Privacy Policy

This Privacy Policy explains what personal data T21 Film Studio LLC ("FIXER", "we", "us") collects when you use FIXER, why, who receives it, how long we keep it and what rights you have. It applies to all FIXER services: the web app at app.fixer-app.com (including FIXER Go and FIXER Workspace where we have opened them), the website fixer-app.com, the FIXER iOS and Android apps, FIXER Premiere (premiere.fixer-app.com and fixer-premiere.com), our APIs, e-mails and support (the "Services").

Controller: T21 Film Studio LLC, 100 Infinity Way, Mountain View, CA 94043, USA. Contact for privacy questions and requests: hq@fixer-app.com (subject "Privacy").

1. Summary

• We collect what you give us (account, profile, work, messages, deals, verification documents), what your device sends us (IP address, device and app data) and what partners send us (Stripe, Google sign-in, Apple and Google stores).
• We use it to run FIXER: your profile, search and matching, messaging, deals and payments, verification, safety and moderation, and support.
• We do not sell your personal data and we do not use it for targeted advertising. There are no advertising or analytics trackers in the FIXER web app (app.fixer-app.com) or on FIXER Premiere. Our marketing website fixer-app.com runs on our own servers and sets no cookies and no analytics. Only the old Premiere website fixer-premiere.com, which we are retiring, is still hosted by Wix, which sets its own cookies there (see the Cookie Policy).
• Some features use AI services from Google (and OpenAI, when we switch a feature to it), and video moderation uses Amazon Web Services. They process data for us to provide those features; Amazon Web Services may also use videos checked for moderation to improve its AI services (see section 4.2).
• You can see and edit your data in your profile, delete your account in Settings, and write to us for a copy of your data or any other request.

2. Data we collect

2.1 Data you give us

2.2 Data collected automatically

• Technical data: IP address, browser and device type, operating system, app version, language, time of requests, and server logs used for security and troubleshooting. If you sign up without confirming an e-mail code, our server log records your e-mail's domain and browser type for fraud prevention (kept 14 days).
• Location: with your permission, the app or browser sends your device location when it opens so that we can find the nearest city. We store only the city, not your coordinates. You can refuse and choose a city yourself. In FIXER Go we store the addresses and map points you enter for run stops, saved places and trips; if you tap "use my location" there, your device's location fills that field. We do not track your location in the background. Live location during a run (opt-in): a FIXER Go runner can switch on "Share my location" for a booked run; only then, and only while the run is active, the device sends an approximate position (rounded to about 100 m, at most every 20 seconds). We keep only the latest point, show it to the production of that run to estimate the arrival, and delete it when the runner switches sharing off or when the run ends in any way (delivered, cancelled by either side, ended with "Nobody at pickup", or closed by FIXER staff). Check-in and "Nobody at pickup" positions: when a runner taps "I'm here" at the pickup or the drop-off, or ends a run with "Nobody at pickup", the app sends the device's position at that moment (only if the runner allows location) together with the accuracy the device reports; we record it in the run's step log, with the distance to the pickup point and whether it was close and accurate enough to count as confirmed. Purpose: to decide whether pickup waiting and the en-route fee may be charged automatically or need a staff review, and to let FIXER staff settle a problem reported about the run (contract; our legitimate interest in fair fees and preventing fraud). The production of the run sees the step and its time, but not the coordinates; FIXER staff who review the run see them. They are kept with the run's records (section 5). At pickup and drop-off we may also record an approximate position with the handoff step, kept the same way. Purpose: the run the runner agreed to (contract).
• Usage: views and reactions on drops and reels, profile views counts, notifications you received and whether messages were read.
• Data we derive from your content: embeddings (numeric summaries of meaning) of profiles, deals, drops, works, BrainMatch phrases and saved Assistant searches, and AI-generated descriptions and tags of what drops and works look like, used for search, matching and the Assistant; and a perceptual fingerprint of each drop and show reel video (hashes of 8 frames; no face recognition), used to find the same clip at another member and suggest that you confirm you worked together.
• Device identifiers in the mobile apps. *Version 3.0 and later of the FIXER iPhone and Android app* (the web app in an app shell) has no analytics and no advertising ID; its push token is described below, and error reports (Sentry, section 4.2) apply to it as to the web app it shows. *Older versions (before 3.0)* collect a push-notification ID (OneSignal), Firebase app instance ID, the device's advertising identifier (IDFA on iPhone, advertising ID on Android), which Google Analytics for Firebase collects where the phone makes it available (on Android by default; on iPhone with iOS 14.5 or later only if you allow tracking when the app asks) — we do not use it to show you ads — and crash reports (Sentry) that include device model, OS version and the error. You can reset or delete the advertising ID, and on iPhone turn off tracking, in your phone's settings.
• Web push on a device: if you switch on notifications in the web app (Settings → Notifications), your browser gives us a push subscription for that device: an address at your browser's push service (for example Google, Mozilla, Apple or Microsoft) and two encryption keys, and we add a label such as "Chrome on Android" made from your browser type. We use it only to send you FIXER notifications; their text is encrypted, so the push service cannot read it. If you remove a device from your list, we keep a one-way hash of its address so that it is not added back automatically.
• Push on a phone (the FIXER app): if you switch on notifications in the FIXER iPhone or Android app (Settings → Notifications), the phone's operating system gives us a device token for the app (from Apple's push notification service on iPhone, from Google's Firebase Cloud Messaging on Android). We store the platform (iPhone or Android), the token (encrypted at rest; we also keep a one-way hash of it to recognise the device), the app version and when the app last reported it, and we label the device "iPhone app" or "Android app". We use it only to send you FIXER notifications; a notification contains only its short text and the screen it opens, never your e-mail or other account data. If you remove a device from your list, we keep a one-way hash of its token so that it is not added back automatically.
• Calendar feed: if you turn on your calendar link, the calendar app that fetches it sends us its requests (with its IP address, used only for rate limits in memory, not stored) and we record when the link was last fetched.
• Browser storage: see the Cookie Policy.

