Skip to main content
HeyfixitHeyfixit

← All legal documents

Heyfixit Data Processing Agreement

Version 1.0 · Effective 11 November 2026 · heyfixit.ai/legal/dpa

This Data Processing Agreement ("DPA") forms part of the agreement between Heyfixit, Inc. ("Heyfixit", "we", "us") and you under the Heyfixit Terms of Service. It applies from the date your first Order Form is signed, without a separate signature. If you need a signed copy for your records, ask us at privacy@heyfixit.ai. Words defined in the Terms of Service have the same meaning here.

1. How this DPA works

1.1 What it covers. This DPA applies when we process Customer Personal Data on your behalf in providing the Services. It lasts for as long as we hold Customer Personal Data, including after the Agreement ends until we delete it under clause 10.

1.2 Core terms and regional annexes. Clauses 1 to 15 apply to every customer. Annexes A to D (the "regional annexes") apply automatically, without a signature, only where the law each one names applies to the processing of Customer Personal Data, whatever your address. Annexes 1 to 3 describe the processing, our security measures and our Subprocessors. Clause 17.12 of the Terms of Service applies to any right or duty under Data Protection Law that cannot be excluded.

1.3 Definitions. In this DPA:

  • Customer Personal Data means personal data in Customer Data that we process on your behalf. It does not include the account details, billing contact details and Usage Data that clause 2.3 says we control, or De-identified Data.
  • Data Protection Law means the laws on data protection and privacy that apply to the processing of Customer Personal Data under the Agreement.
  • Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorised disclosure of, or access to, Customer Personal Data while we or our Subprocessors process it. Failed log-ins, pings, port scans, blocked attacks and other activity that does not compromise Customer Personal Data are not Personal Data Breaches.
  • Subprocessor means a third party we engage that processes Customer Personal Data on your behalf. It does not include our own staff. Nor does it include systems you connect under clause 4.6 of the Terms of Service or telecoms carriers that only carry calls and messages.
  • Transfer clauses means the standard contractual clauses and the UK addendum that Annex A incorporates.
  • Personal data, controller, processor, processing and data subject have the meanings Data Protection Law gives them. They include equivalent terms such as personal information, business and service provider.

2. Roles

2.1 You and us. You are the controller of Customer Personal Data or a processor acting for your client. We are your processor or, where you act for a client, your subprocessor.

2.2 When you act for a client. You are our only point of contact for your client. Your instructions count as your client's instructions too. You pass on to your client any notice from us that it needs.

2.3 Where we are a controller. We are the controller of the account details of Users and billing contacts. We are also the controller of Usage Data so far as it is personal data, and of the record clause 10.4A describes. We use these for our own purposes as our Privacy Policy describes. This DPA does not apply to them, except clause A.9. Information in logs that identifies a Contact is Customer Personal Data.

3. Processing on your instructions

3.1 Purpose. We process Customer Personal Data only to provide, support, secure and improve the Services for you under the Agreement, to create De-identified Data under clause 4 and where the law requires us to.

3.2 Your complete instructions. The Agreement and the way you configure the Services are your complete instructions to us on processing Customer Personal Data. A further instruction needs our written agreement. We may charge for following it.

4. De-identified Data

4.1 Your instruction. By using the Services, you instruct us to create De-identified Data from Customer Data (including Customer Personal Data) and to use it as clause 8.2 of the Terms of Service describes. This is part of your instructions under clause 3.2.

4.2 Your authority. You confirm that you are entitled to give this instruction for all Customer Data in your account, including data you hold for your clients. If you tell us in writing that a client of yours has not authorised it, we leave that client's data out of De-identified Data from then on.

4.3 Limits. We never use a person's voice to identify them. We do not create or keep a voiceprint or any other measurement of a person's voice that could identify them. We remove health details, notes on vulnerability, safety warnings and checks on engineers at the first step, and they do not form part of De-identified Data. We use call audio to create De-identified Data only after removing everything that identifies a person, including their voice. We never try to re-identify you, your clients, any individual or any property from it. We require anyone we share it with to give the same promise. Clause 8.2(g) of the Terms of Service covers data that turns out to be identifiable.

