Art. 6(1)(b)) | Guests: 30 days. Accounts: 24 months |
| Engine recordings and related data (see section 4) | Training and improving our sound analysis; if you agreed to the current consent version, also pairing a recording with the workshop's visit report | Consent (Art. 6(1)(a)) | Until you delete them, stop sharing or delete your account, and no longer than 3 years; then deleted or effectively anonymised |
| Bookings: workshop, service, time, status, vehicle, notes, attached car check, your name and phone, history of changes | Providing bookings, reminders and notifications; passing the booking to the workshop; after the visit, handling complaints and claims | Contract (Art. 6(1)(b)); after the visit, legitimate interest in establishing, exercising or defending claims (Art. 6(1)(f)) | Personal details anonymised 3 years after the visit |
| Visit reports from workshops: what the workshop found and did at your visit (part of the car, result, urgency, short note, final price), linked to the booking | Keeping the record of the visit with the booking; comparing it with your car check to check and improve the accuracy of the car check and the sound analysis | Legitimate interest in improving the accuracy and safety of the Service (Art. 6(1)(f)); pairing with an engine recording: your consent (Art. 6(1)(a)) | The note is deleted when you delete your account and in any case 3 years after the visit; the rest (part of the car, result, urgency, price) is then kept without any link to you |
| Reviews: rating, text, photos, your name shown as "First name + initial", workshop replies | Publishing reliable reviews | Contract (Art. 6(1)(b)); after account deletion, legitimate interest in keeping reliable reviews (Art. 6(1)(f)) | While published. After account deletion the review stays as "Former customer", without your name, and its photos are deleted |
| Favourites, notification settings, quiet hours | Your preferences | Contract (Art. 6(1)(b)) | Until account deletion |
| In-app inbox messages | Informing you | Contract (Art. 6(1)(b)) | 365 days |
| Push notification token, platform, app version, language, last activity | Sending push notifications | Contract (Art. 6(1)(b)) | 270 days without activity |
| Marketing consent (with date, shortened IP address and device information) | Sending news and offers by email, push and in the app | Consent (Art. 6(1)(a) GDPR and Art. 398 of the Polish Electronic Communications Law); proof of consent: legitimate interest (Art. 6(1)(f)) | Messages until you withdraw consent; the consent record until account deletion |
| Data export file | Giving you a copy of your data | Legal obligation (Art. 6(1)(c) in connection with Art. 15 and 20 GDPR) | 7 days |
4. Engine recordings
4.1. Before your first recording we ask whether you agree to share recordings. If you do not agree, the recording is analysed only on your phone and is not sent to us.
4.2. If you agree, we store: the recording (mono audio, up to 35 seconds), which may contain voices or other sounds nearby; the month it was recorded; your car check answers and result; the phone's analysis result and model version; your platform and app version; and your car's make, model, year, fuel type and mileage. We never store your name, email, phone number or licence plate with a recording. The recording is linked to your account (or, for guests, to the car check) only so that you can delete it and, if you agreed to it, so that it can be paired with a visit report (section 4.3).
4.3. Purpose: we use the recordings as they are only to train and improve Fixovio's sound analysis. If you agreed to the current version of the consent and later book a visit through Fixovio, we may pair the recording with what the workshop found at that visit (the visit report), to check whether the analysis was right. Recordings shared under an earlier version of the consent are never paired.
4.4. Anonymisation. When you delete a recording, stop sharing or delete your account, when a recording is 3 years old, and before we use it for any other purpose, we either delete it or create a fully anonymous version: we remove all parts with human speech and every link to you, your account, car check, booking, device and IP address, and keep only general technical data (for example the month, the car's make and model and rounded mileage). Effectively anonymised versions are not personal data. We may keep them without a time limit, use them to develop and improve Fixovio and other products and services, and share or license them to other companies. Original recordings are never shared, licensed or sold.
4.5. Your control: you can stop sharing and delete your recordings in Settings at any time, or write to contact@fixovio.pl (guests: give the reference shown on the car check result). Withdrawing consent does not affect the lawfulness of processing carried out before.