2.3 Data from others

• Stripe: payment status, the last digits and brand of your card, payout account status and verification results. Stripe never gives us your full card number.
• Google (if you sign in with Google): your Google account ID, name, e-mail and profile picture link.
• Apple (if you sign in with Apple in the iPhone app): your Apple user ID, your name and either your e-mail or the private relay address Apple gives us, as you choose.
• Apple and Google stores: purchase receipts and subscription status for in-app purchases.
• Public sources you point us to: when you ask us to import your work, we read the public pages you give us (for example your website, YouTube, Vimeo, Behance, IMDb) and public information about those works. When you use AI fill we may look up a public Gravatar image linked to your e-mail (we send only a one-way hash of the e-mail).
• Document checks for FIXER Go: to check a runner's or a production's documents we may confirm them with the insurer or agent that issued them or with a public register (for example the California Secretary of State), and we record how and when we checked.
• Other users: people can mention you in a deal, recommend you, add you to a network tie or a company team, report you, or send you messages.

Providing your data is voluntary, but without the data marked as required in a form (for example your e-mail to create an account, or verification documents for deals) we cannot provide that feature. We do not intentionally collect sensitive data such as health, religion or sexual orientation. Please do not put it in your profile. ID documents and selfies that you upload to FIXER are reviewed by a person; FIXER itself does not use automated face recognition and does not create biometric templates. When the identity check runs through Stripe Identity instead, the document photo and the live selfie go directly to Stripe, not to FIXER: Stripe checks the document and compares your face in the selfie with the photo on the document automatically. That comparison is biometric processing; Stripe asks for your explicit consent in its own verification screen before it starts, and you can decline and ask us for another way to verify at hq@fixer-app.com. Section 2.4 is our notice and retention policy for it.

2.4 Biometric data: the identity check with Stripe Identity

This section is our written notice, consent and retention policy for biometric data, as required by laws such as the Illinois Biometric Information Privacy Act (BIPA). It applies when you choose "Verify with Stripe" to verify your identity. It does not apply to ID photos and selfies you upload to FIXER for a person to review: no software compares faces in those.