4.4 After de-identification. De-identified Data is not personal data and this DPA does not apply to it. Deleting Customer Personal Data under clause 10 does not affect it.

5. Our people

We give access to Customer Personal Data only to people who need it for their role. Each of them is bound by a duty of confidentiality under contract or law and receives security training.

6. Security

6.1 Our measures. We protect Customer Personal Data with the technical and organisational measures in Annex 2. They are also published at heyfixit.ai/legal/security.

6.2 Updates. We may update the measures as technology and risks change. An update will not reduce our measures below what Article 32 of the UK GDPR and the EU GDPR requires. An update that does not reduce the overall protection of Customer Personal Data applies when we publish it. Any other update follows clause 13.

7. Subprocessors and location

7.1 Your authorisation. You authorise us to use the Subprocessors listed at heyfixit.ai/legal/subprocessors (Annex 3). The list shows every provider we use or have ready to use, so we may switch between listed providers at any time.

7.2 Changes to the list. We may update the list at any time. Annexes A and B add advance notice and a right to object where the law requires them.

7.3 Location. We store Customer Data as Annex 1 describes. We and our Subprocessors may process Customer Personal Data in other countries, including the EU and the US, and Subprocessors may keep copies for the periods the list shows.

8. Personal Data Breaches

8.1 Notice. We tell you without undue delay after we become aware of a Personal Data Breach. We send the notice to the notice email address in your Order Form.

8.2 What we tell you. Our notice describes the breach and what we are doing about it. As far as we know it at the time, it gives the information you need to meet any duty Data Protection Law gives you. We update you as we learn more.

8.3 Notices to others. You decide whether to notify regulators and the people affected. We do not notify them about a Personal Data Breach unless the law requires us to or you ask us to.

8.4 No admission. Notifying you of or responding to a Personal Data Breach is not an admission of fault or liability by us.

9. Requests and help

9.1 Requests from individuals. If a person contacts us to exercise a right over Customer Personal Data, we pass the request to you. We answer it only as you instruct or the law requires, though we may tell the person to contact you.

9.2 Help with your duties. To answer a request or meet another duty under Data Protection Law, you use the features the Services offer first. Where those are not enough, we give reasonable further help at your reasonable cost.

9.3 Security questionnaire. Once a year at most, we answer a reasonable written security questionnaire from you. Our answers are our confidential information. Clauses 1 to 15 give no right to audit or inspect us. Annexes A and B add one only where the law requires it.

10. Deleting Customer Personal Data

10.1 Export. You can export Customer Personal Data during the term and for 30 days after the Agreement or an Order Form ends, as clause 6.4(c) of the Terms of Service describes.

10.2 Deletion. Within 30 days after that export period ends, we delete the Customer Personal Data held for the Services that have ended. This includes the copies we keep with our Subprocessors. Copies a Subprocessor keeps under its own retention, such as logs and backups, are deleted as the subprocessor list shows.

10.3 Backups. Copies in backups are overwritten in the normal backup cycle, within 35 days. Until then we protect them under this DPA and use them only to restore our systems.

10.4 What the law requires us to keep. Customer Personal Data that the law requires us to keep (where Annex A applies, the law of the UK, the EU or an EU member state) is kept only for that purpose and only for as long as the law requires. We protect it under this DPA while we hold it.

10.4A Our record of setup and use. When Customer Personal Data is deleted, we keep a record of how your account was set up and used: its configuration, and the approvals given and actions taken, with who took them and when. The record does not keep the content of calls, messages or files, or any free text. The only personal data in it is Users' names and work contact details. It refers to Contacts only by a reference that does not identify them once your other data is deleted. We keep it as a controller under clause 2.3, to establish, exercise or defend legal claims, for six years after the Agreement ends, securely and with access limited, and then delete it.

