Privacy Policy

Effective May 21, 2026 · Version 1.0

1. About this Policy

This Privacy Policy describes how Innova Electronics Corporation, 17352 Von Karman Avenue, Irvine, CA 92614 (“Innova,” “we,” “us”) collects, uses, discloses, and protects personal information in connection with the AskFixy service, including the websites at askfixy.com, chat.askfixy.com, api.askfixy.com, our mobile applications, our developer APIs, and any related software (collectively, the “Service”).

AskFixy is an AI-powered automotive diagnostic assistant offered by Innova. Your use of the Service is also governed by our Terms of Use & End User License Agreement.

2. Information We Collect

2.1 Information you give us.

• Account information — name, email address, password (hashed), profile photo, and (if you choose social sign-in) a unique identifier from Google or another OAuth provider.
• Vehicle and garage information — year, make, model, trim, VIN, mileage, photos of your vehicle, OBD-II diagnostic trouble codes (DTCs), repair history, and similar details you choose to enter.
• Inputs to the AI — your prompts (questions, symptoms, text), uploaded photos, uploaded audio or video, attached documents, and any other content you submit (collectively, “User Content”).
• Feedback — thumbs-up/down ratings, comments, reason codes, and any feedback you submit about an AskFixy response, plus the request_id of the original response.
• Communications — emails or messages you send us, including the contents of support tickets and any optional survey responses.
• Payment information (only if you purchase a paid plan in the future) — handled by our payment processor; we receive only billing email, last-4 of card, and transaction status, not your full card number.

2.2 Information collected automatically.

• Device & technical data — IP address, approximate location derived from IP, browser type, OS, device model, language, time zone, referring URL, time of access.
• Usage data — pages viewed, features used, prompts per session, time spent, error events, crash reports.
• Cookies and similar technologies— see Section 8.
• Service telemetry — server-side logs of requests, responses, latencies, model versions used, charge in credits, error codes. These logs include your request_id, your account id (if logged in), and your API key id (if calling the developer API). They do not include your password.

2.3 Information from third parties.

• OAuth identity providers (Google via Firebase Authentication) — when you sign in with Google, we receive the basic profile data you authorize: your name, email, Google account ID, and profile picture URL.
• Vehicle data partners — when you ask about a specific VIN, we may query third-party decoders and recall databases.
• Innova-corporate systems— if you are a customer of Innova's broader product line (e.g., RepairSolutions 2), Innova may link your AskFixy account to your Innova customer record to provide a unified experience. This linking is described in Section 5 and you may request unlinking at any time.

2.4 Sensitive information.

We do not knowingly collect government-issued identifiers, biometric data, health information, precise GPS coordinates without your action, racial or ethnic data, religious beliefs, sexual orientation, or children's information. Do not submit such information through AskFixy.If you submit it inadvertently, contact us and we'll delete it.

3. How We Use Information

We use information for the following purposes:

• Provide the Service — generate AI responses to your prompts, render your garage, save chat history, authenticate you, prevent abuse, route to the right model provider, and bill your account if applicable.
• Safety, abuse prevention, and security — detect fraud, abuse, prompt injection, illegal uploads, jailbreak attempts, harm to minors, account takeover, and other policy violations. We may review flagged inputs.
• Evaluation & debugging — diagnose bugs, improve model selection, optimize prompts, and measure quality of responses.
• Training and tuning of our own systems — we may use anonymized, aggregated, or de-identified prompts and responses to improve AskFixy. You can opt out— see Section 9.4.
• Communications — send transactional emails (sign-in links, security alerts, password resets, billing receipts) and, only with separate opt-in, marketing communications. You can unsubscribe from marketing at any time.
• Legal compliance — comply with applicable law, respond to lawful requests, and enforce our Terms.

4. Third-Party AI Model Providers

AskFixy uses large language models hosted by third-party providers, including (currently): OpenAI (gpt-* model family), xAI (Grok), Anthropic (Claude), and others we may add or change over time. When you submit a prompt, we transmit it (together with retrieval context such as portions of our knowledge base) to one of these providers in order to generate a response. The provider processes the prompt under its own terms of service and privacy policy and returns a response to us, which we then return to you.

