1. Who We Are
Fixr, including the Fixr website, Fixr web application, Fixr APIs, the Fixr Assistant browser extension, and related hosted services (together, the "Services"), is provided by:
Datafixr Limited
Private limited company registered in England and Wales
Company number: 17209258
First Floor, 18-19 South Bar Street, Banbury, Oxfordshire, England, OX16 9AF
Email: info@datafixr.io
If you have appointed a data protection officer or privacy lead, you can contact them at: info@datafixr.io
Fixr and DataFixr are products and trading brands of Datafixr Limited.
In this Privacy Policy, "Fixr", "DataFixr", "we", "us", and "our" mean Datafixr Limited.
2. Scope
This Privacy Policy explains how we collect, use, store, share, and otherwise process personal data when you:
- visit the Fixr website;
- create or use a Fixr account;
- use the Fixr web application, APIs, data cleaning tools, list and export tools, and related features;
- install or use the Fixr Assistant browser extension; or
- otherwise interact with Fixr.
This policy covers the Extension and the Fixr platform together. The Extension's purpose is to help users capture company and contact details from supported LinkedIn pages, compare, create, or update records in Fixr, and — through the optional Connectr feature, which you must separately opt in to — send LinkedIn connection requests on your behalf from a list you select.
This policy does not govern third-party websites, services, or pages that you access separately, such as LinkedIn, Companies House, or other external sites, except to the extent that the Extension reads visible content from supported LinkedIn company pages or LinkedIn profile pages after your opt-in, or sends relevant extracted fields to the configured Fixr backend at your request.
3. Data Controller and Processor Roles
For personal data processed to operate Fixr accounts, authentication, workspace administration, usage tracking, security, subscription management, API access, and our own platform operations, Datafixr Limited is the data controller.
Where a Fixr customer uses the Services to import, upload, extract, clean, enrich, compare, sync, verify, create, update, or export records relating to third-party individuals or businesses, that customer may be the data controller and Fixr may act as a processor or service provider on the customer's behalf, depending on the applicable contract and law.
In some cases, Fixr may also act as controller for data included in Fixr's own service dataset, platform administration records, support records, and security or compliance records.
4. Personal Data We Collect
Depending on how you use the Services, we may collect or process the following categories of personal data.
A. Account and identity data
- Email address
- Password and password setup state
- User ID and authentication/session data
- First name and last name
- Organisation membership
- User role and permissions, such as admin or organisation manager status
- Invitation records and password setup links
- Account status, including disabled or deleted status and related timestamps
- Account-closure status, closure reason, and closure timestamps
We do not intentionally store plain-text passwords in the Fixr application database. Authentication is managed through our authentication provider.
B. Organisation and workspace data
- Organisation name
- Organisation website / company URL
- Postal address details, including first line, second line, city, county, and post code
- Workspace and organisation identifiers
- API key metadata, such as API key prefix, hashed API key, revoked status, creation date, and creator
- Workspace user roster and roles
- Subscription and tier records, including plan, billing cycle dates, credit allowance, credits used, proration, status, and change notes
Payment card details are handled by our payment providers rather than stored directly in the main Fixr application database. We may store billing and subscription metadata such as customer references, plan state, invoices, payment status, and credit balances.
C. Browser extension data and local browser storage
When you use the Fixr Assistant browser extension, the Extension stores certain data locally in browser extension storage so it can operate and display information in the side panel.
- email address used for login;
- access token, refresh token, and expiry time;
- basic account details;
- configured Fixr base URL;
- extracted tab data so the side panel can display it and compare it with Fixr; and
- related runtime state.
D. Website and web application preference/storage data
When you use the Fixr website or web app, we may use:
- Authentication cookies needed to keep you signed in
- Basic UI preference cookies or local storage, such as sidebar and theme preferences
- Local browser storage used to remember visual preferences
E. Company, contact, and business record data
Fixr may store, display, compare, create, update, import, export, clean, or otherwise process business records, including:
Company data, such as:
- Company name
- Website URL and normalized website host
- LinkedIn URL
- Industry and final industry
- City and country/region
- Company size
- Founded year
- Description
- Email address
- Phone number
- Live/dead or status information
- Keywords
- Source metadata and enrichment timestamps
- Verification status and timestamps for phone verification
- Third-party or CRM identifiers where available, such as record IDs
Contact data, such as:
- First name and last name
- Job title
- Company name
- Associated company record
- LinkedIn URL
- Email address
- Phone number
- Industry
- Seniority
- ICP / segmentation metadata
- Keywords
- Source metadata and enrichment timestamps
- Verification status and timestamps for phone verification
F. Data read from supported LinkedIn pages by the Extension
Before page-data collection starts, the Extension shows an in-product disclosure and requires your affirmative opt-in.