5. Workshop owners and team members
| Data | Why we use it | Legal basis | How long we keep it |
|---|---|---|---|
| Account data, as for drivers; role in the workshop; invitations (email, role) | Account, team management, access rights | Contract (Art. 6(1)(b)) | Until account deletion; invitations until accepted or expired |
| Workshop Listing data (name, description, address, map pin, phone, email, website, hours, services, prices, photos), legal name and NIP shown on the Listing | Publishing the Listing | Contract (Art. 6(1)(b)) | Until the workshop is deleted |
| Verification data: NIP, legal name, address, the response from the Ministry of Finance's register (which may include names of representatives and partners and bank account numbers), check results, uploaded documents | Verifying the workshop | Contract and legitimate interest in keeping Fixovio safe and reliable (Art. 6(1)(b) and (f)) | While the workshop is on Fixovio and 3 years after it is closed (or after the last rejection) |
| Business Terms acceptance (with date, shortened IP address and device information) | Proof of acceptance | Legitimate interest, including to establish, exercise or defend claims (Art. 6(1)(f)) | Until account deletion; then a record of the acceptance (document, version, date, shortened IP address and device information), linked only to a pseudonymised form (keyed hash) of your email address, is kept for 3 years, the limitation period for possible claims |
| Visit reports the workshop records (see section 3) | Providing the tool to the workshop; improving the Service | Contract (Art. 6(1)(b)); legitimate interest (Art. 6(1)(f)) | As in section 3 |
| Subscription records received from Stripe: Stripe customer and subscription identifiers, plan, price, status, billing period, billing email, company name and NIP given at checkout, invoice and receipt numbers, amounts and links, refunds and disputes | Keeping the subscription status and the listing up to date; showing receipts and invoices in Fixovio Biz; billing support; accounting for payouts from Stripe | Contract (Art. 6(1)(b)); legal obligation under tax and accounting law (Art. 6(1)(c)); legitimate interest in establishing, exercising or defending claims (Art. 6(1)(f)) | 6 years after the end of the year in which the payment was made; other subscription data while the subscription exists |
| Promotional code uses (code, NIP, workshop, date) | Making sure each business uses a free code only once, and any other code only once per code | Legitimate interest in preventing abuse (Art. 6(1)(f)) | 5 years after the code was used |
| Technical payment event records (Stripe webhooks) | Processing payment events reliably and investigating errors | Legitimate interest (Art. 6(1)(f)) | 90 days after processing |
| Suspension and termination decisions with reasons, complaints and appeals | Handling suspensions, terminations and complaints (P2B Regulation) | Legal obligation and legitimate interest (Art. 6(1)(c) and (f)) | 3 years after the decision |
| Workshop statistics (counts of impressions, views and taps) | Showing statistics to the workshop | Legitimate interest in providing useful statistics (Art. 6(1)(f)) | See section 6.3 |
5.1. Payments. The workshop subscription is sold by Stripe as the seller (merchant of record) under Stripe Managed Payments. In this Privacy Policy, "Stripe" means Stripe Payments Europe, Limited (Dublin, Ireland) and the other companies of the Stripe group that take part in providing Stripe Managed Payments, including Link, LLC, the Stripe group company that acts as the seller and is named on receipts and invoices. Payment data (card or wallet data, billing address, tax data, IP address and device data used for fraud prevention) is collected directly by Stripe on its pages and processed by Stripe as an independent controller (or, where several Stripe group companies are involved, as independent controllers) under Stripe's privacy notice (stripe.com/privacy). We never receive or store card numbers.
6. Everyone
| Data | Why we use it | Legal basis | How long we keep it |
|---|---|---|---|
| Reports of content: what was reported, reason, explanation; for reporters without an account, name and email | Handling notices under the Digital Services Act (DSA) | Legal obligation (Art. 6(1)(c) GDPR, Art. 16 DSA) | 3 years after the decision; name and email of reporters without an account deleted 1 year after the decision |
| Moderation decisions, statements of reasons, appeals | Moderation and internal complaints under the DSA | Legal obligation and legitimate interest (Art. 6(1)(c) and (f)) | 3 years after the decision |
| Emails and messages you send us | Answering you, handling complaints and requests | Contract, legal obligation or legitimate interest, depending on the topic | As long as needed to handle the matter, then for the limitation period of possible claims: usually 3 years, and up to 6 years where the message concerns billing, tax or accounting matters |
| Service messages and notices you receive from us | Informing you about the service, your account and changes | Contract (Art. 6(1)(b)) | 3 years after sending |
| Security and audit records (who did what and when, with a shortened IP address) | Security, preventing abuse, accountability | Legitimate interest (Art. 6(1)(f)) | 2 years |
| Email delivery records (with an encrypted form of the address) | Delivery problems, rate limits | Legitimate interest (Art. 6(1)(f)) | 90 days |
6.1. Shortened IP addresses. Where we keep an IP address in records, we shorten it to reduce the ability to identify a particular device or user.
