1. Who we are
Fixback is provided by Wemuda ApS, CVR 38275437, Kronprinsessegade 54, 5., 1306 København K, Denmark. We are the controller of the personal data described in this policy: about our customers and the Members of their workspaces, about Reporters' accounts, about visitors to fixback.dev and docs.fixback.dev, and about people who apply for the Founding 100 or write to us.
When a customer uses Fixback to capture feedback and errors from its own website or app, the customer is the controller of that data and we are its processor. That data includes session replays, screenshots, console and network logs, narration and the identifiers of the customer's end users. We process it only on the customer's instructions, under our Data Processing Agreement. If you are an end user of a site that uses Fixback, please contact that site's owner; we will help them answer you. How the SDKs limit what they capture is described in the documentation of the SDK's privacy controls.
2. What we collect
Account and identity
Your email address and name. If you sign in with Google or GitHub (or Apple, where it is offered), the name, email address and profile picture that provider shares with us, its identifier for your account, and the tokens it issues. For each signed-in session, the IP address and browser it was started from.
Workspaces
Your workspaces, their Members and roles, invitations you send or receive, your Projects and their settings, and the Issues, comments and actions you take in the dashboard. Secret keys and API keys issued to you are stored only as hashes.
Billing
A workspace's billing email and tax ID, its plan and invoices, and the brand, last four digits and expiry date of its card. Stripe, which handles payments, holds the billing address and the card details: Fixback never receives or stores card numbers.
Service and usage logs
Records of how the service is used and performs: requests, errors and their timing, including IP addresses, and the usage each workspace is billed for, such as Briefs written and sandbox minutes used.
Your sessions in the Fixback dashboard
We use Fixback to improve Fixback, so its SDK records sessions in the Fixback dashboard the way it does on our customers' sites. It keeps a short replay of the last moments in your browser, and sends it to us, with console and network details and your browser's environment, only when you send feedback or the dashboard hits an error. Input values are masked and the SDK scrubs personal data such as email addresses before anything leaves your browser.
Reporters
If you report on a site through Fixback, your account is linked to the Projects you report on, and the reports you send are the site owner's data, which we process for them.
Founding 100 applications and messages
If you apply for the Founding 100 on fixback.dev, the company name, email address and message you send. If you write to us, your message and the details you include.
Visits to our websites
Our web servers log each request, including the IP address and browser, to deliver and secure the sites. fixback.dev sets no cookies and loads no third-party scripts.
3. Why we use it, and our legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing Fixback: accounts, sign-in, workspaces and the features you use | Contract (Art. 6(1)(b)) |
| Sending the email the service needs: sign-in links, invitations, the alerts you subscribe to, billing notices | Contract (Art. 6(1)(b)) |
| Billing, invoicing, tax and accounting records | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) |
| Keeping the service secure and preventing fraud and abuse | Legitimate interest (Art. 6(1)(f)) |
| Finding and fixing problems and improving Fixback, including the dashboard's own session recordings | Legitimate interest (Art. 6(1)(f)) |
| Answering Founding 100 applications and messages | Steps before a contract (Art. 6(1)(b)); legitimate interest (Art. 6(1)(f)) |
| Complying with the law and establishing or defending legal claims | Legal obligation (Art. 6(1)(c)); legitimate interest (Art. 6(1)(f)) |
Where we rely on legitimate interest, our interest is running a secure, working service for our customers, and we weigh it against your rights. We do not sell personal data, we do not use it for advertising, and we do not use it or our customers' data to train AI models. We send marketing email only with your consent.
4. Who we share it with
- Our subprocessors, the service providers that help us run Fixback, such as Stripe for payments and SendGrid for email. They are listed, with what they do and where, on the Subprocessors page. We host Fixback ourselves, so no hosting provider receives your data.
- The sign-in provider you choose (Google, GitHub or Apple), which confirms your identity to us under its own privacy policy.
- Google Fonts. The Fixback dashboard and the documentation site load the IBM Plex typeface from Google Fonts, so your browser requests it from Google, which receives your IP address and browser details. fixback.dev serves its fonts itself.
- Other people in your workspace. Members see each other's names and email addresses, and a Reporter's name and email address are shown with the reports they send to that workspace.
- Authorities and advisers, where the law requires it or to establish or defend legal claims, and our professional advisers under confidentiality.
- A successor, if our business or the part of it that provides Fixback is sold or merged, under this policy's terms.
5. International transfers
We are based in Denmark, and Fixback runs on servers we operate at our offices in Copenhagen, so the data we hold is stored in the European Union. Some of our subprocessors process data outside the European Economic Area, mainly in the United States. When personal data is transferred outside the EEA, we rely on an adequacy decision of the European Commission, including the EU–US Data Privacy Framework for a certified recipient, or on the Commission's Standard Contractual Clauses, with additional measures where they are needed. You can ask us for a copy of the safeguards that apply.
6. How long we keep it
- Account data is kept while your account exists. If you ask us to delete your account, we delete it, except what we must keep by law.
- Workspace data is kept until the workspace is deleted. An Owner can restore a deleted workspace for 30 days; after that it is permanently deleted, with its stored screenshots, replays and recordings.
- Billing records are kept for as long as Danish bookkeeping law requires, currently five years from the end of the financial year they belong to.
- Sign-in sessions are kept until they expire or you sign out.
- Service logs are kept for a limited period, for security and to fix problems.
- Founding 100 applications and messages are kept as long as we need them to answer you and run the offer, and deleted on request.
7. Your rights
Under the GDPR you have the right to access the personal data we hold about you, to have it corrected, deleted or restricted, to receive it in a portable form, and to object to processing based on our legitimate interest. Where we rely on your consent, you may withdraw it at any time.
To exercise a right, write to support@fixback.dev. We answer within one month, and may need to confirm your identity first. If a request concerns data a customer captured through Fixback, we pass it to that customer and help them answer it.
You may also complain to a data protection authority. In Denmark that is Datatilsynet (the Danish Data Protection Agency), datatilsynet.dk.
8. Security
We protect personal data with technical and organisational measures appropriate to the risk. Traffic to Fixback is encrypted with TLS; the credentials we must read back are encrypted at rest, and secret keys are stored only as hashes; the SDKs mask and scrub data before it leaves the browser; and access by our own staff is limited and logged. The measures are listed in Annex 2 of the Data Processing Agreement.
10. Children
Fixback is for businesses and professionals aged 18 or over, and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has given us personal data, write to us and we will delete it.
11. Changes to this policy
We may update this policy. We will post the new version here with a new date, and tell account holders by email before a material change takes effect.
12. Contact
Questions about this policy or your personal data:
Wemuda ApSKronprinsessegade 54, 5.
1306 København K
Denmark
CVR 38275437
support@fixback.dev