Once you opt in, the Extension may read visible page content on supported LinkedIn company pages and LinkedIn profile pages.
This may include company or profile fields and visible contact details such as name, job title, employer, LinkedIn URL, email, phone number, website, birthday, company details, page URL, metadata, and structured data when present.
The Extension may also read location information visible on supported LinkedIn pages, such as a company headquarters, city or country. It does not collect device GPS or IP-based location.
G. Data processed by Connectr
Connectr is off by default. Before a run can start, the Extension shows an in-product disclosure and requires your affirmative opt-in, and you confirm each run and the list it works from.
To send a connection request, Connectr uses the LinkedIn profile URL and name held in the list you select, and reads the visible profile page to confirm it has opened the right person and to check whether a request is needed. It does not send a connection note, so no message content is processed.
The Extension records the progress and outcome of each run — such as which list items were queued, sent, skipped, or failed, and the reason — so a run can survive a browser restart and so you can see what happened. This is stored locally in extension storage as described in section C.
Connection requests are sent through your own signed-in LinkedIn account. We do not receive or store your LinkedIn credentials. The time your account spends running Connectr is reported to Fixr as usage so it can be counted against your plan's Fetchr allowance; that record covers the duration of the activity, not the identity of the people you contacted.
H. Uploaded and imported data
If you upload a CSV file or submit data through APIs or forms, we may process:
- file name;
- CSV contents and headers;
- row counts;
- company/contact data contained in the upload;
- cleaned, normalized, validated, deduplicated, or enriched output; and
- change previews, warnings, or quality statistics generated by the tool.
Some upload and cleaning workflows process file contents transiently to generate cleaned output, previews, and quality checks, while separately recording limited operational, usage, or billing metadata such as file name, row count, workspace, user, and credits used.
I. Search, list, export, and usage data
We may process:
- search terms and filters you enter;
- list names, entity types, and list membership;
- selected record IDs for export or list actions;
- export context, including whether premium fields were requested;
- usage history, such as file name, search query, number of rows, entity type, credits used, fields requested/delivered, timestamps, and related context metadata.
J. Public registry and lookup data
If you use Companies House or related lookup features, we may process and return public registry data, including:
- company search queries and company numbers;
- company profile information;
- registered office address details;
- officers data;
- persons with significant control data; and
- related public filing metadata.
This data may include personal data about officers or controllers, such as names, roles, appointment dates, nationality, country of residence, occupation, and partial date-of-birth information where available from the public source.
K. Phone verification and enrichment data
If you use phone verification or re-verification features, we may process:
- the phone number submitted or stored on the relevant record;
- normalized phone number data;
- verification provider responses;
- summary indicators, such as whether a number appears possible, mobile, active, UK-based, or on the TPS;
- phone verification status, timestamps, and retry timing.
L. Contact and company enrichment data
If you use contact or company enrichment features powered by external providers such as Apollo, Bright Data, or Hunter, we may process:
- the input fields sent to the provider, such as a name, email address, LinkedIn URL, company name, or website domain;
- enriched output returned by the provider, such as verified or discovered email addresses, job titles, seniority, firmographics, industry, company size, location, and related public profile or company data;
- provider match status, the dataset or source used, and enrichment timestamps; and
- normalized cached copies of enrichment results used to fulfil later requests.
