FixX Privacy Policy

Introduction

FixX is a mobile application developed and operated by Lumenor AI Tech Pvt. Ltd. ("Lumenor", "we", "our", "us"), a company incorporated in India with its registered office at Plot No. 14, Sy No. S-229 to 2, Golf Pride Homes, Yapral, Jai Jawahar Nagar, Secunderabad, Medchal Malkajgiri District, Telangana – 500087.

FixX is a field operations platform for solar installers and technicians. It enables installers to receive job assignments from EPC (Engineering, Procurement & Construction) companies, track and update work progress, document site activities, manage job-related payments, and sync accepted jobs to their device calendar.

This Privacy Policy explains precisely what personal data we collect, why we collect it, how it is stored and protected, with whom it is shared, how long we retain it, and what rights you hold over your data.

Who This Policy Applies To

This policy applies to:

• Solar installers and field technicians who register and use FixX to receive and execute job assignments
• EPC company representatives who assign or monitor jobs through the FixX platform
• Any individual who downloads or accesses the FixX mobile application

Personal Data We Collect

We collect only the data necessary to deliver FixX's core services.

3.1 Account and Identity Data

• Full name
• Mobile number – used as primary account identifier
• Email address – optional, used for communications and account recovery
• Profile photograph
• Password – stored using cryptographic hashing, never stored in plain text
• Google account details – only if you choose Google Sign-In via OAuth 2.0

3.2 Professional Profile Data

• Trade skills such as solar panel installation, electrical wiring, and mounting
• Experience level
• Certifications and licences held
• Company or contractor affiliation
• Professional role or designation

3.3 Identity Verification Data (Sensitive Personal Data)

Collected to verify your identity before you can accept paid job assignments:

• Aadhaar card number – we store only the masked version (last 4 digits) and your verification status. Your full Aadhaar number is transmitted to our UIDAI-licensed KYC partner solely for verification and is never stored on FixX servers in full.

Face-Match Selfie

• A selfie photograph is captured at job site check-in and processed entirely on-device using ML Kit for face-match verification
• The raw biometric image is deleted immediately after on-device verification; only the verification result (pass/fail) and timestamp are retained for audit purposes
• No biometric data is transmitted to Lumenor servers or any third party

Customer / Homeowner PII

• Customer name, site address, and phone number – collected as part of job assignment for coordination during installation
• Customer GST number – collected where applicable for invoice generation

3.4 Bank Account Data (Sensitive Personal Data)

• Bank account number
• IFSC code

This data is transmitted securely to Razorpay solely for processing payouts. We do not store your full bank account number beyond what is technically required. We do not collect card numbers, CVV codes, UPI PINs, or internet banking credentials.

3.5 Location Data

• Real-time GPS coordinates during active job assignments
• Location metadata at the time of site photograph capture
• Background location – FixX continues to collect your location while a job is active, including when the app is minimised or running in the background

Background location tracking begins only after you explicitly accept a job assignment. Tracking stops automatically when the job is marked completed, cancelled, or rejected.

3.6 Job and Workflow Data

• Job assignments received from EPC companies including scope, location, and timeline
• Job acceptance and rejection actions
• Work progress updates and status logs
• Site photographs and installation images uploaded as proof of work
• Documents, PDFs, or reports attached to a job record
• Annotated images and field notes
• Payment amounts and payment status linked to completed jobs

3.7 Device and Technical Data

• Device model and manufacturer
• Operating system version and app version
• Unique device identifier
• Push notification token
• Crash logs and error reports via Firebase Crashlytics
• App usage patterns and session data via Firebase Analytics
• IP address

3.8 Calendar Data

When you accept a job intent, FixX requests permission to create a calendar entry on your device. We write job details – title, date, time, and location – to your device calendar. We do not read, modify, or delete any existing calendar entries. Calendar data is not transmitted to or stored on our servers.

3.9 Communication Data

• Messages exchanged with EPC project managers via FixX's in-app messaging feature
• Support queries, complaints, or feedback submitted via email or in-app support

Legal Basis for Processing

Sensitive Personal Data – Additional Notice

Aadhaar verification data and bank account data are Sensitive Personal Data under the DPDP Act 2023. For these categories:

• We obtain explicit, informed, and specific consent before collection, separate from general registration consent
• Access is restricted exclusively to Lumenor's Operations team on a strict need-to-know basis
• This data is encrypted in transit using TLS 1.2 or higher and encrypted at rest
• We use this data solely for identity verification and payment disbursement respectively
• You may withdraw consent at any time by contacting privacy@lumenor.in, though doing so will prevent you from receiving paid job assignments

Data Sharing & Sub-Processors

We do not sell, rent, or trade your personal data. We share it only as described below.

