FixSnags Privacy Policy

Last updated: 15 July 2026

This Privacy Policy explains how VISONTRA LTD, trading as FixSnags, collects, uses, stores, shares, and protects personal data in connection with the FixSnags websites, mobile applications, web application, support processes, and related services.

1. Who we are

VISONTRA LTD
Company number: 17234050
Registered office: 167-169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom
Privacy contact: [email protected]
General/support contact: [email protected]

For the main FixSnags Service, we are generally:

  • the controller for account, billing, support, website, marketing, analytics, and security data that we use for our own business purposes; and
  • the processor for customer content stored in workspaces or company accounts where we process that content on behalf of business customers.

2. Scope of this policy

This policy applies to the main FixSnags Service. Referral-programme processing may be covered by additional referral-specific terms or notices where applicable.

3. The kinds of personal data we collect

Depending on how you use FixSnags, we may collect and process the following categories of data.

3.1 Account and profile data

  • name
  • email address
  • phone number
  • company name
  • login and account identifiers
  • role or workspace association

3.2 Billing and subscription data

  • subscription plan
  • billing status
  • payment-related identifiers from Stripe
  • invoices and transaction records
  • limited billing contact details

We do not intend to store full payment card details ourselves.

3.3 Service content and workflow data

  • project and company data
  • inspections
  • reports
  • observations
  • categories and severity/status fields
  • sign-off comments
  • uploaded photos and attachments
  • file metadata
  • exports and sync status

3.4 Technical and device data

  • device information
  • app version
  • operating system
  • browser or user agent information
  • IP address or truncated IP where required for security, logging, or consent records
  • crash reports
  • log and audit information

3.5 Location data

  • approximate or precise location/GPS where the Service stores it as part of inspection workflows or where you choose to provide it

3.6 Support and communications

  • support requests
  • account or billing emails
  • diagnostic information you send to us
  • records of communications with us
  • website analytics
  • in-app analytics where consent or settings allow
  • cookie or consent preferences
  • campaign/attribution information where implemented lawfully

3.8 Early access and marketing signups

If you submit the early access form on our website, we collect:

  • your name
  • your email address
  • the fact that you ticked the consent box, and when

This information is recorded in a Google Sheet via Google Apps Script and is used only to contact you about FixSnags availability and product updates. You can ask us to remove you at any time by emailing [email protected].

3.9 Special category or sensitive information

We do not intentionally ask users to upload special category data. However, because users may upload photos or notes from real sites, content may incidentally contain sensitive information. Users are responsible for minimising unnecessary personal data in uploaded content.

3.10 AI

As at the last updated date above, FixSnags does not use AI features or third-party AI providers in the main product, and customer content is not used to train third-party AI models.

4. How we collect personal data

We collect personal data:

  • directly from you when you sign up, contact us, create content, or use the Service;
  • from your employer or workspace administrator where you use FixSnags under a business account;
  • from devices and browsers when you access the website or app;
  • from our service providers, such as payment processors or identity providers;
  • from logs, crash reporting, consent tools, and analytics tools where enabled;
  • from referral flows where applicable.

5. Purposes and lawful bases

Under UK GDPR, we rely on one or more lawful bases depending on the purpose.

5.1 Contract

We use personal data where necessary to:

  • create and manage your account;
  • provide the Service;
  • store and sync reports, projects, and files;
  • generate exports;
  • provide support;
  • process subscriptions and manage billing;
  • enforce our Terms.

5.2 Legitimate interests

We may use personal data where necessary for our legitimate interests, provided those interests are not overridden by your rights and interests. These purposes include:

  • fraud prevention and abuse detection;
  • service security;
  • logging and troubleshooting;
  • service improvement;
  • aggregate reporting and analytics;
  • defending legal claims;
  • business administration.

We may process personal data where necessary to comply with legal or regulatory obligations, including:

  • tax, accounting, and financial record-keeping;
  • responding to lawful requests;
  • maintaining records required by law;
  • handling rights requests and complaints.

We rely on consent where required, including:

  • contacting you about early access and product updates where you submitted the early access form and ticked the consent box;
  • certain non-essential analytics or cookie-based tracking technologies, if we introduce them;
  • other processing where consent is the most appropriate lawful basis.

You can withdraw consent at any time, although this will not affect processing already carried out before withdrawal.

6. Cookies, analytics, and tracking

We use cookies and similar technologies on the website and, where applicable, consent-based analytics in the app.

6.1 Current approach

  • this website sets no non-essential cookies and runs no analytics, advertising, or retargeting technologies;
  • essential/necessary technologies operate to run and secure the Service;
  • in-app PostHog analytics are opt-in only;
  • we do not enable non-essential analytics or marketing technologies before valid consent where consent is required.

