FixPromptFixPrompt
Scan free

Legal

Privacy policy

What FixPrompt collects, why, who processes it and the rights you have. Last updated September 30, 2026.

  1. 1Who we are

    FixPrompt (“we”, “us”) operates this website and the scanning service. We act as the controller of the personal data described here (and as a processor for scan content you submit, where that concept applies). Contact: use the support option in your account.

  2. 2What we collect

    • Account data: email address, name (if provided) and a hashed password or sign-in identifier.
    • Scan data: the URLs you submit, the public pages, headers, cookies metadata and scripts retrieved from them, the findings we generate, and your resolution status for each finding.
    • Billing data: purchase history, credit balance and payment status. Card details are collected and stored by our payment provider (Polar, the merchant of record for your purchase), never by us.
    • Technical data: IP address, browser and device information, and logs used for security, abuse prevention and rate limiting, including for visitors without an account.
    • Communications: messages you send us and the transactional emails we send you.

    When a scan detects a secret (such as an API key or password exposed in a file), we keep only its type and location. The secret value is redacted and not stored.

  3. 3Why we use it, and our legal bases

    • Provide the Service (run scans, generate and store reports, manage credits and your account): performance of a contract.
    • Payments, tax and accounting records: legal obligation and performance of a contract.
    • Security, fraud and abuse prevention, rate limiting, service improvement: legitimate interests.
    • Product and account emails (verification, receipts, scan results, password resets): performance of a contract; optional marketing emails only with your consent, which you can withdraw at any time.
    • Compliance with law and legal claims: legal obligation and legitimate interests.

  4. 4Scanning third-party sites

    Scans only request public resources with an identifiable user agent and do not exploit or access private data. Content retrieved from a scanned site may incidentally contain personal data; we process it only to produce your report, keep it in truncated form, and do not use it for profiling or advertising. Site owners can ask us to remove data collected from their site.

  5. 5Automated analysis

    Findings are prioritized and explained using automated analysis, which may involve processing scan results (with secrets redacted) through an AI service provider. We do not allow these providers to use your data to train their models, and no decision with legal or similarly significant effect is made about you solely by automated means.

  6. 6Who we share data with

    We do not sell your personal data and do not share it for cross-context behavioral advertising. We share it only with service providers acting on our instructions, in these categories: cloud hosting and storage, authentication, payment processing, email delivery, and automated analysis. We may also disclose data to comply with law or legal process, to protect rights and security, or in a merger or sale of the business.

    A current list of subprocessors is available on request.

  7. 7International transfers

    Data may be processed in countries other than yours, including outside the European Economic Area, United Kingdom and Brazil. Where required, we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses.

  8. 8Retention

    We keep account and scan data while your account is active. Raw crawl artifacts are truncated and kept only as long as needed to generate and support reports. When you delete your account we delete or anonymize your personal data, except records we must keep for tax, accounting, fraud prevention or legal claims, and backups until they rotate out. Security and rate-limiting logs are kept for a limited period.

  9. 9Cookies

    We use strictly necessary cookies for sign-in sessions and security. We do not use advertising or cross-site tracking cookies. If we add analytics that require consent, we will ask first.

  10. 10Security

    We use encryption in transit, access controls, secret redaction and least-privilege practices to protect your data. No system is completely secure; if a breach affects your personal data we will notify you and the relevant authorities as required by law.

  11. 11Your rights

    Depending on where you live (including under the GDPR, UK GDPR, Brazil’s LGPD and California’s CCPA/CPRA), you may have the right to access, correct, delete or port your data, restrict or object to processing, withdraw consent, opt out of sale or sharing (we do neither), not be discriminated against for exercising your rights, and complain to your data protection authority (in Brazil, the ANPD).

    You can delete your account and edit your details in settings, or contact us to exercise any right. We may need to verify your identity and will respond within the period required by law.

  12. 12Children

    The Service is not directed to anyone under 18 and we do not knowingly collect their personal data.

  13. 13Changes and contact

    We may update this policy and will change the “last updated” date, and notify you of material changes. For privacy questions or requests: use the support option in your account.

See also: Terms · Privacy