• What is collected. A photo of your ID document and a live selfie. To compare them, Stripe makes a scan of face geometry from the selfie and from the photo on the document (a biometric identifier), and reads the data printed on the document. This happens at Stripe, our service provider. FIXER does not receive, create or store the images, the face scans or any face template. FIXER receives and stores only the result: verified or not, document type and country, whether the name on the document matches your profile and whether you are 18 or older, plus a keyed code derived from your name, date of birth and document country (not from your face) that lets us notice one person verifying two accounts.
• Purpose. Only to confirm that you are the person on a valid ID document and that you are 18 or older, so that FIXER can mark your account as verified (deals and FIXER Go require it) and to prevent fraud and impersonation. FIXER uses the data for nothing else. FIXER does not sell, lease, trade or otherwise profit from your biometric data. How Stripe handles it is described in Stripe's own notice at stripe.com/privacy and in its verification screen.
• Your consent. Before anything is captured, Stripe's verification screen asks for your explicit written consent (you give it electronically by agreeing on that screen) to the collection and use of your biometric data for this check. If you do not agree, nothing is collected: close the screen and ask us for another way to verify at hq@fixer-app.com. You can withdraw your consent at any time by writing to the same address; we then ask Stripe to delete your data (see below), and your verification may be removed.
• Retention and destruction schedule. Stripe keeps the images, the face scans and the data read from the document in FIXER's Stripe account only until we ask Stripe to delete (redact) them, and then deletes them. We ask Stripe to delete them (1) 30 days after the final decision on your check: accepted, rejected or canceled, or, when a person reviews the check, 30 days after that person's decision, never while the review is still open; (2) when your account is erased on its deletion date (see "When you delete your account" in 5), within hours of the erasure; and (3) in any event when the purpose is satisfied or within three years of your last interaction with FIXER, whichever comes first. Once we have asked, Stripe deletes the data itself, which can take a few days. Our own result flags and the keyed code stay while your account exists (see 5).
• Who receives it. Only Stripe, as our service provider. We do not disclose your biometric data to anyone else unless you consent, a law requires it, or a valid warrant or subpoena from a court requires it.
• Security. The images go from your device directly to Stripe, over an encrypted connection, and never pass through FIXER's servers. We keep the result data with the same care as the rest of your account data, and with at least the care we use for other confidential and sensitive information.

3. How and why we use data

Automated decisions. Some decisions are made by software: automated moderation may hide or remove content (for example a photo, a video, a comment or your "About me" text) automatically, and a FIXER moderator then reviews it (Terms, section 8); spam and rate-limit checks may block an action; and the feed shows content that meets objective quality rules (for example a filled profile with a profession, or a verified business). Your content stays on your profile even if it is not in the feed. AI matches, search rankings and Assistant suggestions are only suggestions: FIXER does not use them to decide who is hired or paid, and companies make their own decisions. None of these decisions has legal effects on you; you can always ask a person to review one at hq@fixer-app.com. ID documents and selfies uploaded to FIXER are checked by a person. When the identity check runs through Stripe Identity, the document and the selfie (including the face comparison) are checked automatically by Stripe; FIXER accepts the result automatically only when Stripe verified the document and the selfie, the name on the document matches your profile and you are 18 or older, and every uncertain case (for example a name that differs from your profile, a missing date of birth, or an identity that seems to be verified on another account already) is decided by a person. You can ask a person to review a failed check at hq@fixer-app.com. In FIXER Go, software applies the rules described in the Terms (section 12A) — for example a runner cannot take a run above the limit of their checked insurance, and an expired document removes that ability the same day — while a person approves runners and checks documents. The phone, card and business e-mail steps are checked automatically (an SMS code, the card check through Stripe (nothing is charged), and a code sent to an address on the company's own domain; free and disposable e-mail providers are not accepted); you can ask a person to review a failed step at hq@fixer-app.com.