10.5 What is not affected. This clause does not apply to De-identified Data or Usage Data. Users' account details are handled under our Privacy Policy.

11. Your duties

You are responsible for:
(a) having a lawful basis for the processing and giving the notices Data Protection Law requires, including the privacy notices described in clause 2.3 of the Agent and Communications Terms;
(b) having the authority for us to process Customer Personal Data as this DPA describes, including your client's authorisation where you act as its processor (clause 2.4(b) of the Agent and Communications Terms);
(c) making sure your instructions comply with Data Protection Law;
(d) not putting into the Services any data that clause 3 of the Acceptable Use Policy does not allow;
(e) the accuracy of Customer Personal Data.

12. Liability

Each party's liability arising out of or in connection with this DPA, including the regional annexes and the transfer clauses, is subject to clause 14 of the Terms of Service, except where the law or the transfer clauses do not allow it. Nothing in this DPA limits the rights that data subjects have under the transfer clauses or Data Protection Law.

13. Changes

We may change this DPA as clause 16 of the Terms of Service describes. A change needed because Data Protection Law changes or an authority issues new transfer clauses can apply sooner under clause 16.2 of the Terms of Service. A change will not reduce our obligations below what Article 28 and Article 32 of the UK GDPR and the EU GDPR require.

14. Which terms win

For personal data only, if documents conflict, they apply in this order:
(a) the transfer clauses;
(b) this DPA, in which a regional annex wins over clauses 1 to 15 for the processing it covers;
(c) the rest of the Agreement.

An Order Form changes this DPA only as clause 1.2(a) of the Terms of Service allows. Nothing changes the transfer clauses, other than updates to the information in their annexes that this DPA allows.

15. Law and courts

Clauses 17.1 and 17.2 of the Terms of Service apply to this DPA, except where Annex A names another law because the official transfer texts require it. Irish law and the courts of Ireland govern the EU clauses. English law and the courts of England and Wales govern the UK Addendum.

Annex A: UK, EU, EEA and Swiss data protection law

A.1 When this annex applies. This annex applies only where the UK GDPR, the EU GDPR (Regulation (EU) 2016/679) or the Swiss Federal Act on Data Protection (FADP) applies to the processing of Customer Personal Data or, for clause A.9, of the personal data in clause 2.3, as those laws decide. With clauses 1 to 15 and Annexes 1 to 3, it is the processing contract that Article 28(3) of the UK GDPR and the EU GDPR requires. In this annex, Data Protection Law means those laws and the laws that supplement them.

A.2 Instructions.
(a) We process Customer Personal Data only on your documented instructions under clause 3.2, including for transfers. If UK, EU, EU member state or Swiss law requires other processing, we tell you first unless that law forbids it on important grounds of public interest.
(b) We tell you immediately if we believe an instruction breaks Data Protection Law. We may suspend following it until we agree with you how to proceed.
(c) You may give further documented instructions during the term. If we do not agree to follow one, we tell you promptly. Where the EU SCCs apply, Clause 16 then applies.

A.3 Help with your duties. Taking into account the nature of the processing and the information available to us, we help you meet your duties under Articles 32 to 36 (security, breach notices, impact assessments and prior consultation with a regulator) and with requests from individuals under clause 9.2. We do this first through Annex 2, the Documentation and the information in clause A.6(a). Further help is at your reasonable cost.

