fixRAgent

Data Retention Schedule

Effective 14 September 2026Last updated 14 September 2026retention-2026-09-14

This page lists every class of data ARLogic LLC holds for fixRAgent, the system it lives in, how long it stays there, and the job or the request that removes it. It is the working companion to the Privacy Policy: the policy says what we collect and why, and this schedule says exactly when each thing goes.

The schedule

whatwhere it liveshow longwhat removes itprivacy policy section
a triage card's record (answer, photo hash, versions, role, arm)Supabase — our database, under a random diagnosis_idUntil you ask us to delete itYour request to legal@fixragent.com§8
a kept photo (repair-guidance tool, "Keep this photo" ticked)Supabase — a private bucket in the United States, named by the file's hash30 daysA daily sweep that deletes the file and clears the pointer, and leaves the consent record standing§3
a photo on the triage card pathGoogle — the Gemini model service; we keep no bytes of it55 days at GoogleGoogle's own 55-day expiry§3
repair-guidance results under an accountSupabase — our database (diagnoses)Until you delete the result or the accountDeleting it in the app, or your request§8
a guest result on our sideSupabase — our database (diy_guest_scans)Until you ask us to delete itYour request, using the details held on your device§8
an email address or phone number on a cardSupabase — our database, next to the version of the consent line you sawUntil you unsubscribe or ask us to delete itThe unsubscribe line in any card email, or your request§4
unsubscribe recordsSupabase — our database (triage_email_optout)Kept, so that the unsubscribe keeps workingKept by design§4
the record that a follow-up was started for a cardSupabase — our database (triage_mail_log), holding a hash of the address rather than the addressKept with the card, so that no follow-up is started twiceKept by design§4
consent records (which text you saw, when)Supabase — our database, next to the record they belong toKept, as the proof that consent was givenKept by design§8
outcome answersSupabase — our database (outcomes), under the card's diagnosis_idKept with the card, and de-identified once the card is deletedYour request, which de-identifies them§5
feedbackResend — delivered to us as email; Anthropic — read once to categorise it and draft a reply for usUntil you ask us to delete itYour request§8
account, plan and Stripe identifierSupabase — our database (fixr_users); Stripe — your customer recordUntil you delete the account; Stripe keeps its own record of paymentsDeleting the account, or your request§8
a thumbs-up or thumbs-down on an answer (diagnosis_votes)Supabase — our databaseUntil you ask us to delete itYour request§8
properties and assets you registerSupabase — our database (properties, assets)Until you delete them or the accountDeleting them in the app, or your request§8
payment recordsSupabase — our database (payment_logs); Stripe — its own invoice recordKept, as the record of what was paidKept by design, as financial record-keeping requires§8
tenant, manager and roof-inspection photos, and the intake records around them (accounts, properties, units, tickets, intake codes and their scan log)Supabase — private buckets and our databaseUntil the account holder or the contractor deletes them or asks us to; the intake rate-limit record for 24 hoursThe account holder deleting them, or your request§8
a tenant's email address on a ticketSupabase — our database (pm_tickets)Until the account holder deletes the ticket or the tenant asks us toDeleting the ticket, or your request§8
our outreach and prospect records (section 2.9)Supabase — our databaseUntil the person asks to be removedYour request§8
product analytics events at Google Analytics, PostHog and Vercel Web AnalyticsGoogle Analytics, PostHog and VercelEach tool's own period, set out in the processor rows belowDeleting a person and their events in each tool, on your request§8
our own event store (fixr_events: device id, events, city, region, country, browser type)Supabase — our databaseFor as long as we operate the serviceYour request for your device's rows, with the fixr_did value from your browser's storage§8
the QR scan log (qr_scans: time, network address, browser, referring page, city, country, device type)Supabase — our databaseFor as long as the link existsRetiring the link, or your request for the rows for your address§8
the contractor list and its send recordSupabase — our databaseUntil the contractor asks to be removedYour request§8
