Privacy Policy
One2X Technology Private Limited (“Fixit”, “we”, “us”, “our”) operates the Fixit marketing intelligence platform at www.fix-it.ai (the “Service”). This policy explains what information we collect, why we collect it, who we share it with, how long we keep it, and how you can have it deleted.
If you disagree with anything in this policy, please do not use the Service.
1. Who we are
| Legal entity | One2X Technology Private Limited |
| Registered address | House No. 272, Floor 1st, Block C, Prashant Vihar, Rohini, North West Delhi, Delhi – 110085, India |
| Privacy contact | privacy@fix-it.ai |
| Data Protection Officer | Tameesh Sood, Privacy Officer — tameesh@fix-it.ai |
| Grievance Officer (India, DPDP Act 2023) | Tameesh Sood — tameesh@fix-it.ai |
2. What Fixit does
Fixit is a business-to-business platform. Advertisers connect their own advertising accounts — including Meta (Facebook and Instagram) ad accounts — and Fixit reads campaign performance data, researches competitor advertising activity, and creates or manages advertising campaigns on the advertiser’s behalf.
Our customers are businesses. We are a processor (a Data Processor under India’s Digital Personal Data Protection Act, 2023) acting on our customers’ instructions for the advertising data they connect to us, and a controller (Data Fiduciary) for the account information of the individuals who sign up to use Fixit.
3. Information we collect
3.1 Account information you give us
- Name, work email address, and password (stored hashed, never in plain text)
- Company name, role, and billing contact details
- Support correspondence you send us
3.2 Information we receive from Meta (“Platform Data”)
When you connect a Meta ad account using Facebook Login for Business, you choose which permissions to grant. Depending on what you grant, we receive:
| Data | Meta permission | What we do with it |
|---|---|---|
| Your public profile (name, profile picture, Facebook user ID) | public_profile | Identify which Meta account is connected and display it in your Fixit dashboard |
| Your email address | email | Match the connection to your Fixit account |
| Ad account performance data — campaigns, ad sets, ads, spend, impressions, clicks, conversions | ads_read | Display performance reporting, generate recommendations, and detect wasted spend |
| Ad account management — creating, editing, pausing campaigns, ad sets and ads | ads_management | Execute the campaign changes you approve |
| Business portfolio and asset structure — ad accounts, Pages, pixels you have granted us | business_management | List the assets available to you so you can choose which to connect |
| Marketing API access tier | Marketing API Access Tier | Operate at the rate limits and account volume our customer base requires |
We do not use Platform Data to build advertising profiles of individuals, we do not sell it, and we do not use it for any purpose other than providing the Service to the customer whose account it came from.
3.3 Information we collect automatically
- Log data: IP address, browser type, pages viewed, timestamps
- Cookies and similar technologies for authentication and session management
- Product analytics on how the Service is used, so we can improve it
4. Why we process your information
| Purpose | Lawful basis (GDPR) | Basis under India’s DPDP Act 2023 |
|---|---|---|
| Providing the Service you signed up for | Performance of a contract | Consent / certain legitimate uses |
| Reading and managing your connected ad accounts | Performance of a contract | Consent |
| Billing and account administration | Performance of a contract | Consent / compliance with law |
| Security, fraud prevention, and abuse detection | Legitimate interests | Certain legitimate uses |
| Improving the Service and developing new features | Legitimate interests | Consent |
| Marketing emails about Fixit | Consent (withdrawable at any time) | Consent (withdrawable at any time) |
| Complying with law | Legal obligation | Compliance with law |
You may withdraw consent at any time by emailing privacy@fix-it.ai or using the unsubscribe link in any marketing email. Withdrawing consent does not affect processing carried out before the withdrawal, and we will stop the affected processing within a reasonable time.
5. Automated processing and AI
Fixit uses automated analysis, including large language models, to generate advertising recommendations, ad copy, and competitive research summaries. Where customer advertising data is sent to a third-party model provider for this purpose, that provider is listed in Section 6 and is contractually prohibited from using the data to train its models.
Recommendations Fixit produces are suggestions. Campaign changes are applied to your Meta ad account only when you approve them. No decision producing a legal or similarly significant effect on an individual is made by automated means alone.