A.4 New Subprocessors.
(a) Notice.
(i) Before a provider that is not on the list starts to process Customer Personal Data, we add it to the list and email the notice email address in your Order Form at least 30 days in advance.
(ii) The email names the provider, what it will do and where it will process data.
(iii) Switching between listed providers needs no notice.
(b) Objections.
(i) Within those 30 days you may object in writing to privacy@heyfixit.ai, explaining reasonable data protection grounds.
(ii) We consider the objection in good faith and may offer an alternative.
(iii) If we cannot resolve your objection, you may end the affected Service before the new provider starts to process your Customer Personal Data. This is your only remedy. Fees you committed to for the period after it ends are waived. Fees you have already paid are not refunded.
(iv) If you do not object in time, the provider is authorised.
(c) Urgent replacements.
(i) If a provider fails, withdraws its service or creates a security risk, we may move its work at once to another provider on the list.
(ii) We do not move it to a provider that is not on the list until the notice period in (a) has run.
(d) Trials. A provider trialled only with test data or De-identified Data processes no Customer Personal Data and needs no notice.
(e) Terms with Subprocessors.
(i) We bind each Subprocessor by written terms that impose, in substance, the same data protection obligations as this DPA, so far as they apply to its service, including sufficient guarantees of appropriate technical and organisational measures.
(ii) We remain fully responsible to you for its performance of those obligations, subject to clause 12.
(iii) Clauses 3.4, 12.5(d) and 17.5 of the Terms of Service do not apply to a Subprocessor's breach of those obligations.

A.5 Personal Data Breaches. Our notice under clause 8.1 reaches you without undue delay after we become aware of the breach.

A.6 Audits.
(a) Information first. On request, we give you the information needed to show that we meet Article 28: our relevant policies, any audit reports or certificates we hold and our answers to a questionnaire under clause 9.3.
(b) When an audit is allowed. You may audit or inspect our processing of Customer Personal Data if you reasonably consider that the information in (a) is not enough to show that we meet Article 28, or a regulator requires it.
(c) Conditions. An audit or inspection:

  • happens no more than once a year, unless a regulator requires it or you explain reasonable grounds to believe we are not complying with this annex;
  • needs 30 days' written notice of its scope (less if a regulator requires it, or after a Personal Data Breach affecting your data);
  • takes place in our business hours;
  • is done by you or by an auditor bound by confidentiality who is not our competitor;
  • is at your cost, including the reasonable cost of our time;
  • must not disrupt the Services or our other customers;
  • excludes other customers' data.

(d) Our providers. For our Subprocessors, we give you the reports and certificates they make available to us instead of an audit of their facilities.
(e) Results. Audit results are our confidential information. You may use them only to check our compliance and to meet your own legal duties.

A.7 Return or deletion. When the Agreement or an Order Form ends, you choose whether we return Customer Personal Data to you through the export in clause 10.1 or delete it. If you ask in writing, we delete it before the export period ends. Otherwise clause 10 applies. We confirm deletion in writing on request and, where the transfer clauses apply, in every case.

A.8 Requests from public authorities. If a public authority asks us for Customer Personal Data, we tell you unless the law forbids it. We challenge the request where we reasonably consider it unlawful. We disclose only the minimum it requires.

A.9 Transfers.
(a) Authorisation. You authorise transfers of Customer Personal Data to the United States and to the other countries shown in Annex 1 and the subprocessor list. Where Data Protection Law requires a safeguard and no adequacy decision or other safeguard applies, the transfer clauses below provide it.
(b) EU and EEA. For transfers subject to the EU GDPR, the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914 (the "EU SCCs") are incorporated into this DPA by reference, as follows:

  • Module 1 applies to personal data you transfer to us that we process as a controller under clause 2.3 or clause A.10(b). Module 2 applies where you are a controller and Module 3 where you are a processor;
  • for Module 1, Annex I of the EU SCCs is completed from the Order Form and our Privacy Policy;
  • Clause 7 (docking clause) is not used;
  • Clause 9 uses Option 2 (general written authorisation), with the notice period in clause A.4;
  • the optional wording in Clause 11 is not used;
  • the competent supervisory authority is the one Clause 13 identifies for your situation;
  • Clause 17 uses Option 1, with Irish law;
  • under Clause 18, the courts of Ireland have jurisdiction;
  • Annex I of the EU SCCs is completed from the Order Form and Annex 1;
  • Annex II of the EU SCCs is Annex 2, as updated under clause 6.2;
  • Annex III of the EU SCCs is the subprocessor list;
  • audits under Clause 8.9 follow clause A.6;
  • we certify deletion in writing, as Clauses 8.5 and 16(d) require.

