Privacy policy

1. Who we are and what this policy covers

FixerDial is run by FixerAI Technologies Ltd, a company registered in Nigeria (RC 8830155), whose registered office is at Plot A 50, Dr Ambrose Edeh Street, behind V G C, Aguogboriga, Abakaliki, Ebonyi State, Nigeria ("FixerAI", "we", "us"). This policy explains what personal data we handle, why, who sees it, how long we keep it and the rights you have under the Nigeria Data Protection Act 2023.

We handle personal data in two roles:

• As the data controller for our own clients (the businesses that use FixerDial and their team members), people who contact FixerAI, and visitors to our app and website. Sections 2, 3 and 4 cover this.
• As the data processor for each business that uses FixerDial, when its assistant talks to that business's customers. The business is the data controller of its customers' data and decides why it is used. Section 5 covers this.

Contact us about privacy at info@fixeraitech.com, with "Data protection" in the subject. Our Data Protection Officer reads these messages.

2. What we collect about our clients and contacts

• Account details: names, email addresses and roles of the business owner and team members; the business name, type, address, time zone, phone numbers and the facts, prices, listings and rules it gives its assistant.
• Billing details: plans, usage, invoices and payments. Card payments are handled by Paystack; we keep only Paystack's reference to a saved card, with its type, last 4 digits and expiry date, and only if you choose to pay automatically. We never see or store full card numbers.
• Messages with FixerAI: what you send us on WhatsApp, by phone, by email or with Ask FixerAI in the app, and our replies. Our own assistant answers FixerAI's WhatsApp and phone line, so these conversations are written by AI and kept like any FixerDial conversation.
• Enquiries: if you ask about FixerDial or a custom system, the details you give us, such as your name, business, city, what you need and how to reach you.
• Technical data: sign in records, the device you allow to receive notifications, error records and, in our hosting logs, IP addresses. We use no advertising or analytics trackers.

3. Why we use it, and our lawful basis

Where we rely on legitimate interests, we have weighed them against your rights and you can object (section 9).

4. Who sees our clients' and contacts' data

Our staff who need it to serve you, and the service providers in section 6, under contracts that require them to protect it. We do not sell personal data or share it for others' advertising. We disclose data to a public authority only when the law requires it, after checking the request is lawful, and only what it requires.

5. Data we handle for businesses that use FixerDial

When a business uses FixerDial, its assistant handles its customers' messages on WhatsApp and Instagram, voice notes, phone calls and bookings. This can include customers' names, phone numbers, Instagram usernames, what they ask for, budgets, appointment times and anything they choose to write or say. If the business turns call recording on, calls are recorded; otherwise only a short written summary is kept.

• The business decides how its customers' data is used and is responsible for telling its customers. FixerAI uses this data only to run FixerDial for that business, on its instructions and under our terms of service.
• We do not use it for our own marketing, we do not sell it, and we do not use it to train AI models.
• Replies are written by AI from the business's own facts and checked against its bookings and listings before they are sent. The assistant makes no decision about a customer that has legal or similarly significant effects; the business's staff see every conversation and can take over. A customer can ask for a person at any time.
• If you are a customer of a business that uses FixerDial and want to see, correct or delete your data, contact that business. You can also write to us and we will pass your request to the business and help it answer.
• When a customer replies STOP, the assistant stops sending follow ups to them.
• Instagram: the assistant can see a customer's Instagram ID, name, @username and profile picture, their messages to the business, their comments on its posts, and story replies or mentions of the business. If someone asks a question in a comment, the assistant may send them one private message and post a short public reply; it never posts a price or personal details in public. A business can turn this off. If a customer unsends a message, its words are removed and it is not answered.
• Voice notes: kept so the business can listen to them for up to 90 days, then deleted automatically. If the business turns it on, OpenAI turns them into text so the assistant can answer.
• Pictures: when a customer replies to a business's story or comments on its post, the business's own picture may be compared with its listings by OpenAI, so the assistant knows what the customer means.
• Calls: OpenAI processes the caller's voice live so the assistant can understand and reply. A written summary is kept. Calls are recorded only if the business turns recording on, and callers are told at the start.

Google Calendar data. A business can connect its Google Calendar so the assistant offers real open times and books appointments. FixerDial asks Google for only two permissions: free/busy (which times are busy, without the titles, descriptions or attendees of the business's own events) and events created by the app (to create, move and cancel the appointments FixerDial itself made). It cannot read other events, Gmail, Drive, Contacts or Photos.