M. Technical, security, and operational data
The Services and our providers may process limited technical data necessary to operate and secure the Services, such as:
- IP address
- request metadata
- browser, device, or extension version information
- server and access logs
- API key usage
- session and token data
- error and troubleshooting information
N. Billing, payment, automatic top-up, and refund data
When you buy a paid plan or top-up credits, or enable automatic top-ups, we may process billing and payment data, including:
- billing contact name and email, and organisation billing name and address;
- country, tax residence indicators, and tax identifier and its verification status;
- plan, term, seats, currency, price, subtotal, tax, total, status, and timestamps;
- credits granted, used, remaining, allocated pack, expiry, and source;
- Stripe customer, subscription, checkout, invoice, payment-intent, charge, refund, and transaction identifiers;
- limited saved payment-method metadata, such as card brand, last four digits, and expiry month and year;
- payment status, decline or action-required status, a safe customer-facing failure reason, and retry state;
- automatic top-up enabled/disabled status, the selected pack, credit quantity, amount, currency, trigger, and current eligibility;
- the authorising manager, consent timestamp, consent version, Terms version, Privacy version, and subsequent change or disable events;
- refund requester, credit-pack identifier, refund amount, refund status, Stripe refund identifier, and request and completion timestamps; and
- receipts, invoices, statements, and related support or dispute records.
Fixr does not receive or store the full payment card number or CVC. Stripe processes the payment credentials. Fixr may store limited card metadata and payment-provider identifiers needed to display the saved method, process authorised charges and refunds, reconcile transactions, prevent duplicate charges, provide support, and meet accounting or legal obligations.
5. Sources of Personal Data
We may collect personal data:
- directly from you;
- from your employer, workspace owner, or organisation administrator;
- from visible content on supported LinkedIn company pages and LinkedIn profile pages that the Extension reads after your opt-in;
- from CSV uploads, API requests, forms, and manual data entry;
- from existing records in your Fixr workspace;
- from public sources and registries, such as Companies House;
- from verification or enrichment providers used when you request those features; and
- from our authentication, hosting, and infrastructure providers.
6. How We Use Personal Data and Legal Bases
If UK GDPR or EU GDPR applies, we generally rely on the following legal bases.
To provide the Services
This includes:
- creating and administering accounts;
- authenticating users and maintaining sessions;
- inviting users and enabling password setup;
- storing and managing organisations, workspaces, roles, lists, and API access;
- searching, comparing, matching, creating, updating, exporting, and displaying records;
- processing CSV cleaning, normalization, validation, deduplication, and enrichment requests;
- supporting the Fixr Assistant workflow for reading visible content on supported LinkedIn pages after your opt-in, displaying it in the side panel, and enabling Search Fixr, Create, Update, and list enrichment features;
- verifying phone numbers and performing public registry lookups; and
- providing usage, credit, and subscription functionality.
Legal basis: performance of a contract, or steps taken at your request before entering into a contract.
To process billing, payments, and automatic top-ups
Where you buy a plan or top-up credits, set up a payment method, enable automatic top-ups, or request a refund, we process billing and payment data to take the payment, grant credits after the provider confirms payment, execute an enabled automatic top-up instruction, process eligible refunds, and generate receipts, statements, and billing history.
Legal basis: performance of a contract, or steps taken at your request before entering into a contract. We rely on our legitimate interests for fraud and misuse prevention, idempotency and duplicate-charge prevention, reconciliation, and investigating failed or disputed payments, and on legal obligations for accounting, tax, and financial recordkeeping.
The control you use to authorise future automatic charges is a payment and contractual authorisation. It is not, by itself, the "consent" lawful basis under Article 6 UK GDPR, and we do not treat it as such.
To operate, secure, monitor, and improve the Services
This includes:
- role-based access control;
- fraud, abuse, and misuse prevention;
- debugging, support, and reliability;
- usage reporting and audit-friendly history; and
- maintaining searchable indexes, normalized fields, and derived metadata.
Legal basis: our legitimate interests in operating a secure, reliable, and effective service.
To comply with law and protect rights
This includes:
- responding to lawful requests;
- enforcing our terms and policies; and
- maintaining records for compliance, accounting, tax, security, and dispute resolution.
Legal basis: compliance with legal obligations and our legitimate interests in defending rights and claims.
To process customer-directed third-party data
Where customers use Fixr to process business contact or company data, uploaded files, extension extracts, or API submissions, we process that data under the customer's instructions and the legal basis applicable to the customer's use.
For shared enrichment caching and service quality controls
Some enrichment features may use time-limited normalized caching to reduce duplicate provider calls, improve response times, support billing accuracy, and maintain service quality. Access to cached enrichment remains controlled through the relevant customer workspace or organisation context.