(c) United Kingdom. For transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU SCCs, version B1.0, issued by the Information Commissioner under section 119A of the Data Protection Act 2018 and in force from 21 March 2022 (the "UK Addendum"), is incorporated into this DPA by reference. It amends the EU SCCs as completed in (b). Tables 1 to 3 are completed from the Order Form, Annex 1, Annex 2 and the subprocessor list. In Table 4, neither party may end the UK Addendum under its Section 19. As the UK Addendum provides, English law and the courts of England and Wales govern it.
(d) Switzerland. For transfers subject to the FADP, the EU SCCs as completed in (b) apply with the changes the Swiss Federal Data Protection and Information Commissioner (FDPIC) requires:

  • the FDPIC is the competent supervisory authority so far as the FADP governs the transfer;
  • references to the EU GDPR mean the FADP;
  • the term "member state" does not stop data subjects in Switzerland from suing where they habitually live, under Clause 18(c).

(e) Signature. Signing an Order Form counts as signing the transfer clauses, including their annexes and tables.
(f) Replacement mechanisms. If the transfer clauses are replaced, updated or cease to be valid, we may adopt the new version or another safeguard the law allows by updating this DPA under clause 13.
(g) Transfer assessments. We give you the information you reasonably need for your assessment under Clause 14 of the EU SCCs, including a summary of the laws on public authority access that apply to us.

A.10 De-identified Data.
(a) You confirm that you have assessed that creating De-identified Data under clause 4 is compatible with the purposes for which the data was collected, and that your privacy notices describe it as clause 2.3 of the Agent and Communications Terms requires.
(b) So far as Data Protection Law treats us as deciding the purpose of creating De-identified Data, we are a separate controller for that step only, acting with your permission under clause 4.1. We rely on our own lawful basis, carry out our own assessments and give the information Articles 13 and 14 require through our Privacy Policy.
(c) If a person objects, to you or to us, to their data being used to create De-identified Data, we leave out their data that we have not yet de-identified, at no charge. Each of us tells the other when it receives an objection.

Annex B: US state privacy laws

B.1 When this annex applies. This annex applies only where the California Consumer Privacy Act as amended (the "CCPA") or another US state consumer privacy law applies to you as a business or controller for Customer Personal Data.

B.2 Roles. We are your service provider or contractor under the CCPA and your processor under the other state laws.

B.3 Business purposes. You make Customer Personal Data available to us only for these limited and specified business purposes:
(a) running Agents that call, text, WhatsApp and email Contacts for you and keep records of what they do;
(b) recording, transcribing and storing calls and messages;
(c) giving your Users access to the platform and its features;
(d) support, security and fixing errors;
(e) improving the Services, including by creating De-identified Data under clause 4.

B.4 What we do not do. We do not:
(a) sell or share Customer Personal Data, as the CCPA defines those words;
(b) retain, use or disclose it for any purpose other than the business purposes in clause B.3, including any other commercial purpose, except as the CCPA allows;
(c) retain, use or disclose it outside the direct business relationship between you and us;
(d) combine it with personal information we receive from anyone else or collect ourselves, except as the CCPA regulations allow.

B.5 Our commitments. We:
(a) comply with the CCPA duties that apply to us and give Customer Personal Data the level of privacy protection the CCPA requires;
(b) tell you within 5 business days after we decide that we can no longer meet those duties;
(c) let you take reasonable and appropriate steps to check that our use is consistent with your CCPA duties, through clause 9.3 and clause B.7(b);
(d) let you, on notice, take reasonable and appropriate steps to stop and remediate any unauthorised use of Customer Personal Data;
(e) certify that we understand the restrictions in this annex and will comply with them.

B.5A Consumer requests. You tell us about each consumer request under the CCPA that we must comply with, and give us the information we need to comply with it.