error reports and hosting logsSentry — error reports; Vercel — request logsEach provider's own period, set out in the processor rows belowEach provider's own expiry§8
the prompt, the photo and the answer at the model serviceGoogle — the Gemini API55 daysGoogle's own expiry§6
our database, our file storage and sign-inSupabase — United States (US East)A live row stays until it is deleted here; Supabase's daily backups hold the last 7 days on our plan, and Storage objects sit outside those database backupsDeleting the row here, then the backup window passing§6
our web hosting, server functions and request logs, and the page views and page-load timings its analytics reportVercel1 day of runtime logs, and 30 days with the observability add-onVercel's own expiry§6
email deliveryResend30 days for email and log data, and its backups persist for 7 daysResend's own expiry§6
payments and card detailsStripeFor as long as Stripe provides the service, and afterwards for the periods its legal, tax and fraud-prevention duties setStripe's own schedule§6
page views and interactionsGoogle AnalyticsUp to 14 months for the data behind explorations; standard aggregated reports are unaffected by that settingDeleting a person's data in the property, on your request§6
product analytics eventsPostHog1 year on the free plan and 7 years on a paid planDeleting a person together with their events and recordings, on your request§6
the request that loads the typeface and the database client libraryGoogle Fonts and esm.shEach host's own request-log periodEach host's own expiry§6
the request that loads the stylesheet on most site pagesTailwind Labs (cdn.tailwindcss.com)Its own request-log periodIts own expiry§6
the request that loads script libraries on seven site pagesCloudflare — cdnjsThe period Cloudflare's stated business purposes and legal duties setCloudflare's own schedule§6
the request that loads a library on the QR admin pageunpkgIts own request-log periodIts own expiry§6
a property address, when a roof-size estimate is runGoogle Maps and Google SolarGoogle's own schedule; Google anonymises advertising data in server logs by removing part of the address after 9 monthsGoogle's own expiry§6
error reports from our servers, and from your browser on the tenant-intake pagesSentry90 days for errors and 30 days for logsSentry's own expiry§6
the text of feedback you send usAnthropic — ClaudeInputs and outputs are deleted within 30 daysAnthropic's own expiry§6
a video embedded in some repair guidanceYouTubeGoogle's own scheduleGoogle's own expiry§6
your visit, when you follow a link to a parts or trades siteAmazon, The Home Depot, Lowe's, Angi and ThumbtackWe send them nothing, so we hold nothing to remove; each site keeps its own record of the visit under its own policyEach site's own schedule§6
our own encrypted backups of the database and the codeHetzner — our own server; each set is encrypted before it is writtenThe last five sets of each kind, which reaches about five weeksA nightly job that prunes to the last five sets§8
the off-site copy of that nightly setCloudflare — R2 object storage in the European Union, encrypted14 daysA nightly job that deletes sets older than 14 days§8
server snapshotsHetzner — rolling images of the whole server7 daily snapshotsA daily job that keeps 7 and removes the rest§8
our permanent archive of consented outcome photos and resultsHetzner — a content-addressed store on our own serverKept, as the record of what each repair turned out to be; a photo reaches it only where you ticked consentYour request to legal@fixragent.com§7
our evaluation exports (a photo, the verdict and the human signal, under file names that are hashes)Hetzner — a working folder on our own serverKept while the engine is being measuredYour request to legal@fixragent.com§7

How to ask

Email legal@fixragent.com, or use the feedback form in the app. Write from the address you used, or give us the diagnosis_id printed on the card, so that we can find the right records. We act within 30 days and tell you when it is done, as §9 of the Privacy Policy sets out.

A deletion request reaches every copy of the database within about five weeks: the live row goes at once, the off-site copy ages out after 14 days, the server snapshots after 7 days, and our own encrypted sets once the last five have rolled forward.

Sources

Each period above that belongs to another company was read from that company's own published page on the date shown.