6.2. Backups. Our database is backed up. Backups are kept for 30 days, so deleted data disappears from backups at the latest after that time.
6.3. Workshop statistics. To count how many people saw or interacted with a workshop without storing who they were, we create for each event a pseudonymised code (Art. 4(5) GDPR) that changes every day. It is derived from your account ID or, if you are not signed in, only from your IP address, which your device sends with every request anyway (we do not read any other information from your device for this purpose), combined with a secret value that we destroy every day, so codes from different days cannot be linked. We do not use these codes to identify you or to create a profile of you. Raw events with this code are deleted after 30 days; only aggregated daily totals remain, which we treat as anonymous information where they cannot reasonably be used to identify an individual. Workshop staff viewing their own workshop are not counted. The legal basis is the legitimate interest of Fixovio and of the workshops in reliable statistics on the visibility of Listings (Art. 6(1)(f) GDPR).
Right to object (Art. 21 GDPR): you can object to this processing at any time, on grounds relating to your particular situation, by writing to contact@fixovio.pl from your account's email address; we will then stop counting your account. If you are not signed in, we cannot identify you from the daily code, so we cannot link an objection to you (Art. 11(2) GDPR); the code is deleted after 30 days in any case.
7. People whose data reaches us through others
- People heard in engine recordings: their voice may be captured by chance. We process it on the basis of our legitimate interest (Art. 6(1)(f)) only as part of the recording, as described in section 4, and speech is removed before any other use. We cannot identify these people and do not try to.
- Drivers whose visits are described in visit reports: the workshop gives us this information (section 3).
- Customers entered by workshops: when a workshop enters a booking manually, we store the customer's name and phone number on the workshop's behalf, as its processor. The workshop is the controller and is responsible for having a lawful basis for providing the data to Fixovio.
- Representatives and partners of workshops: the Ministry of Finance's register may return their names. We use them only to verify the workshop (section 5).
- People mentioned in reviews or emails: we process this only as part of the content concerned, and remove it if it breaks our rules.
8. Who receives your data
| Recipient | What they receive | Role |
|---|---|---|
| Workshops you book with | Your name, phone, vehicle, notes, attached car check | Independent controllers |
| The public | Workshop Listings, reviews (with "First name + initial"), workshop replies | — |
| Railway (hosting, database, files, map tiles) | All data stored by the service, in the EU region | Processor |
| Resend (email delivery, EU region) | Your email address and the content of our emails | Processor |
| Hostinger (support mailbox) | Emails you send us | Processor |
| Google – Firebase Cloud Messaging | Push token and notification content | Processor |
| Apple and Google – sign-in | Data needed for signing in, if you choose these options | Independent controllers |
| Stripe – Stripe Payments Europe, Limited (Ireland), Link, LLC (the seller) and other Stripe group companies providing Stripe Managed Payments (section 5.1) – sale of and payment for workshop subscriptions | Workshops and owners: email, company name, NIP and billing address given at checkout, amounts, subscription identifiers; payment data entered directly with Stripe | Independent controllers (as the seller of the subscription and as payment service providers). To the extent Stripe processes data on our behalf, as our processor under the Stripe Data Processing Agreement |
| Apple Pay, Google Pay | Data needed for paying, if a workshop chooses these options in Stripe Checkout | Independent controllers |
| Ministry of Finance (register of VAT taxpayers) | Workshop NIP | Public register queried to verify the workshop |
| Nominatim – OpenStreetMap Foundation (United Kingdom), address search | Workshop addresses, to place the workshop on the map during verification | Independent controller |
| IT service providers working for us | Data needed for development and maintenance | Processors, under data processing agreements |
| Accounting and legal advisers; courts and authorities | Data needed for their tasks or required by law | Independent controllers or as required by law |
| A buyer or successor of the business | Data needed to continue the service, if all or part of Fixovio's business is sold or merged | The buyer continues to use the data for the same purposes, and we will inform you in advance |
9. Transfers outside the European Economic Area
9.1. We store data in the European Economic Area. Some providers, or their parent companies, are based outside the EEA (in particular in the United States: Google and Stripe group companies, for example Stripe, Inc. and Link, LLC, Railway Corporation and Resend, Inc.), and may process data there. The map is served from our own servers, so no map provider receives your location. Address searches go to the OpenStreetMap Foundation in the United Kingdom, which is covered by an adequacy decision of the European Commission. These transfers rely on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework where the recipient is certified, or on standard contractual clauses approved by the Commission. You can ask us for a copy of the safeguards at contact@fixovio.pl.