B.6 De-identified Data. Creating De-identified Data under clause 4 is internal use to improve our Services, which the CCPA regulations allow a service provider to make. Where the CCPA applies, De-identified Data also meets the definition of deidentified information in Cal. Civ. Code section 1798.140(m):
(a) we take reasonable measures so that it cannot be associated with a consumer or household;
(b) this DPA, published at heyfixit.ai/legal/dpa, is our public commitment to keep and use De-identified Data only in de-identified form and not to try to re-identify it;
(c) we bind every recipient of De-identified Data by contract to meet the same requirements.

B.7 Further terms.
(a) Where the CCPA applies, we engage each Subprocessor under a written contract that meets the CCPA. The published list is our notice of each engagement.
(b) Where the CCPA applies, you may carry out reasonable assessments of our compliance on the conditions in clause A.6. With your agreement, we may instead arrange an independent assessment at least once a year and give you the report on request.
(c) Where another US state privacy law requires it, we also:
(i) give you notice of a new Subprocessor through the published list, and an opportunity to object, as that law requires;
(ii) allow assessments as (b) describes;
(iii) return or delete Customer Personal Data at the end at your direction, as clause A.7 describes;
(iv) engage Subprocessors under written contracts that meet that law.

Annex C: Australia

C.1 When this annex applies. This annex applies only where you are bound by the Privacy Act 1988 (Cth) for Customer Personal Data.

C.2 The Australian Privacy Principles. We handle that personal information in a way that is consistent with the Australian Privacy Principles, other than APP 1, so far as they apply to the processing we do for you. This supports your duties under APP 8 when you disclose personal information to us outside Australia.

Annex D: United Arab Emirates

D.1 When this annex applies. This annex applies only where Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") applies to the processing of Customer Personal Data.

D.2 Roles and duties. You are the controller and we are the processor under the PDPL. We meet the duties the PDPL gives a processor.

D.3 Transfers outside the UAE. Where Customer Personal Data goes to a country that the PDPL does not treat as giving adequate protection, this DPA is the contract that requires us to apply the PDPL's provisions, measures and controls, so far as the PDPL allows a transfer on that basis.

D.4 DIFC and ADGM. The PDPL does not apply in free zones that have their own data protection laws. Where the DIFC Data Protection Law (DIFC Law No. 5 of 2020) or the ADGM Data Protection Regulations 2021 apply instead, this DPA applies with the changes those laws require. Where a transfer under either law needs standard clauses issued under it, those clauses apply, completed from Annexes 1 and 2. So far as that law allows, signing an Order Form counts as signing them.

Annex 1: Details of the processing

Parties and roles

  • You: the customer named in the Order Form, at the address and notice email address in it. Controller or processor acting for your client. Uses the Services.
  • Us: Heyfixit, Inc., 251 Little Falls Drive, Wilmington, Delaware 19808, United States, privacy@heyfixit.ai. Processor or subprocessor where you act for a client. Provides the Services.

Data subjects

  • Users.
  • Contacts.
  • Other people named in Customer Data, such as in work orders and records.

Personal data

  • Contact details: names, phone numbers, email addresses and addresses.
  • Job, visit and work-order details, such as booked times, preferred times and access arrangements.
  • Messages: texts, WhatsApp messages and emails.
  • Call recordings and transcripts.
  • Photos taken during work.
  • What a Contact chooses to tell an Agent.
  • Users' names and records of what they do in your account, such as approvals. We hold Users' account details as a controller under clause 2.3.
  • Access details for places, such as entry instructions and key-safe codes.
  • Who occupies or uses a place, and notes kept about people for the work.
  • Certificates and qualifications of engineers and contractors.
  • Location data recorded for the work.
  • Other files added to jobs and records.
  • Users' conversations with Vera.
  • Fields your organisation defines.