6. Who we share information with
We do not sell your information. We share it only with:
Service providers (subprocessors)
| Vendor | Purpose | Location |
|---|---|---|
| Amazon Web Services | Cloud hosting and infrastructure | ap-south-1 (Mumbai, India) |
| MongoDB | Application database | India |
| Anthropic / OpenAI | AI analysis of advertising data to generate recommendations and copy | United States |
| Stripe / Razorpay | Payment processing and billing | United States / India |
| Google Workspace | Email, identity, and business communications | Global |
| GitHub | Source control and build tooling (no customer advertising data) | United States |
| Sprinto | Continuous security and compliance monitoring | India |
We keep this list current. Where a subprocessor changes, we update this page and, for material changes, notify customers by email or in-product notice.
Other recipients
- Meta, when we make API calls to manage your ad accounts on your instruction
- Legal authorities, where we are legally required to disclose
- An acquirer, in the event of a merger or acquisition — you will be notified before your information becomes subject to a different privacy policy
7. International transfers
Your information is primarily stored and processed in India (AWS ap-south-1). Some subprocessors listed in Section 6 process data in the United States.
Where we transfer personal data out of the European Economic Area or the United Kingdom, we rely on the European Commission’s Standard Contractual Clauses, or an adequacy decision, as appropriate. Transfers of personal data out of India are made only to countries not restricted by the Central Government under the DPDP Act, 2023.
8. How long we keep information
| Data | Retention |
|---|---|
| Meta Platform Data (profile, ad performance, asset lists) | Access tokens revoked immediately on disconnection. Data is then erased within 90 days of you disconnecting the ad account or closing your Fixit account, as part of our routine deletion cycle. If you ask us to delete it, we complete the deletion within 30 days, including copies held in backups. |
| Fixit account information | For the life of your account, then 90 days after closure — or 30 days if you request deletion |
| Security and audit logs | 12 months, or longer where an active investigation or legal obligation requires it |
| Billing and tax records | 8 financial years, as required by section 128(5) of the Companies Act, 2013 and Indian tax law |
| Support correspondence | 24 months from the last message in the thread |
| Aggregated, anonymised statistics | Indefinitely — this data cannot be linked back to you or your ad accounts |
We retain personal data only as long as necessary for the purpose it was collected for, or as required by law. Where an individual is entitled to advance notice of erasure under applicable law, we will give that notice before we delete.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete, port, or restrict processing of your personal data, to object to processing based on legitimate interests, to nominate another person to exercise your rights in the event of death or incapacity, and to withdraw consent.
To exercise any of these, email privacy@fix-it.ai. We acknowledge requests promptly and respond within 30 days, which meets the one-month deadline in Article 12(3) of the GDPR. Where you ask us to delete your data, the deletion itself is completed within that same 30 days — you do not have to wait for the routine 90-day cycle described in Section 8.
You can also revoke Fixit’s access to your Meta data at any time directly in Facebook: Settings & Privacy → Settings → Apps and Websites → Fixit AI → Remove.
If you are in the EEA or UK and are unhappy with how we have handled your data, you have the right to complain to your local supervisory authority.
If you are in India, you may raise a grievance with our Grievance Officer at tameesh@fix-it.ai. If it is not resolved to your satisfaction, you may complain to the Data Protection Board of India under the Digital Personal Data Protection Act, 2023.
California residents: we do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not discriminate against anyone who exercises their privacy rights.
10. Deleting your data
Full step-by-step instructions, including how to delete data Fixit obtained through Facebook Login, are at www.fix-it.ai/data-deletion-instructions.
11. Security
We protect your information with encryption in transit (TLS) and at rest, role-based access controls limiting employee access to what their role requires, multi-factor authentication on administrative accounts, audit logging of access to customer data, endpoint controls on company devices, and regular security review. Our infrastructure is hosted on AWS, and our security programme is monitored continuously and reviewed at least annually.
No system is perfectly secure. If a breach affects your personal data we will notify you and any required regulator without undue delay — including, where applicable, the relevant EEA or UK supervisory authority within 72 hours under the GDPR, and the Data Protection Board of India in accordance with the DPDP Rules, 2025.
12. Children
The Service is for business use and is not directed at anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact privacy@fix-it.ai and we will delete it.
13. Changes to this policy
We will post any changes on this page and update the “Last updated” date. If the changes are material, we will notify you by email or in-product notice before they take effect.
14. Contact us
Questions about this policy or how we handle your data:
House No. 272, Floor 1st, Block C, Prashant Vihar, Rohini, North West Delhi, Delhi – 110085, India