FixControl Privacy Policy

Effective from 15 July 2026 · Terms of Service

§ 1. Data Controller

1. The controller of personal data processed in connection with the FixControl website and application (Windows, Android) is Nadzory Budowlane Grzegorz Turowski, address: Czerska 33/16, 80-180 Gdańsk, Poland, VAT ID: PL8461594579 (hereinafter: "Controller").
2. Contact for data protection matters: [email protected]. The Controller will respond within 30 days of receiving a request.

§ 2. Legal Basis for Processing

The Controller processes personal data in accordance with:

• Regulation (EU) 2016/679 (GDPR),
• Polish Personal Data Protection Act of 10 May 2018,
• Polish Act on Electronic Services of 18 July 2002.

§ 3. Data Collected by the Mobile and Desktop Application

The FixControl app (Android, Windows) transmits data exclusively to the server at fixcontrol.pl. The following table describes what data is collected and for what purpose:

The application does not collect GPS location data, contact lists, or any other device diagnostic data.

§ 4. App Permissions

Android

• CAMERA — taking photos of construction defects in the field. Used only upon user request. Photos are uploaded to the server and linked to a specific defect record.
• RECORD_AUDIO — dictating defect descriptions (speech-to-text). Speech recognition is performed locally by the Android Speech Recognizer API. No audio recordings are stored or transmitted by the Controller.
• INTERNET — communication with fixcontrol.pl server (HTTPS).
• READ/WRITE_EXTERNAL_STORAGE (Android ≤ 9) — saving exported PDF/XLSX files to the Documents folder.

Windows

• Microphone — dictating defect descriptions via Windows Speech Recognition API. Processing is local; no audio is transmitted to the Controller.
• File system access (Documents) — saving PDF/XLSX exports and floor plan cache files.
• Outbound internet access — communication with fixcontrol.pl server (HTTPS).

§ 5. Data Collected by the Web Panel

1. At company Registration: company name, administrator email address, password (stored as a bcrypt hash).
2. During panel use: user actions logged in defect history (login, operation type, timestamp).
3. Technical data: IP address (logged by nginx for security purposes), browser headers.
4. Analytics: anonymous traffic data via Google Analytics 4 (GA4) — only after consent to analytics cookies.
5. Marketing: a Google Click ID ("gclid") — this is not personal data, only information that a given visit originated from a specific Google Ads advertisement. This identifier is shared with Google Ads at the moment of account registration regardless of consent to marketing cookies — no other data is shared with it. Additional Google Ads cookies that extend this attribution are set only after consent — see § 13.

§ 6. Purpose and Legal Basis for Processing

1. Service provision (Art. 6(1)(b) GDPR) — account registration and management, defect handling.
2. Legal compliance (Art. 6(1)(c) GDPR) — documentation, invoices.
3. Legitimate interests of the Controller (Art. 6(1)(f) GDPR) — system security, technical logs.
4. User consent (Art. 6(1)(a) GDPR) — GA4 analytics cookies and Google Ads marketing cookies.
5. Legitimate interests of the Controller (Art. 6(1)(f) GDPR) — measuring the effectiveness of the Controller's own Google Ads campaigns via a Google Click ID (gclid), regardless of cookie consent; only information about the traffic source is processed, no personal data.

§ 7. Data Storage and Security

1. All data transmitted between the application and the server is encrypted using TLS 1.2/1.3 (HTTPS).
2. Passwords are stored in hashed form (bcrypt with SHA-256 pre-hashing) — never in plain text.
3. Data is stored on Hetzner Online GmbH servers in Germany (European Union), compliant with GDPR and ISO 27001.
4. The floor plan cache (PNG files) is stored locally on the user's device for up to 90 days from last access, then automatically deleted by the application.

§ 8. Data Retention

1. Account data — for the duration of the active account.
2. Defect data and photos — for the duration of service use or until manually deleted by the user.
3. Billing data — for 5 years from the end of the tax year (legal obligation).
4. Technical server logs — maximum 90 days.
5. Local device cache — maximum 90 days from last access.