Legal basis: performance of a contract where the customer requests the feature, and our legitimate interests in operating an efficient, abuse-resistant, and reliable service where we process related operational metadata for our own platform operations.
For Fixr Assistant page-data collection on supported LinkedIn pages
Before page-data collection starts, the Extension shows an in-product disclosure and requires your affirmative opt-in. Once you opt in, the Extension may read visible page content from supported LinkedIn company pages and LinkedIn profile pages so the side panel can display the extracted data and compare it with Fixr.
When you use Search Fixr, Create, Update, or list enrichment features, relevant extracted fields are sent to the configured Fixr backend so Fixr can look up, compare, create, or update records.
Legal basis: consent for page-data collection on supported LinkedIn pages. Where you direct Fixr to search, compare, create, or update records, we also process the relevant data to provide the functionality you requested.
Where consent applies
If we rely on consent for a specific activity, we will ask for it where required by law. For Fixr Assistant page-data collection, you can withdraw consent at any time from the Extension's Options page. Revoking consent stops page-data collection and clears locally stored extracted page data.
8. International Transfers
Data processed locally by the Extension is stored in your browser profile or extension storage on your device.
Data processed by the web app, APIs, authentication systems, hosting providers, and feature-specific providers may be processed in countries where those providers operate. In particular, our payment processor Stripe may process billing and payment data in the United States, and enrichment providers may process data outside the UK and EEA, including Apollo in the United States, Hunter in the European Union, and Bright Data in Israel.
Where required by applicable law, we will use appropriate safeguards for international transfers, such as adequacy decisions, standard contractual clauses, or equivalent lawful transfer mechanisms.
9. Data Retention
We retain personal data for no longer than necessary for the purposes described in this policy, unless a longer period is required or permitted by law.
In general:
- web app authentication cookies remain until logout, expiry, or deletion;
- local browser preferences remain until you clear them;
- for extracted page data stored by the Extension, revoking consent from the Extension's Options page stops page-data collection and clears locally stored extracted page data;
- uploaded CSV contents processed by the cleaning endpoint are handled transiently to provide the requested output, while usage metadata may be logged;
- time-limited enrichment results and related unlock records may be cached for limited periods to support enrichment, billing, and service quality workflows;
- account, organisation, subscription, list, record, and usage history data may be retained while the account or workspace is active and afterward as needed for audit, security, compliance, dispute resolution, backups, and legal obligations;
- support tickets, support messages, and permitted attachments may be retained as long as reasonably needed for support, security, fraud prevention, dispute handling, and compliance;
- billing, payment, automatic top-up authorisation, and refund records, including invoices, statements, transaction records, consent and settings-change history, and failed-payment logs, are retained for the period required for accounting, tax, dispute and chargeback handling, fraud prevention, and legal claims, and are then deleted or anonymised;
- deleted or disabled records may first be flagged as deleted rather than immediately erased.
Account and organisation closure
You can close an eligible Fixr account from your account settings, and an organisation manager can separately close an entire organisation. Closure is a soft-close: it revokes access straight away, but it is not the same as immediate, permanent erasure of all personal data or Customer Data. The effects fall into three stages.
Immediately after a successful closure. Access is disabled and the acting user is signed out; roles and active access are revoked; and a closure timestamp and reason are recorded. Where you are the last active user in your organisation, or an organisation is closed, we also disable future automatic top-up authorisation and turn off subscription renewal. A closed account cannot be restored through ordinary login, signup, OAuth, or an organisation invitation; restoring a self-closed account requires a support or administrator process.
At the end of the current paid period. Where a paid subscription exists and renewal has been turned off, the subscription runs to the end of its already-paid period and then does not renew. The organisation may no longer receive paid-plan service after that period. This does not erase billing history or Customer Data.
Longer-term retention. Closure does not immediately erase your records. Subject to the account and applicable law, we may retain account and authentication records (including the authentication identity, email, name, former role, closure status, reason, and timestamps), organisation and Customer Data (including lists, imported and enriched records, usage history, and API-key metadata), billing and accounting records (including invoices, payment and refund transactions, limited card metadata such as brand and last four digits, and automatic top-up authorisation and event history), and support, security, fraud, audit, backup, and legal-claim records. We keep this information only for as long as reasonably necessary for the purposes described in this policy — including operating the Services, maintaining closure and suppression state, preventing unauthorised reactivation, accounting and tax, dispute and chargeback handling, fraud prevention, security, support, legal obligations and claims, and backups — and then delete or anonymise it, subject to legal, technical, contractual, and backup constraints.
