FixPilot — Privacy Policy

This Privacy Policy explains how we collect, use, and share information when you use FixPilot’s web dashboard, Chrome extension, and iOS app (the “Service”). This is a US-only offering directed to users in the United States.

Scope & US-Only Offering

We offer and direct the Service to users in the United States. We do not target or promise availability outside the US. If you access the Service from outside the US, you (a) consent to transfer and processing in the United States under this Policy, (b) acknowledge US law applies (not EU/UK/Canada regimes), and (c) agree we may limit, suspend, or terminate access (and delete data) where required by law or prudent.

Information We Collect

• Account & Identifiers. Name, email, plan/tier, account IDs, password hash (if any).
• Device & Usage. IP address, user agent, app/extension versions, interaction events (e.g., extension clicked, upload started, report created), diagnostics/crash logs.
• Vehicle & Content. VIN, make/model/year/mileage, listing URLs, photos/videos (which may incidentally include license plates, faces, addresses, or other personal data), OBD/DTC codes, and optional documents (e.g., title images, invoices). We do not automatically redact images or documents.
• Payments. Tokenized payment details and transaction metadata processed by our payment provider; we do not store full card numbers.
• Approximate Location. ZIP or IP-derived region to localize rates and estimates.

Sources of Information

• You (inputs/uploads in the apps/extension/web).
• Your device/browser (for the current tab you activate in the extension).
• Our Service and systems (logs, security, analytics).
• Third-party data sources/APIs (e.g., VIN/parts/labor benchmarks; potential NMVTIS data via authorized providers in the future).
• Service providers processing data on our behalf (hosting, payments, analytics, email delivery, cloud AI inference).

How We Use Information

• Provide & operate the Service (generate reports, estimates, shareable links).
• Security & misuse prevention (detect, investigate, and prevent fraud/abuse).
• Improve & develop products, models, and features (including quality, accuracy, and new capabilities).
• De-identified/aggregated analytics (statistics, benchmarks, insights that do not identify you).
• Communications (Service messages, policy updates, support).
• Legal compliance (records, lawful requests).

Sharing with Service Providers (No Vendor Listing)

We share personal information with third parties that process it on our behalf to provide the Service—e.g., hosting/storage, payments, analytics, email delivery, and cloud AI inference. We may change or add providers at any time. We impose contractual safeguards and purpose limits. We do not “sell” or “share” personal information for cross-context behavioral advertising under US state privacy laws.

Vendor confidentiality. We do not publicly identify individual vendors or publish subprocessor lists. If legally required (e.g., by a valid court/government order), we may disclose the minimum necessary information.

AI Providers & Training

We use cloud model providers to analyze content and generate outputs. Where controls exist, we configure providers not to train their foundation models on your prompts/outputs and to prohibit use for their own advertising/marketing. We may use vendor fine-tuning/embedding features to deliver functionality. We do not disclose the identity of specific AI vendors in this Policy.

Learning from User Content; Enterprise Opt-Out

By default, FixPilot may use User Content (your uploads and related metadata) to improve FixPilot products, models, and features, and to create de-identified/aggregated datasets for any lawful purpose.

Enterprise opt-out. Customers on eligible custom-priced tiers may contractually opt out of product/model improvement for their Customer Content by emailing legal@fixpilot.ai. We may continue to use de-identified analytics.

Report Links & Access

Reports are viewable by link (unlisted). By default, links auto-expire after 180 days; you may revoke earlier or extend before expiry from your dashboard. Once a link expires, it is permanently disabled and cannot be restored. To share again, you must create a new report/link.

Retention & Deletion

We retain information as long as needed to provide the Service and for legitimate business/legal purposes. On a verified request (or account deletion), we will delete or de-identify personal information within 30–60 days, subject to legal holds and backup cycles. (Billing/financial records may be retained as required by law.)

Your US Privacy Rights

If you are covered by CA/CO/CT/UT/VA (or similar) laws, you may request to access, correct, or delete personal information and appeal a denied request. Submit requests to legal@fixpilot.ai. We will verify your identity (and the authority of agents). We do not sell/share personal information for cross-context ads.

Cookies & Tracking

We use essential cookies and first-party analytics. We do not run cross-context advertising. A cookie banner is not required for our current US-only use; we will update this Policy if that changes.

Children

The Service is not directed to children under 13, and we do not knowingly collect data from users under 16.

Security

We use reasonable and appropriate safeguards, including TLS in transit, encryption at rest, role-based access controls, logging/monitoring, backups, and vulnerability/incident processes. No system is perfectly secure.

Changes to This Policy

We may update this Policy. Material changes take effect 30 days after notice (email or in-product). Continued use after the effective date means you accept the changes.