• We have configured our integrations to use the providers' API endpoints, which under the providers' standard terms do not use customer API content to train their public models. Providers may still process prompts for abuse monitoring and short-term debugging.
• We do not control or operate the providers' infrastructure. Their data handling is governed by their published policies (e.g., OpenAI's API data usage policy, xAI's terms, Anthropic's commercial terms).
• What you send to AskFixy may be sent to a Model Provider. Do not include trade secrets, health information, payment card numbers, or other content you would not want a third-party AI service to receive.

5. How We Share Information

We share personal information only as described below:

• With the AI Model Providers(Section 4) — to generate the responses you request.
• With infrastructure providers — Amazon Web Services (hosting and storage in the US), Google/Firebase (authentication, push notifications, app crash reporting), our email-delivery provider (AWS SES), and our analytics provider. These providers act as our processors and may only use the data to provide services to us.
• With our corporate family— Innova subsidiaries and affiliates, including for unified customer-account support, as described in Section 2.3.
• With business customers operating the developer API — if you interact with AskFixy via a third-party application that uses our developer API (api.askfixy.com), the operator of that application is treated as our business customer. Your prompts and metadata are visible to that business customer in their account dashboard (e.g., feedback, usage, ledger entries tied to their API key). Their use of your data is governed by their privacy policy, not ours.
• With professional advisors — auditors, lawyers, accountants, and consultants under confidentiality obligations.
• For corporate transactions — in connection with a sale, merger, acquisition, bankruptcy, financing, reorganization, or divestiture, subject to standard confidentiality obligations.
• For legal reasons — to comply with subpoena, court order, regulator inquiry, or other legal process; to enforce our Terms; to protect the rights, property, or safety of Innova, our users, or the public; or to detect, prevent, or address fraud, security, or technical issues.
• With your consent — for purposes you specifically authorize.

We do not sell or “share” (as those terms are defined under California privacy law) your personal information for cross-context behavioral advertising.

6. Retention

We retain personal information only as long as needed for the purposes described in this Policy, including to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. Typical retention windows:

• Account record — for the life of your account plus up to 30 days after deletion.
• Chat history / prompts & responses — for the life of your account, unless you delete a conversation.
• Server-side request logs — typically up to 90 days, then aggregated or deleted.
• Audit + security logs — up to 1 year (longer if required by law or for active investigation).
• Backups — encrypted and retained for up to 30 days from the date of backup; deletion requests propagate to backups within that window.
• De-identified, aggregate data — may be retained indefinitely.

7. Security

We use commercially reasonable administrative, technical, and physical safeguards designed to protect personal information, including TLS in transit, encryption at rest for production databases and backups, fine-grained access controls, audit logging, multi-factor authentication for administrative access, bcrypt-hashed passwords, AES-256-GCM encryption of two-factor authenticator secrets, single-use recovery-code hashes, rate limiting, and security monitoring. No system is perfectly secure. You are responsible for protecting your account credentials. Report security concerns to security@askfixy.com.

8. Cookies & Similar Technologies

We use first-party cookies for essential functions (authentication sessions, CSRF protection, language and theme preferences). We may use a limited set of third-party cookies for service analytics. We do not use cookies for cross-site behavioral advertising. Most browsers let you control cookies through settings; rejecting essential cookies may prevent you from signing in.

9. Your Privacy Rights

9.1 Universal rights (we offer these to everyone).

• Access — request a copy of personal information we hold about you.
• Correction — ask us to fix inaccurate information.
• Deletion — ask us to delete your account and personal information.
• Portability — receive your data in a structured, commonly used, machine-readable format.
• Withdraw consent — withdraw any consent you previously gave.

To exercise a right, email privacy@askfixy.com from the email address associated with your account, or use any in-product control we may provide. We may ask you to verify your identity. We will respond within the timeframe required by applicable law (and in any case within 45 days where no specific timeframe is required).

9.2 California residents (CCPA / CPRA).

In addition to the universal rights above, California residents have the right to:

• Know the categories of personal information we collect, the sources, the purposes, and the categories of recipients.
• Opt out of the “sale” or “sharing” of personal information (we do not sell or share, as defined).
• Limit our use of sensitive personal information (we do not knowingly collect sensitive personal information).
• Not be retaliated against for exercising your rights.
• Designate an authorized agent to exercise rights on your behalf.