Because billing and organisation data belong to the organisation rather than to an individual, closing one member's account does not close the organisation, cancel its subscription, or delete organisation-owned data; the organisation continues under its remaining managers. A sole manager with other active members cannot close only their own account, and must first appoint another manager or use the organisation-closure process.
Self-service closure is not the same as a data-protection erasure request. To request erasure, restriction, access, correction, or portability of personal data, contact us at: info@datafixr.io. Such requests remain subject to identity verification, legal exemptions, accounting and tax requirements, security and fraud records, legal claims, data controlled by a customer organisation, records involving other users, and backup and technical deletion cycles.
10. Security
We use reasonable technical and organisational measures designed to protect personal data, including measures such as:
- HTTPS/TLS for network communication;
- authenticated access controls;
- role-based access controls and row-level access controls where implemented;
- hashed storage of organisation API keys rather than storing the raw key for later display;
- session management and cookie controls; and
- provider-managed authentication and password handling.
No system can guarantee absolute security. You are responsible for keeping your credentials, device, browser profile, and extension environment secure.
11. Your Privacy Rights
Depending on where you live, you may have rights including:
- the right to know whether we process your personal data;
- the right to access personal data;
- the right to correct inaccurate personal data;
- the right to delete personal data, subject to exceptions;
- the right to restrict or object to certain processing;
- the right to data portability;
- the right to withdraw consent where processing is based on consent;
- the right to opt out of sale or sharing, if applicable;
- the right to limit use of sensitive personal information, if applicable;
- the right not to be discriminated against for exercising privacy rights; and
- the right to lodge a complaint with a supervisory authority or regulator.
To exercise your rights, contact us at: info@datafixr.io
We may ask for information needed to verify your identity, authority, and the scope of your request before acting on it. We aim to respond within the timeframes required by applicable law.
If your request relates to data that a Fixr customer controls, we may direct you to that customer as the primary controller.
13. Automated Processing
Fixr may use automated rules and workflows to search, normalize, validate, deduplicate, compare, verify, or enrich data. This includes matching records by identifiers such as email, phone number, LinkedIn URL, website host, or company data, and generating search indexes or verification flags.
Fixr also uses automated rules to monitor an organisation's spendable credit balance. If an organisation manager has enabled automatic top-ups and the configured conditions are met, the system may create and submit a charge for the selected pack to the saved payment method. This is an execution of the organisation's configured billing instruction rather than profiling used to determine creditworthiness or eligibility. Managers can review the setting, see the trigger and pack, disable future automatic top-ups, and contact support about a payment or refund. Some payments may be declined or require additional authentication by Stripe or the card issuer.
Fixr does not use solely automated decision-making that produces legal or similarly significant effects about individuals. Automatic top-ups execute a billing instruction the organisation has configured rather than making a decision about an individual.
14. Children's Privacy
The Services are intended for business and professional use and are not directed to children. We do not knowingly collect personal data from children in connection with the Services.
15. Your Responsibilities When Using Third-Party Data
If you use Fixr to collect, import, upload, extract, verify, enrich, compare, create, update, or export records about other individuals, you are responsible for ensuring that you have an appropriate legal basis and that your use complies with applicable privacy, employment, marketing, and data protection laws.
If you use contact data for outreach or direct marketing, you are also responsible for complying with applicable electronic communications and marketing rules, including any consent, suppression, TPS, or CTPS screening obligations that apply to your use case.
You should not upload special category or highly sensitive personal data unless you have a clear lawful basis and the Services are appropriate for that data.
16. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to the Services, our providers, applicable law, or our processing practices.
When we make material changes, we will update the effective date and provide additional notice where required.
17. Contact Us
If you have questions about this Privacy Policy or our privacy practices, contact:
Datafixr Limited
Company number: 17209258
First Floor, 18-19 South Bar Street, Banbury, Oxfordshire, England, OX16 9AF
Email: info@datafixr.io