Privacy Policy | Fixmeapp

1. Introduction

Fixmeapp (“we”, “our”, “us”) is a booking platform where you find, book and talk to beauty and wellness professionals: hair, nails, brows, lashes, skin and more. Professionals use Fixmeapp to run their calendar, their services and their booking conversations.

We process personal data in line with the EU General Data Protection Regulation (GDPR), the Swedish Data Protection Act and, where they apply, the CCPA and other international frameworks. Fixmeapp AB is the data controller.

This policy covers the Fixmeapp app for iPhone and Android, the booking pages on the web (the link a professional shares, for example in their Instagram bio) and fixmeapp.ai.

2. Data we collect

Account: your email address (you sign in with a one-time code sent to it), your name, and a profile picture if you add one.
Bookings:the professional, the services, the date and time, the price, your booking reference (FX-…), any note you add, and the name, email and phone number you give when you book.
Messages: what you write in the chat with a professional or their booking assistant.
Search:what you type in search, including a city or area, is used to find results. If you are signed in and “Save my search history” is on, we keep the service, the @username and the place you searched for on your account, never the whole sentence. You can turn this off and clear it in Settings > Privacy. The app does not read your device location.
Notifications: a push token for your device, if you allow notifications, and your notification choices in Settings.
Photos you choose to upload: for example a profile picture or, for professionals, pictures of their work.
For professionals: business details (business name, organisation number, address, city, country), services and prices, working hours, and, if you connect them, your calendar and your public Instagram and Google business information.
Technical data: IP address, device and app version, and error reports when something breaks.
Assistant memory (optional): short, reworded preference facts, only with your consent and after your review. See section 4.
Health-related memory (optional): allergy and sensitivity facts relevant to your appointments, only with your separate, explicit consent. See section 5.

We do not use advertising identifiers, we do not show ads, and we do not track you across other companies’ apps or websites. The booking pages and fixmeapp.ai only use cookies and local storage that they need to work, such as keeping you signed in and remembering your language.

3. How we use your data

to create your account and sign you in
to make, move and cancel bookings, and to send confirmations, reminders and changes by email and push notification
to show you professionals and free times that match your search
to run the booking assistant in your conversations
to sync bookings with a professional’s calendar when they connect it
to find and fix errors, and to prevent fraud and abuse
to meet legal obligations, for example bookkeeping

A professional sees what they need to carry out your booking: your name, your contact details, the booking and your note. They do not see your other bookings, your searches or your assistant memory (see section 4).

You choose which emails and push notifications you get in Settings > Notifications. Messages that are part of a booking you just made, such as the confirmation, are always sent.

We do not sell personal data. Voluntary sharing, if we ever offer it, will only happen with your informed consent, on transparent terms, and with a benefit to you (see section 11).

4. The AI assistant and what it remembers

Fixmeapp’s booking assistant handles booking conversations with professionals. Reading those conversations to arrange your appointment is part of the service itself (GDPR Art. 6(1)(b)): the assistant cannot book for you without reading your messages.

Assistant memory is different, and it is your choice. Only if you switch on assistant memory in your data wallet may the assistant keep short preference facts after a conversation ends, so you don’t have to repeat yourself (for example “Prefers evening appointments”).

Off by default. Without your consent, no memory is kept and your conversations are not analysed for it. Nothing is pre-checked for you.
Reworded facts only, never transcripts. Word-for-word quotes are rejected automatically, and so are contact details, addresses, personal identity numbers and social handles.
Nothing counts until you approve it.Every fact waits in your wallet as “pending” until you approve or delete it. Deleting is immediate and permanent.
Professionals never see your memory. The one exception is appointment prep: facts you choose to share are visible to your professional shortly before your appointment until it ends, and then hidden again.
Every consent has a receipt. We record the date and the version of this policy you agreed to, and show you the receipt in your wallet. A new purpose is always a new question, never a silent extension of an old yes.

You can withdraw assistant-memory consent at any time in your wallet. New memory stops immediately, and you can delete any stored fact one by one.

5. Health-related information

Some things worth remembering are health-related: an allergy to a nail adhesive, a scalp that reacts to bleach, a sensitivity to strong chemicals. Under the GDPR this is special category data (Art. 9), and we treat it that way:

Its own explicit consent. Health-related memory has a separate switch and its own consent moment. It is never bundled into another yes.
Both switches must be on. Turning off assistant memory stops health-related memory too.
Always your review first. Health-related facts are never approved automatically.
Never part of anything we sell.

You can withdraw this consent at any time and permanently delete any stored health fact in your wallet.

6. Integration with Meta services (Instagram Graph API)

A professional can connect Instagram so Fixmeapp can show their public profile and work, and so their booking assistant can answer Instagram messages. Data from the Instagram Graph API is refreshed or deleted within 24 hours unless the professional has agreed to longer storage.