Marketing. We send only service messages (for example sign-in codes, deal and contract updates, team invitations). We do not send marketing e-mails without your consent. If we start, every marketing e-mail will have an unsubscribe link.

4. Who receives your data

4.1 Other users and the public

• Your public profile (name, nickname, photo, professions, city, about text, day rate, availability and busy dates, experience, recommendations, social links, show reel, drops, works, journal, your "Verified" or "Verified business" badge and company page) is visible to FIXER users. Your public business card (app.fixer-app.com/u/your-nickname) and link previews of it can be seen by anyone, including search engines; it shows your name, nickname, photo, banner, professions, city, about text, day rate, verification badges, show reel (or smart reel), drops, works, journal, the social links you added and your company team memberships. Your account e-mail, phone number, exact location, verification documents and payment details are never shown to other users; a contact you add yourself as a link on your profile (for example an e-mail address) is public.
• Messages are seen by the people you send them to. In a company team, messages sent for the company show who sent them, and company admins see team members' names, roles and work e-mails.
• FIXER Go: before a run is booked, runners see the area, the place name and an approximate point of its stops, and a runner is shown to the production as first name and initial; after booking, the booked runner sees the exact addresses, access notes and contacts of that run, and the production sees the runner's name, vehicle and the "documents checked" facts of their runner card. Your declared trips are never shown to anyone. Before booking, a production sees how many runners are covered for a value only as a range, never who; the exception is a runner the production invites (from the moment of the invitation, whether or not the runner answers) or who sends it a counter-offer: the production then also sees that runner's insurance line (liability limit per occurrence, any cargo limit, and the month and year it is valid until), but not the insurer or the certificate. Once a production has booked a runner, that production's managers can open the runner's current general-liability insurance certificate for that run through a short-lived link, which shows the insurer, the coverage limit and the expiry date; each view is logged. Other documents and document numbers are not shown to productions.
• Workspace files and albums are visible only to you. Your calendar link shows your calendar to anyone who has the link; keep it private, and replace or turn it off in Settings if it leaks.
• Deals you post are visible to FIXER talent members looking for work, and job alerts and the Assistant can suggest them. Applications, contracts, payments and disputes are seen by the company (including team members who act for it) and the talent involved, not by other users.

4.2 Service providers (processors)

They process data only on our instructions to provide their service to us, except where the table below says otherwise:

The AI providers receive the data described above through their business APIs.

Maps. FIXER Go address search and driving distances use OpenStreetMap-based software (Photon and OSRM) that runs on our own servers, so no map provider receives the addresses you search. The "Navigate" button opens Google Maps with the stop's address or point, under Google's terms. Map data © OpenStreetMap contributors.

Calendar apps. If you add your calendar link to Google Calendar, Outlook or another calendar app, that app receives the link and fetches your calendar under its own terms.

YouTube API Services. FIXER uses YouTube API Services. With the YouTube Data API we read publicly available information about the YouTube videos, channels and playlists whose links you give us for import or AI fill: titles, descriptions, thumbnails, durations, publication dates, channel names and channel country. We use it to prepare your work cards and your profile draft, may send it to our AI providers for those features (see the table above), and keep it with your imported items and works for the periods in section 5. We also use the YouTube embedded player to play YouTube videos on FIXER (see the Cookie Policy). We do not connect to your YouTube account or read private YouTube data. How Google handles data is described in the Google Privacy Policy; YouTube's terms are at youtube.com/t/terms.

4.3 Others

• Professional advisers (lawyers, accountants) under confidentiality.
• Authorities, when the law requires it, or to protect the rights, property or safety of users, the public or FIXER.
• A buyer or successor if FIXER is involved in a merger, acquisition or sale of assets; they must respect this Policy.