• Google user data is used only to show real open times and to book, move or cancel appointments for that business, with confirmations and reminders. It is not used for advertising, not sold, and not used for anything unrelated to bookings.
• To answer a customer, the open times and the details of the appointment being booked are sent to our AI providers (Anthropic and OpenAI, under their commercial API terms, which do not allow training on this data).
• We do not use Google user data, raw, aggregated, anonymised or derived, to create, train or improve any machine learning or AI model, ours or anyone else's.
• No person at FixerAI reads a business's calendar data, except with the business's permission to solve a support request, for security or abuse investigations, or where the law requires it.
• Google access tokens are encrypted (AES-256-GCM) before they are stored. A business can disconnect Google Calendar in FixerDial or at myaccount.google.com/permissions at any time; when a business leaves, we revoke access with Google and delete the stored token.
• FixerDial's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements, and the use of raw or derived user data received from Google Workspace APIs will adhere to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.

6. Service providers and transfers outside Nigeria

To run FixerDial, personal data passes through these providers:

Most of these providers are outside Nigeria. We transfer data to them only as the NDPA allows (sections 41 to 43): under their contractual data protection terms, which bind them to protect the data, use it only for our instructions and help us meet our duties, and where needed with other safeguards the Nigeria Data Protection Commission accepts. We keep a record of each transfer and why it is needed. We will update this list before adding a provider that sees personal data.

7. How long we keep it

• Client account data: while your business uses FixerDial. After you leave, we delete it within 30 days, or sooner if you ask, except what the law requires us to keep.
• Invoices and payment records: as long as Nigerian tax and company law requires.
• Customers' conversations, summaries and bookings handled for a business: while that business uses FixerDial, unless the business deletes them earlier. A business can ask us to delete one customer's data at any time. After the business leaves, we delete them within 30 days.
• Call recordings, only if a business turns recording on: until the business deletes them or leaves FixerDial.
• Customers' voice notes: 90 days, then deleted automatically.
• Enquiries to FixerAI that did not become clients: up to 24 months after the last contact.
• Error and security records: up to 12 months.
• If you ask us to delete data and we are allowed to, we do it within 30 days and tell you when it is done.

8. How we protect it

• All traffic to FixerDial is encrypted (HTTPS). Each business can only reach its own data; this is enforced in the database itself.
• Access keys for WhatsApp, Instagram, Google and other connections are stored encrypted, with the key kept outside the database. Only staff who need it can reach client data, and important actions are recorded.
• Payments are handled by Paystack, which is certified to the card industry's security standard (PCI DSS).
• If a breach is likely to put people's rights at risk, we tell the Nigeria Data Protection Commission within 72 hours of becoming aware of it, and we tell the businesses and people affected without delay, with what they can do to protect themselves.

9. Your rights

Under the NDPA (sections 34 to 38) you have the right to:

• be told how your data is used (this policy);
• get a copy of your data, in a common electronic format;
• have wrong or incomplete data corrected;
• have your data deleted when we no longer need it or have no lawful basis for it;
• ask us to limit how we use it, or object to our use of it, including for marketing;
• withdraw consent at any time, without affecting what was done before;
• have your data moved to another provider where the law allows;
• not be subject to a decision based only on automated processing that has legal or similarly significant effects on you;
• complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

To have everything FixerDial holds about you deleted (if you contacted a business through WhatsApp, Instagram, a phone call or its website): email info@fixeraitech.com with the subject "Delete my data", and give the name of the business and your phone number or Instagram @username. We confirm the request with the business, delete your messages, comments, voice notes, call records, bookings and enquiries within 30 days, and email you when it is done. A business that connected Instagram can also remove FixerDial in Instagram under Settings, Website permissions, Apps and websites; its access is then deleted.

To use a right, email info@fixeraitech.com. We may ask you to confirm who you are. We answer within 30 days and tell you if we need longer and why. It is free unless a request is clearly unfounded or excessive.

10. Children

FixerDial is a service for businesses and is not meant for anyone under 18. Businesses must not use it to target children. If you think a child's data has reached us, tell us and we will help the business deal with it.

11. Cookies

The FixerDial app uses only the cookies it needs to keep you signed in and secure. We use no advertising or analytics cookies. Notifications on your device are only sent if you allow them, and you can turn them off at any time.

12. Changes to this policy

We update this policy when what we do changes. We email clients about important changes before they take effect. The date at the top shows the latest version.

13. Contact and complaints

FixerAI Technologies Ltd (RC 8830155), Plot A 50, Dr Ambrose Edeh Street, behind V G C, Aguogboriga, Abakaliki, Ebonyi State, Nigeria. Email info@fixeraitech.com (Data protection), or WhatsApp +234 812 713 3097. If you are not happy with our answer, you can complain to the Nigeria Data Protection Commission at ndpc.gov.ng.