Sensitive data
Only what clause 3(d) of the Acceptable Use Policy allows: what the work needs, kept under your lawful basis, such as:

  • access or mobility needs for a visit, and notes on a person's vulnerability;
  • safety warnings about a person who has been abusive or threatening;
  • checks on engineers and contractors.

Safeguards: access only where a role needs it, the measures in Annex 2 and the limits in clause 3 of the Acceptable Use Policy.

Nature of the processing
Collecting, recording, transcribing, storing, organising and analysing Customer Personal Data with AI models; generating Outputs; making and receiving calls and messages; support; security; de-identification under clause 4; deletion.

Purpose

  • To provide, support, secure and improve the Services for you.
  • To create De-identified Data under clause 4 of this DPA and clause 8.2 of the Terms of Service.

Frequency
Continuous.

Duration and retention
For the term of the Agreement, then until deletion under clause 10. During the term, Customer Personal Data is kept until you delete it or ask us to delete it.

Where it is stored

  • Our platform stores Customer Data in the European Union, unless your Order Form names another region. Some Subprocessors keep copies elsewhere, as below and as the subprocessor list shows.
  • Backups and recovery copies: in the same region as the live data, stored separately from it across more than one data centre.
  • Processing: our platform stores Customer Data in the places above. We and our Subprocessors may process it, and Subprocessors may keep copies for the periods the subprocessor list shows, in other countries, including the EU and the US.
  • Accessed by Heyfixit, Inc. staff, including from India and the United States.

Transfers to Subprocessors
As the subprocessor list shows for each one (Annex 3), including how long it keeps copies.

Annex 2: Security measures

These are the measures we apply under clause 6. They are also published at heyfixit.ai/legal/security.

1. Separation of customers

  • Each customer's data is kept separate from every other customer's.

2. Access control

  • Staff have access to Customer Data only where their role needs it, and only the access it needs.
  • Multi-factor authentication protects every staff account that can reach production systems or Customer Data.
  • Access is removed promptly when a person leaves or changes role.

3. Encryption

  • Customer Data is encrypted at rest with AES-256 wherever our platform stores it, including backups.
  • It travels over public networks, and between our platform and our Subprocessors' services, using TLS 1.2 or higher. Calls and texts also cross telephone and messaging networks that we and our Subprocessors do not control.

4. Backups and recovery

  • Our databases have automated backups with point-in-time recovery. Other stores holding Customer Data are backed up or can be rebuilt.
  • Backups are stored separately from the live data, across more than one data centre in the same region (the European Union, unless your Order Form names another region), and are kept for at most 35 days.
  • We test restoring from backup before the Services first hold Customer Data, and periodically after that.
  • Our recovery targets are to restore services within 12 hours, with no more than 12 hours of data lost.

5. Monitoring

  • We monitor the platform, and its alerts reach a person, including out of hours.

6. Records of actions and changes

  • The Services record the actions taken in your account and each change to Customer Data, Agent Instructions and permissions.
  • Our cloud accounts keep audit logs of administrative actions.

7. Changes and testing

  • Changes to the Services are reviewed and tested before they reach production.
  • Test environments are separate from production and hold no live Customer Data.
  • We scan our code's dependencies and our container images for known vulnerabilities.

8. Providers

  • Before a provider processes Customer Personal Data, we check it and bind it by written data protection terms.
  • Every provider is bound by written terms not to use Customer Data to train AI models, except to detect fraud and abuse of its own service where its terms allow it.
  • The subprocessor list shows how long each provider keeps copies. Where a provider offers zero data retention on the plan we use, we use it.

9. Incidents

  • A written incident procedure sets how we rate an incident, who decides and how and when we tell customers.

10. People

  • Everyone with access to Customer Data is bound by a duty of confidentiality.

Annex 3: Subprocessors

Our Subprocessors are listed in a separate document, the subprocessor list, at heyfixit.ai/legal/subprocessors. For each one it shows what it does, where it processes data, how long it keeps copies and which parts of the Services it supports. The list names every provider in use and every provider ready to switch to, so moving between listed providers needs no notice.