10. Automated processing
10.1. We do not make decisions based solely on automated processing that produce legal effects for you or similarly significantly affect you (Article 22 GDPR). In particular:
- Car check: fixed rules turn your answers into guidance on urgency and service categories. You decide what to do.
- Sound analysis: a machine-learning model on your phone classifies the engine sound and shows a confidence level.
- Ranking: workshops are ordered by matching categories, rating and distance (see the Terms of Service). No payment influences it.
- Workshop verification: a workshop can be approved automatically if all register checks pass. A rejection is always decided by a person.
- Bookings and subscriptions: requests expire, bookings are completed, reminders are sent, and listings are hidden automatically when a subscription is unpaid or ends, according to the published terms.
- Payments: Stripe may use automated fraud prevention when a workshop pays, under its own responsibility and privacy notice.
- Content moderation: no automated moderation is used; a person decides on every report.
11. Storage on your device and cookies
11.1. In the apps we store on your device only what the app needs to work: the sign-in token (in the phone's secure storage), language, theme, last map position and similar settings, drafts, your recording-sharing choice and a summary of your last car check. We use no cookies or advertising identifiers in the apps. We use only storage technologies that are strictly necessary to provide the functions of the Service you request (Art. 399 of the Polish Electronic Communications Law). Where consent is required by law, we obtain it before using the relevant technology.
11.2. Our websites (app.fixovio.com and the Fixovio Biz web panel at biz.fixovio.com) use no cookies. They keep in your browser's local storage only what is strictly necessary for the functions you use: on app.fixovio.com, your language and the part of the site you last viewed; in the Fixovio Biz web panel, your sign-in token (for up to 30 days after your last use), language and similar settings. This information stays in your browser and is not used for tracking or advertising, so no consent banner is needed.
11.3. Subscription payments take place on Stripe's pages (Stripe Checkout and the Stripe billing portal), which use Stripe's own cookies for payment, security and fraud prevention, as described in Stripe's cookie and privacy notices. Fixovio does not control these cookies.
11.4. You can clear this storage in your browser at any time; in the Fixovio Biz web panel you will then be signed out.
12. Your rights
12.1. You have the right to:
- access your data and get a copy (in the app: Account → Privacy & data → Download your data; in Fixovio Biz: More → Privacy & data);
- rectify inaccurate data (in the app, or by writing to us);
- erasure (in the app: Account → Privacy & data → Delete account; in Fixovio Biz: More → Privacy & data; recordings can be deleted separately; or by writing to us);
- restrict processing;
- data portability, for data processed on the basis of contract or consent;
- object to processing based on legitimate interest, on grounds relating to your situation, and at any time to direct marketing;
- withdraw consent at any time (marketing: Settings or the unsubscribe link; recordings: Settings), without affecting the lawfulness of processing before withdrawal;
- lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.
12.2. The 7-day cancellation period for account deletion started in the app does not limit your right to erasure under the GDPR. A request for erasure sent to us is handled under section 12.3.
12.3. To exercise your rights, use the app or write to contact@fixovio.pl, preferably from your account's email address. We answer without undue delay and within one month at the latest; for complex or numerous requests we may extend this by two further months and will tell you the reason within the first month. We may need to confirm your identity.
13. Do you have to give us your data?
13.1. Giving data is voluntary, but without an email address (or Apple or Google account) and a name you cannot create an account, and without a name and phone number you cannot book. Location, photos, recordings and marketing consent are always optional. Workshops must give the data needed for verification, and the data needed for payment and invoices at Stripe Checkout.
14. Security
14.1. We use encryption in transit (HTTPS), store sign-in tokens in the phone's secure storage, never receive or store card numbers (payments are handled by Stripe), give access to private files only through short-lived links, remove location data (EXIF) from published photos, limit and log staff access to personal data, protect access to our payment account with two-factor authentication, and use rate limits against abuse.
15. Age
15.1. Fixovio is intended only for people aged 18 or older. We do not knowingly allow people under 18 to create an Account. If you believe a person under 18 is using Fixovio, write to us and we will review the matter and, where appropriate, delete the Account.
16. Anonymous data
16.1. We may create anonymous statistics, anonymous versions of recordings and anonymous visit-report data that cannot identify anyone. Such data is not personal data, and this Privacy Policy does not apply to it.
17. Changes
17.1. We may update this Privacy Policy, for example when we add features or providers. We will tell you about important changes at least 14 days in advance, in the app and by email. The current version is always available in the apps and at app.fixovio.com.
17.2. This Privacy Policy takes effect on 10 November 2026.