Third-Party Sub-Processors

What We Do NOT Do

• No data selling – We never sell, rent, or trade personal data to third parties for commercial purposes
• No advertising – FixX contains no advertisements; data is never shared with ad networks or marketing platforms
• No unrelated profiling – Data is used only for the purposes stated in this policy
• No raw biometric transmission – Face-match images are processed on-device and never transmitted to any external server
• No unauthorised bank access – Bank details are accessed only with a valid Job ID and X-Purpose header; every access is audit-logged

Data We Do Not Collect

FixX does not collect:

• Contacts from your phone address book
• Browsing history or data from other apps on your device
• Microphone recordings or audio data
• Full Aadhaar numbers – only masked last 4 digits and verification status are stored
• Card numbers, CVV codes, UPI PINs, or internet banking credentials
• Messages outside of the FixX in-app messaging feature
• Any data from individuals under 18 years of age

Data Retention

Data Security

We implement the following technical and organisational measures:

• Encryption in transit – all data transmitted between your device and our servers uses TLS 1.2 or higher
• Encryption at rest – Sensitive Personal Data including Aadhaar records and bank account details is encrypted in storage on our DigitalOcean India servers
• Role-based access controls – only Lumenor's Operations team may access Sensitive Personal Data; access is logged and audited periodically
• Engineering and all other internal teams have no access to Sensitive Personal Data
• Firebase Crashlytics for crash detection and error reporting
• Regular security reviews and vulnerability assessments on our infrastructure
• PIN storage – bcrypt hash with cost factor 12; plaintext PIN never stored or logged
• JWT tokens – signed with a 64-character random secret; expire after 7 days; invalidated on logout
• Audit logging – every access to bank details is logged with actor identity, job ID, timestamp, and last 4 digits of account number only
• Rate limiting – OTP endpoints limited to 3 requests per hour per user; brute-force protection on PIN login
• Self-hosted PostgreSQL and Redis with network isolation on dedicated VPS infrastructure

App Permissions

You will be asked for each permission individually at the relevant point in the app. Denying optional permissions will not prevent you from using FixX. Denying core permissions will limit specific job-related features.

Background Location – Prominent Disclosure

Background location collection begins only after you explicitly accept a job assignment. Before tracking starts, you will receive a clear in-app disclosure screen with an explicit confirmation step. Tracking stops automatically when the job is marked as completed, cancelled, or rejected.

You can stop background location tracking at any time by closing the active job within the app, or by revoking location permissions in your device settings:

• iOS: Settings → Privacy → Location Services
• Android: Settings → Location → App Permissions

Your Rights

12.1 All Users

• Access the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your account and all associated personal data via the in-app Delete Account feature or by contacting privacy@lumenor.in
• Withdraw consent for optional data processing including location tracking, calendar access, Aadhaar verification, and bank account data

12.2 EU and EEA Users (GDPR)

• Right to data portability – receive your data in CSV or JSON format
• Right to restrict processing without requiring full deletion
• Right to object to processing based on legitimate interests
• Right to lodge a complaint with your local Data Protection Authority

12.3 California Users (CCPA and CPRA)

• Right to know what personal information is collected, used, and disclosed
• Right to opt out of the sale or sharing of personal information for advertising – we do not engage in this
• Right to correct inaccurate personal information
• Right to non-discrimination for exercising your rights
• We will respond to verifiable consumer requests within 45 days

12.4 Indian Users (DPDP Act 2023)

• Right to access and obtain a summary of personal data we process about you
• Right to correct or update your personal data
• Right to withdraw consent at any time without affecting the lawfulness of prior processing
• Right to grievance redressal through our appointed Grievance Officer in Section 15
• Right to nominate a representative to exercise your rights in case of death or incapacity
• Right to approach the Data Protection Board of India if your grievance remains unresolved after 30 days

To exercise any right, contact us at privacy@lumenor.in. We will acknowledge within 7 days and respond fully within 30 days.

Children's Privacy

FixX is a professional tool intended exclusively for individuals aged 18 and above. We do not knowingly collect personal data from anyone under 18. If we become aware that a minor has registered, we will immediately deactivate the account and permanently delete all associated data within 48 hours. To report this, contact privacy@lumenor.in.

Do Not Track Signals

FixX is a mobile application and does not currently respond to Do Not Track browser signals, as no universally adopted standard mechanism exists for mobile applications. We will update this policy if our practices change.

India – Grievance Officer

In compliance with the Information Technology Act 2000 and the Digital Personal Data Protection Act 2023, Lumenor AI Tech Pvt. Ltd. has appointed the following Grievance Officer:

Changes to This Policy

We may update this Privacy Policy periodically. For material changes, we will notify you via:

• In-app notification within FixX
• Email to your registered address
• An updated Last Updated date at the top of this policy

Continued use of FixX after changes are posted constitutes your acceptance. If you do not agree, you may request account deletion via the in-app Delete Account feature or by contacting privacy@lumenor.in.

Contact Us