6.2 Analytics providers

Depending on implementation, we may use:

  • PostHog Cloud EU for service analytics;
  • Firebase Crashlytics for mobile crash reporting;
  • other tools only if added and disclosed later.

For more detail, please read our Cookie Notice. If we later introduce non-essential cookies or similar technologies, we will add a Cookie Settings control and update that notice before those technologies are used.

7. Who we share personal data with

We may share personal data with trusted third parties where necessary to operate the Service, including:

  • DigitalOcean for hosting, compute, storage, backups, and database infrastructure;
  • Stripe for payment processing, subscription management, and billing operations;
  • Brevo for transactional email delivery;
  • PostHog Cloud EU for service analytics, where enabled and permitted;
  • Google Firebase Crashlytics for mobile crash reporting;
  • Google (Apps Script and Sheets) for receiving and storing early access form submissions;
  • Google or Apple where you choose to sign in with those providers;
  • professional advisers such as lawyers, accountants, auditors, or insurers;
  • law enforcement, regulators, courts, or public authorities where required by law or necessary to protect rights, safety, or security.

We do not sell personal data.

8. International transfers

Primary production data is intended to be hosted in the EEA through DigitalOcean EU-region infrastructure. Some providers or corporate group structures may nevertheless involve transfers or remote access outside the UK or EEA, including to the United States.

Where personal data is transferred internationally, we aim to use appropriate safeguards required by applicable law, such as:

  • adequacy regulations;
  • standard contractual clauses;
  • the UK addendum; or
  • other approved transfer mechanisms.

9. Data retention

We keep personal data only for as long as necessary for the purposes set out in this policy, unless we are required or permitted to retain it longer.

9.1 Main retention approach

  • Account/profile data: until account deletion, subject to legal, billing, dispute, or security retention needs
  • Reports: until deletion, with any brief post-deletion sync window required for service integrity
  • Uploaded photos: media bytes may be purged on deletion, while limited metadata/tombstones may remain briefly for sync integrity
  • Voice notes/audio: not a current feature in the main product
  • Support/chat messages: only if support records exist; retained only as needed
  • Application/service logs: approximately 90 days
  • Crash logs: according to Crashlytics settings, approximately 90 days
  • Analytics data: according to PostHog settings, currently targeted at 12 months
  • Backups: approximately 7 days
  • Pending invites: approximately 7 days
  • Early access signups: until you ask to be removed, or until the signup is no longer relevant to contacting you about availability
  • Inactive free accounts: no automatic expiry today, unless we later update our policy

We may keep some records longer where reasonably necessary for:

  • tax and accounting;
  • billing and charge disputes;
  • fraud prevention;
  • security investigations;
  • legal claims and regulatory compliance.

10. Deletion and user controls

  • users can delete their own account;
  • company administrators can delete team members;
  • users can delete individual reports and photos;
  • deleted content may remain in backups until the backup cycle expires;
  • there is currently no restore window once deletion has taken effect.

11. Data export

Users can export individual reports in supported formats such as PDF, DOCX, or CSV where available in the product.

We may provide a machine-readable export of certain personal data on request or through self-service features where required by law. At present, we do not commit to providing a full company-wide workspace export unless required by law or separately agreed in writing.

12. Security

We use reasonable and appropriate technical and organisational measures designed to protect personal data, including measures relating to:

  • encryption in transit;
  • encryption at rest where supported by our providers and infrastructure;
  • access controls;
  • logging and monitoring;
  • backups; and
  • incident response procedures.

We also use periodic security reviews and provider-level controls. No online service can guarantee absolute security.

13. Children and age restrictions

The main FixSnags Service is not directed at children. The referral programme and commission-earning features are intended for adults aged 18 or over only.

14. Your rights

Depending on the circumstances and applicable law, you may have rights to:

  • access your personal data;
  • correct inaccurate data;
  • request deletion;
  • restrict processing;
  • object to certain processing;
  • receive certain data in a portable format;
  • withdraw consent where processing is based on consent;
  • complain to the UK Information Commissioner’s Office (ICO).

Some rights may be limited where we need to keep data for legal, security, billing, fraud prevention, or dispute reasons.

To exercise your rights, contact [email protected].

15. Third-party sign-in

If you choose to sign in using Google or Apple, those providers may process personal data according to their own privacy notices. We receive only the information necessary to authenticate your access and create or maintain your FixSnags account.

16. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will take reasonable steps to notify users before the changes take effect.

17. Contact

Privacy questions and rights requests: [email protected]
General support: [email protected]
Billing: [email protected]