5. How long we keep data

When you delete your account. Your profile is removed at once from member search and the member directory, and your public business card (and its link previews) stops working. Right after your request we e-mail you a confirmation with the deletion date and a "Cancel deletion" link. The deletion date is the third day after the day of your request, at 00:00 UTC (so you always have at least 2 full days). Until then, other signed-in members can still open your profile directly (for example from a chat or a link), your drops can still appear in the feed, and you can cancel: with that link (no sign-in needed), in Settings in the FIXER iPhone or Android app, or by writing to hq@fixer-app.com (we can cancel only before the deletion date). On the deletion date your account is closed for good and can no longer be restored. If at that time you still have an unfinished contract, an unpaid deal payment, a payment started in the last 48 hours that has not gone through, or an open complaint against you, or the law requires us to preserve the data, we wait with the erasure until these are settled or the preservation ends. Then we erase or anonymise your personal data and delete your uploaded files (photos, show reel, drops, journal, works, identity documents, imported items). We keep records of contracts, deals, payments, payouts, credits and in-app purchases for tax and accounting (up to 7 years), linked to an anonymised account ("Deleted user"); deals you published and files attached to contracts stay part of those records. If your account took part in a contract or a payment, we also keep a restricted record for 7 years so that we can meet tax and accounting duties and handle disputes and legal claims: your name as on your account, e-mail, company name, account role, identity-verification status and date and the result of each verification step (no document images or files) and the ids of those contracts and payments. Only FIXER administrators can see it, and it is deleted automatically after 7 years. These steps apply to deletions you request; if FIXER closed your account for breaking our rules, fraud or abuse, we keep its data as evidence as described in the table above. Messages you sent remain in the other person's conversation as from "Deleted user". In FIXER Go we delete your declared trips, your "my runners" pairs, the text of your run messages and counter-offers, your run filters, the receiver names on your runs' proofs and, for a company, the contacts and access notes of its runs' stops; the runs, offers and the step log stay as the other party's record. Your Workspace and calendar link are deleted. Complaint and moderation records are kept in anonymised form, and private copies of content removed after a report are kept for up to 1 year for legal claims and law enforcement. Where the law requires us to preserve data (for example the contents of a report we make to NCMEC about child sexual abuse material, or records that law enforcement asks us to preserve), we may keep that data for as long as the law requires, even after you delete your account. Copies in encrypted backups disappear when the backups expire (30 days). Our providers keep their own copies for the periods in their own policies — for example Stripe (payment and payout records), Apple and Google (purchases), OneSignal (push IDs), Twilio (SMS logs) and the AI providers (request logs).

6. Security

We protect data with measures such as encrypted connections (HTTPS), hashed passwords, encrypted backups, access limited to staff who need it, private storage for identity documents, rate limits against abuse and reviews of our code for security issues. No system is completely secure; if a data breach affects you, we will notify you and the authorities as the law requires.

7. International transfers and where you live

FIXER is operated by T21 Film Studio LLC in the United States, and we do not have an establishment in the EU, the EEA, the UK or Switzerland. We have not appointed a representative there. People outside the United States, including in the EU, the EEA, the UK and Switzerland, may register, keep a profile and use FIXER, so we describe here how we treat your data. FIXER Go works only in the San Francisco Bay Area and Los Angeles, and payouts currently need a U.S. Stripe account (Terms, sections 10 and 12A), so for most members outside the United States the data we hold is the account, profile, messages, deals and verification data in section 2.

We do not say that the GDPR or the UK GDPR applies to us in every case, but we choose to follow their main rules for everyone who uses FIXER from the EU, the EEA, the UK or Switzerland: the legal bases in section 3, the rights in section 8 and the retention periods in section 5. If you are there, you give your data directly to us, and we and our providers (section 4.2) process it in the United States and other countries that may not offer the same level of protection as your own. When our providers process your data, we rely on the European Commission's Standard Contractual Clauses in their data processing terms (with the UK addendum and the Swiss amendments where they apply) or on the provider's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. We rely on a transfer being necessary for your contract with us only for occasional transfers, for example when the other party to your deal is in another country. You can ask for a copy of these safeguards at hq@fixer-app.com (subject "Privacy").