The categories of personal information we have collected in the past 12 months include: identifiers (name, email, account ID, IP address), internet/network activity (usage logs), inferences drawn from your prompts and feedback (to personalize and improve responses), audio/visual information (only when you upload it), geolocation (city-level, inferred from IP), and commercial information (account/usage records).

To submit a verifiable consumer request, email privacy@askfixy.com with the subject line “California Privacy Request.”

9.3 EU/EEA, UK, and Switzerland.

If you are in the European Economic Area, United Kingdom, or Switzerland, the GDPR/UK GDPR/Swiss FADP apply. Innova is the controller of your data. Our lawful bases for processing are:

• Contract (Art. 6(1)(b)): to provide the Service you requested.
• Legitimate interests (Art. 6(1)(f)): to operate, secure, debug, and improve the Service, subject to your right to object.
• Consent (Art. 6(1)(a)): for marketing and any optional features that require it.
• Legal obligation (Art. 6(1)(c)): to comply with applicable law.

You have the right to access, rectify, erase, restrict, object to, and port your data; the right to withdraw consent; and the right to lodge a complaint with a supervisory authority (e.g., your local DPA, or the UK ICO). We transfer personal data to the United States for processing, which is done under Standard Contractual Clauses or other valid transfer mechanisms.

For GDPR/UK GDPR queries email privacy@askfixy.com with the subject line “EU Privacy Request.”

9.4 Opt out of training-related uses.

If you do not want your anonymized prompts and responses to be used to evaluate or improve AskFixy or to help train our internal models, email privacy@askfixy.com with the subject line “Training Opt-Out.” Operational logs needed for security, billing, and abuse investigation are retained regardless of opt-out, but they are not used to improve models. Inputs you submitted before your opt-out may already have been processed for these purposes; we cannot reverse that processing, but we will exclude your future inputs.

9.5 Other jurisdictions.

If you reside in another jurisdiction that grants you statutory privacy rights (for example, Virginia, Colorado, Connecticut, Utah, Texas, Canada, Brazil, Australia, Japan), email privacy@askfixy.com and we will honor those rights to the extent required by law.

10. Automated Processing & AI Decisions

AskFixy generates responses using automated processing. The Service does not make legally or similarly significant decisions about you automatically. The Service does not deny you insurance, employment, credit, housing, healthcare, education, government benefits, or essential goods or services. If you have questions about an AI-generated response, contact support@askfixy.com and a human will review.

11. Children

AskFixy is for users 18 years of age and older. We do not knowingly collect personal information from anyone under 18 and we do not direct the Service to children under 13 (or the equivalent minimum age in your country). If you believe a child has provided us with personal information, contact privacy@askfixy.com and we will promptly delete it.

12. International Transfers

The Service is operated from the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, where data-protection laws may differ from those in your country. We rely on appropriate safeguards (such as Standard Contractual Clauses) for cross-border transfers from the EEA, UK, and Switzerland.

13. Do Not Track

The Service does not currently respond to “Do Not Track” browser signals because there is no industry consensus on how to interpret them. We do, however, honor the California “Global Privacy Control” signal where required by law.

14. Links to Third-Party Sites

The Service may link to third-party websites (parts retailers, video tutorials, repair providers, etc.). We are not responsible for the privacy practices of those sites. Review their privacy policies before submitting personal information to them.

15. Changes to this Policy

We may update this Privacy Policy from time to time. The “Effective” date at the top will reflect the most recent update. If we make material changes, we will provide additional notice (for example, by email or an in-product banner) before the change takes effect. Your continued use of the Service after the effective date constitutes acceptance.

16. Contact Us

AskFixy is a product of Innova Electronics Corporation.

Innova Electronics Corporation
Attn: Privacy Office
17352 Von Karman Avenue
Irvine, California 92614, USA
Email: privacy@askfixy.com (privacy questions)
Email: support@askfixy.com (general support)
Email: security@askfixy.com (security disclosures)

17. Copyright & Trademarks

This Policy and all content accessible through the Service is Copyright © 2026 Innova Electronics Corporation, 17352 Von Karman Avenue, Irvine, CA 92614, USA. All rights reserved.

AskFixy, the AskFixy logo, Fixy, and related marks are trademarks and/or registered trademarks of Innova Electronics Corporation in the United States and other jurisdictions. All other names and marks referenced through the Service (including product names, model names, vehicle marks, and partner names) are the property of their respective owners and are used for identification purposes only.