Privacy Policy

1. Who We Are

FixDoc is a product of ByteUp LLC, a technology company based in Tamarac, FL. FixDoc provides AI-powered document verification software for mortgage professionals. We are a technology service provider -- not a mortgage lender, broker, or financial advisor.

2. Data We Collect

We collect only what is necessary to provide our service:

• Account information: Name, email address, organization name, and role when you create an account.
• Financial documents: Pay stubs, bank statements, W-2s, tax returns, and other documents you upload for verification. These are stored encrypted and isolated per organization.
• Usage data: Feature usage, API calls, and session data to improve our service and enforce plan limits.
• Payment information: Processed securely by Stripe. We do not store credit card numbers on our servers.

3. How We Protect Your Data

• Encryption: All data is encrypted at rest via Supabase on AWS infrastructure and in transit via TLS, enforced by our hosting and database providers.
• Data isolation: Every request is scoped to your organization, by Row Level Security (RLS) policies in the database and by organization checks in the application. One organization cannot see another's data.
• Access control: Role-based access control (RBAC) ensures team members only see what their role permits. Key actions, including document downloads and exports, are recorded in an audit log.
• Infrastructure: The database, sign-in and file storage run on Supabase, built on AWS; the application runs on Vercel.

4. How We Use Your Data

• To provide document verification and fraud detection services.
• To power the AI Assistant with project-specific context.
• To enforce plan limits and usage tracking.
• To send service-related notifications and updates.

5. What We Never Do

• We never sell your data. Your financial documents and client information are never shared with third parties for marketing or any non-service purpose.
• We never train public AI models on your data. Documents processed through our AI engine are used solely for your verification results. They are not used to train, improve, or fine-tune any public or third-party machine learning models.
• We never access your data without cause. Our team does not review your documents unless required for technical support that you explicitly request.

6. Data Retention

Your data is kept while your organization exists. Ending a subscription does not delete it: the organization moves to the free start and keeps its clients, files and findings. Loan files are records your organization may be required to keep, so a removed document is hidden from your team but kept for the retention period that applies to it, five years by default and longer where a state rule requires, before it becomes eligible for secure disposal. Owners and admins can restore a removed document during that period.

7. Third-Party Services

We use the following third-party services:

• Supabase: Database, authentication, and file storage (SOC 2 Type II certified).
• Stripe: Payment processing (PCI DSS Level 1 certified).
• OpenAI: AI-powered document parsing and assistant. Data sent through OpenAI's API is not used to train their models, under OpenAI's API data usage policy. Social Security numbers and full account and card numbers are removed from document text before it is sent to the AI provider; names, employers, dates, amounts and transactions are sent so the figures can be read.
• Vercel: Application hosting and CDN.
• Resend: Delivery of account and notification emails.
• Google: Sign-in, only if you choose to sign in with Google.

8. Your Rights

You have the right to access and correct your personal data, and to ask us to delete it. Loan file records stay for the retention period described above; personal data outside them is deleted on request. Contact us at privacy@fixdoc.co.

9. Contact

For privacy-related questions, contact us at privacy@fixdoc.co.