8. Your rights

You can:

• access and edit most of your data in your profile and settings;
• delete your account: in the app, or on the web at app.fixer-app.com → Settings → Delete profile (this works for accounts created in the mobile apps too), or by writing to hq@fixer-app.com from your account e-mail;
• ask us for a copy of your data (including in a portable format), or to correct, delete or restrict it;
• object to processing based on legitimate interest, and withdraw consent at any time (this does not affect earlier processing);
• ask a person to review an automated decision;
• complain to a data protection authority, for example the authority where you live or work (in the EU, the EEA, the UK or Switzerland) or the California Privacy Protection Agency. Because we have no representative in the EU or the UK, please write to hq@fixer-app.com first; you keep every right to go to your authority.

Your right to object. Where we use your data on the basis of legitimate interest (section 3), you can object at any time, on grounds relating to your situation, by writing to hq@fixer-app.com (subject "Privacy"). We will then stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need the data for legal claims. You can object to any use of your data for direct marketing at any time, and we will then stop that use.

California residents (CCPA/CPRA): you have the right to know what personal information we collect, use and disclose; to delete it; to correct it; to opt out of its "sale" or "sharing" — we do not sell or share personal information as those terms are defined, and we have not done so in the past 12 months; to limit the use of sensitive personal information — we use it (ID documents, account log-in details, the contents of messages between users, Social Security or tax numbers you give Stripe for payouts, FIXER Go runners' driving license numbers, the exact addresses of FIXER Go run stops, and your device's precise location if you allow it, which we use to find your nearest city and do not store, except that for FIXER Go runners the positions recorded at check-in and "Nobody at pickup" are kept with the run's records, see section 2.2) only to provide the Services and for security, as the law permits, and not to infer characteristics about you; and not to be discriminated against for using your rights. The categories of personal information we collect are those listed in section 2 (identifiers, customer records, characteristics of protected classifications (date of birth for payout accounts; age, sex and nationality shown on ID documents), commercial information, internet activity, geolocation (your device's location if you allow it, stored only as a city), audio/visual information, professional information, and sensitive personal information as described), for the purposes in section 3, disclosed to the recipients in section 4, and kept for the periods in section 5. You may use an authorized agent: the agent writes to hq@fixer-app.com (subject "Privacy") with your signed permission or a power of attorney, and, unless the agent has a power of attorney, we may ask you to confirm your identity and the request directly with us.

California "Shine the Light": we do not disclose personal information to third parties for their own direct marketing purposes.

Ukraine: if you are in Ukraine (FIXER Go is not available there), you have the rights of a data subject under the Law of Ukraine "On Personal Data Protection", including access, correction, deletion and objection, and you can complain to the Ukrainian Parliament Commissioner for Human Rights.

Other U.S. states (such as Colorado, Connecticut, Virginia, Texas, Oregon): you have similar rights to access, correct, delete and obtain a copy of your data and to appeal our decision.

How to make a request: write to hq@fixer-app.com (subject "Privacy"). If you have an account, write from its e-mail; if you do not (for example you only bought a Premiere ticket or sent us a form), tell us the e-mail and details we can use to find your data. We may ask for information to confirm it is you. We confirm receipt within 10 business days and reply within 28 days (so always inside the one calendar month of the GDPR and the 45 days of California and other U.S. state laws). Where the law allows (for example for complex or numerous requests), we may extend this period and will tell you why before the first period ends. If we refuse a request, we will explain why, and you can appeal by replying to our answer; we will decide the appeal within 30 days (extendable where the law allows) and, if we deny it, tell you how to contact your state Attorney General.

9. Children

FIXER is only for people 18 and older. We do not knowingly collect data from anyone under 18. If we learn that someone under 18 has an account, we will delete it. If you believe a minor uses FIXER, please tell us at hq@fixer-app.com.

10. Do Not Track and Global Privacy Control

We do not track you across other websites and do not sell or share personal data, so Do Not Track and Global Privacy Control signals do not change how we treat your data.

11. Changes

We will post any update to this Policy here and change the date at the top. If a change is material, we will tell you in the Services or by e-mail before it takes effect.

12. Contact

T21 Film Studio LLC
100 Infinity Way, Mountain View, CA 94043, USA
E-mail: hq@fixer-app.com (subject "Privacy")