Privacy & Cookie Policy

1. Who We Are

FIXFLEX LTD is an app development company registered in England and Wales, company no. 08944523, registered office: 170 Connell Crescent, London, W5 3BP. We operate the websites fixflex.co.uk and kep.fixflex.co.uk (Kep) and related projects, and we are the data controller for the personal data described in this policy. Contact: [email protected]

2. Cookies and Similar Technologies

Analytics cookies (optional). We use Google Analytics 4, a service provided by Google, to understand how visitors use our website (pages visited, time spent, device and browser type, approximate location such as country). Google Analytics is only loaded after you click "Accept" on our cookie banner. If you click "Decline", or make no choice, Google Analytics is not loaded and no analytics cookies are set. Google states that GA4 does not log or store IP addresses; it does use a random client ID stored in the _ga cookie, which may count as personal data under UK GDPR.

A normal visit does not set any Cloudflare cookies; they only appear if Cloudflare's security protection needs to verify a visitor. Strictly necessary cookies do not require consent.

Browser storage (not cookies). We store two small values in your browser's local storage. They stay on your device and are not sent to us: fixflex_cookie_consent remembers your cookie choice, and liked_<post> remembers which blog posts you have liked. On kep.fixflex.co.uk the same cookie choice is stored as kep_cookie_consent; the Kep demo itself does not load Google Analytics.

3. Data You Give Us

Contact form. We collect your first and last name, email address, phone number (optional), project type, budget and message, and use them only to respond to your enquiry and to any resulting work. The legal basis is our legitimate interest in answering enquiries and, where you ask about a project, taking steps at your request before entering into a contract (Article 6(1)(b) and 6(1)(f) UK GDPR). The contact form on kep.fixflex.co.uk also asks for your firm's name, type and team size, and works the same way, including the spam check described below.

To protect the form from spam, messages are checked by our own spam-filtering service (SpamSlap). As part of this check, your name, email address and message may be sent to an AI model provider (OpenRouter), used only to decide whether the message is spam (it passes the message to Google's Gemini model; if OpenRouter is unavailable, a model on our own server is used). For each check we keep a record: for messages classified as spam, your email address, the first 200 characters of the message and your IP address; for genuine messages, only the time, result and IP address. If the check cannot be completed, the full message is held for manual review instead of being lost. Your enquiry is then delivered to our business email inboxes, one of which is hosted by Google (Gmail).

Kep live demo. The online demo at kep.fixflex.co.uk/demo uses a fictional law firm and invented documents; file uploads are switched off. To answer your questions, the text of each question — together with extracts from the fictional demo documents — is sent to Anthropic (the Claude AI model). Your IP address and identifiers are not sent to Anthropic. Your questions and answers stay in your private demo sandbox, which is deleted after about 24 hours. To understand how the demo is used and to prevent abuse, we also keep usage records: the text of your questions, a random sandbox identifier, your IP address, the referring page and the cost of each request. These records do not include your name or email address. Please do not enter real client or personal information into the demo. The legal basis is our legitimate interest in demonstrating the product and preventing abuse (Article 6(1)(f)).

Ebook downloads. When you request a free ebook, we store your email address and which ebook you requested so we can give you access. We do not send you a newsletter unless you ask for one. The legal basis is your consent (Article 6(1)(a)).

Surveys. Our surveys are anonymous. If you choose to leave your email address for early access, we use it only for that purpose, based on your consent.

Blog. If you comment on a blog post, the name you enter and your comment are stored on our blog platform (BlogAPI, on our own server) and shown publicly next to the post. Each comment is sent through OpenRouter to a DeepSeek AI model, which checks it for spam and may write an automatic reply. AI replies are shown under the comment and clearly labelled "AI-generated reply". We also count views and likes on each post. The legal basis is our legitimate interest in running and moderating the blog (Article 6(1)(f)).

Security logs. When you submit a form, we record your IP address and the time of submission to prevent abuse (rate limiting and spam protection). Like most websites, our web server also logs each request (IP address, time, page and browser) for security and troubleshooting. The legal basis is our legitimate interest in keeping the site secure (Article 6(1)(f)).

We do not sell your personal data.

4. Third-Party Services

• Cloudflare — DNS, CDN and security protection. All traffic to our website passes through Cloudflare, which processes your IP address to deliver and protect the site. Cloudflare Privacy Policy
• Google Analytics — website analytics, only with your consent. Google Privacy Policy
• Google Fonts and jsDelivr — fonts and code libraries are loaded directly from their servers, so these providers receive your IP address when your browser requests them. Google Fonts privacy · jsDelivr privacy
• Google (Gmail) — one of the business inboxes that receives contact form enquiries.
• OpenRouter — routes AI requests: contact form messages to Google's Gemini model for spam checking, and blog comments to a DeepSeek model for spam checking and automatic replies (see section 3). The company running the model may be outside the UK. OpenRouter Privacy Policy
• Anthropic — provides the AI model behind the Kep online demo only (the Kep product itself runs on the client's own hardware). Anthropic is based in the United States. Anthropic Privacy Policy

Some of these providers are based outside the UK, for example in the United States. Where personal data is transferred internationally, it is protected by the UK's adequacy regulations (such as the UK–US Data Bridge) or by appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, as provided by the relevant provider.

5. Data Retention

• Google Analytics — no longer than 14 months, according to our Google Analytics retention setting.
• Contact enquiries — kept for as long as needed to handle your enquiry and any work that follows, then deleted. You can ask us to delete them at any time.
• Ebook and survey email addresses — kept until you ask us to remove them.
• Blog comments — kept while the post is published, unless you ask us to remove your comment.
• Spam-check records and form logs with IP addresses — 90 days, then deleted automatically.
• Web server logs (IP address, time, page requested, browser) — 90 days, then deleted automatically.
• Kep demo sandbox (your demo questions and answers) — about 24 hours, then deleted automatically.
• Kep demo usage records — 90 days, then deleted automatically.
• Kep web server logs (IP address, time, page requested, browser, referring page) — 30 days, then deleted automatically.

6. Your Rights (UK GDPR)

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request erasure of your data ("right to be forgotten")
• Restrict or object to certain processing
• Request data portability, where applicable
• Withdraw your consent at any time (this does not affect processing before you withdrew it)
• Lodge a complaint with the Information Commissioner's Office (ico.org.uk)

To exercise any of these rights, contact us at [email protected].

7. How to Change Your Cookie Choice

You can change or withdraw your analytics consent at any time by clicking Cookie Settings (also in the footer of every page), which reopens the cookie banner. Choosing "Decline" removes the Google Analytics cookies from this site.

You can also clear this site's cookies and local storage using your browser settings, or opt out of Google Analytics on all websites with the Google Analytics opt-out add-on.

8. Changes to This Policy

We may update this policy from time to time. The "Last updated" date at the top of this page shows when it was last revised.

9. Contact

For any privacy-related questions, contact us at [email protected].