Access only happens after explicit OAuth consent.
We follow the Meta Platform Terms, the Meta Developer Policies and the Facebook Data Protection Addendum.
We never sell or transfer Meta data, and never use it for advertising.
You can disconnect in Settings or ask for deletion at privacy@fixmeapp.ai.

6.1 Google services

A professional can connect Google Calendar so bookings appear there and busy times are not offered to customers. We read free and busy times and write the bookings we create. We also use Google’s public business listings to fill in a professional’s address and reviews. Access can be revoked at any time, and our use of data from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

7. Who processes data for us

We share personal data only with service providers (“processors”) that help us run Fixmeapp, under data processing agreements that meet GDPR standards:

Railway: hosting of our servers and database.
Resend: sending emails (sign-in codes, confirmations, reminders).
Expo, with Apple and Google: delivering push notifications.
OpenAI: the language models behind search and the booking assistant. Your data is not used to train their models.
Sentry: error reports, so we can fix what breaks.
Google: calendar sync and business listings, as in section 6.1.
Meta: Instagram, as in section 6.

We share data with a professional when you book with them, as described in section 3, and with authorities only when the law requires it. We never perform profiling or automated decision-making with legal effect.

8. Your data rights

Under the GDPR, you have the right to:

access and receive a copy of your data
have it corrected or erased (“right to be forgotten”)
restrict or object to processing
withdraw consent at any time
move your data to another service

Email privacy@fixmeapp.ai with “Data Request” in the subject line. We answer within 30 days. You can also complain to the Swedish Authority for Privacy Protection (IMY) or your local data protection authority.

9. Keeping and deleting data

Delete your account without the app: email privacy@fixmeapp.ai with “Delete my account” in the subject, from the email address you sign in with. We confirm it is you, delete the account and its personal data within 30 days, and email you when it is done. What we keep, and for how long, is described below.

Delete your account in the app:Settings > Account > Delete my account. You are signed out at once, your profile is removed, and your personal data is permanently deleted within 30 days. Records the law requires us to keep, such as bookkeeping for paid bookings, are kept only as long as required.

The text of chat messages is deleted 30 days after a conversation closes. The booking itself stays in your history until you delete your account.

If we ban an account: when someone seriously breaks our terms, for example with threats, harassment or fraud, we can close their account. So that it cannot simply be opened again, we keep a protected one-way code made from its email address, its business registration or personal identity number and its Instagram account, never the details themselves. We keep it for 3 years, or 5 years for threats, violence, sexual harassment or fraud, and delete it when that time ends. We do this to keep people on Fixmeapp safe (legitimate interest). We email the person why, and they can reply within 30 days to ask us to review the decision.

Reports: when you report someone, or someone reports you, we keep the report for 2 years after we have handled it, so that a repeated problem can be seen and a review can be answered. Then it is deleted. A report that led to a ban is kept for as long as the ban lasts.

Reported conversations and photos: when a chat or a photo is reported, we keep the messages or the photo until the report is handled and 30 more days for a review, even if they are deleted in the meantime; until then nobody else can see a deleted photo. Then the usual deletion applies.

Assistant-memory facts (sections 4 and 5) can be deleted one by one in your data wallet at any time, without deleting your account.

If you cannot use the app, email privacy@fixmeapp.ai with the subject “Data Deletion Request” from the email address on your account. We confirm it is you before deleting.

10. Security

All connections use HTTPS/TLS. Stored data is encrypted at rest by our hosting provider, sign-in codes are stored hashed and expire, and connections to calendars and Instagram use encrypted tokens. Access to production is limited to authorised people. No system is 100% secure, and we keep working on ours.

11. Ethical data economy: our vision

We believe people should be able to see and benefit from their own data. Our long-term goal is an ethical data economy where you choose what to contribute, get a receipt for every contribution, and earn from voluntary sharing. None of this is live yet, and until it is, your data is shared only as described in this policy.

When it launches, three promises hold from day one: every channel is off by default and is its own separate yes; what we sell is aggregated market insight, never individual data, never your words and never your identity; and deletion is described honestly: you can stop future contributions at once and destroy the link between you and past ones, but statistics already published stay published, with your connection to them provably destroyed.

Read more on our Ethical Data Economy page.

12. Transfers outside the EU/EEA

Some processors (for example OpenAI, Sentry and Expo) are based in the United States. Transfers rely on the EU–U.S. Data Privacy Framework or the EU Standard Contractual Clauses.

13. Children

Fixmeapp is not meant for children under 16. We do not knowingly collect data from children under 16. If you believe we have, contact us and we will delete it.

14. Changes to this policy

Updates appear here with a new “Last updated” date. Every consent is recorded against the policy version in force at that moment. If a change asks for something new, we tell you by email or in the app and ask you first. A new purpose is always a new question.

15. Contact

Questions about privacy: privacy@fixmeapp.ai.