§ 9. Recipients of Personal Data

1. User data may be shared only with:
   • Hetzner Online GmbH (Germany, EU) — server infrastructure provider,
   • Google LLC (USA) — anonymous analytics data via GA4 from the website (only after consent to analytics cookies), a Google Click ID (gclid) — information only about the traffic source, no personal data — shared with Google Ads to measure the effectiveness of the Controller's advertising campaigns on the website (regardless of consent to marketing cookies; additional Google Ads cookies described in § 13 are set only after consent), and, on Android only, the advertising identifier and selected in-app events shared with Google Ads for the same purpose; Google LLC holds a Data Privacy Framework certification,
   • PayPro SA (Przelewy24) (Poland, EU) — subscription payment processing in PLN,
   • Stripe, Inc. (USA) — subscription payment processing in EUR and USD,
   • government authorities — only as required by applicable law.
2. The Controller does not sell, rent, or transfer personal data to third parties for marketing purposes.
3. The FixControl app displays no advertisements within the app. The Android version shares the advertising identifier and selected in-app events (e.g. login, sign-up) with Google Ads solely to measure the effectiveness of the Controller's own advertising campaigns — how many users who clicked an ad installed and use the app. This data is not used to build advertising profiles of users for third parties or to show them ads in other apps. The user gives consent to this processing by accepting the Terms of Service and this Privacy Policy on first launch of the app; consent may be withdrawn at any time by contacting the Controller (§ 10).
4. The website displays no advertisements. A Google Click ID (gclid) — only information that a visit originated from a specific ad, no personal data — is shared with Google Ads at the moment of account registration, regardless of consent to marketing cookies; it is used solely to measure the effectiveness of the Controller's own Google Ads campaigns — linking a registration/conversion on the website to a specific ad click. Additional Google Ads cookies that extend this attribution are set only after consent to marketing cookies (§ 13). This data is not used to build advertising profiles of users for third parties or to show them ads on other websites. Consent to the additional Google Ads cookies may be withdrawn at any time via the cookie banner (the "Manage consent" button on the Cookies page) or by contacting the Controller (§ 10).

§ 10. User Rights (GDPR)

1. Each user has the right to:
   • Access their personal data (Art. 15 GDPR),
   • Rectification of inaccurate data (Art. 16 GDPR),
   • Erasure of data — "right to be forgotten" (Art. 17 GDPR),
   • Restriction of processing (Art. 18 GDPR),
   • Data portability (Art. 20 GDPR),
   • Objection to processing (Art. 21 GDPR),
   • Withdrawal of consent at any time (Art. 7(3) GDPR).
2. To exercise these rights, contact the Controller at: [email protected].
3. Users also have the right to lodge a complaint with the Polish supervisory authority (UODO, ul. Stawki 2, 00-193 Warszawa, www.uodo.gov.pl).

§ 11. Account and Data Deletion

1. Users may request deletion of their account and associated personal data at any time by sending an email to [email protected] with the subject line "FixControl Account Deletion".
2. The Controller will delete the data within 30 days of receiving the request, subject to data that must be retained by law (e.g. billing records for 5 years).
3. The local application cache (floor plans, temporary files) can be deleted via the operating system settings: Settings → Apps → FixControl → Clear Data (Android), or by manually deleting the Documents\usterki_rzuty folder (Windows).

§ 12. Children's Privacy

1. The FixControl app and website are intended exclusively for adults acting in a professional context (construction defect management). The service is not directed at children under 16 years of age.
2. The Controller does not knowingly collect personal data from children under 16. If such data is discovered, it will be deleted immediately. If you believe we have inadvertently collected data from a child, please contact us at [email protected].

§ 13. Cookies (Web Panel)

1. The web service uses the following cookies:
   • Necessary: usterki_token — JWT for session authentication (7 days, httpOnly, SameSite=Lax); usterki_lang — language preference (1 year).
   • Analytics (GA4): _ga, _ga_* — only after user consent. Validity: 2 years.
   • Marketing/advertising (Google Ads): _gcl_au, _gcl_aw — only after user consent. Validity: up to 90 days.
   • Payment: Przelewy24 or Stripe cookies during payment processing.
2. Independent of cookies: the gclid parameter (ad click identifier) is shared with Google Ads directly from the URL — without being stored in a cookie and regardless of consent. Only information about the traffic source (that it originated from an ad click) is shared, no personal data — see § 5 and § 9.
3. The mobile and desktop application does not use cookies. It uses secure local storage (Flutter Secure Storage) only to store the JWT authentication token on the device.

§ 14. Changes to This Privacy Policy

1. The Controller reserves the right to amend this Policy. Users will be notified of significant changes via the service website or email with 14 days' advance notice.
2. Current version effective from 15 July 2026.

Home · Terms of Service · Sign in