Privacy policy

FixRamp is operated by Himo Technologies Inc., a Quebec, Canada corporation (130-5645 Grande Allée, Unit 162, Brossard, QC J4Z 3G3, Canada). This policy explains what personal information we collect, why, who we share it with, how long we keep it, and your rights. It is written to meet Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25) and Canada's PIPEDA.

Person in charge of privacy

Our person in charge of the protection of personal information is Hicham Mounir. Contact: privacy@fixramp.com, or by mail at Himo Technologies Inc., 130-5645 Grande Allée, Unit 162, Brossard, QC J4Z 3G3, Canada.

What we collect and why

• Order email address: to deliver your report, send receipts and answer your questions.
• Billing name and address: collected by Stripe during checkout to process payment and calculate taxes. We never see or store your full card number.
• Website address (URL): to run the scan you ordered and produce your report.
• IP address: for security, fraud prevention and rate limiting.
• Email correspondence: when you write to us, we keep the messages to answer you and keep a record of your requests.

We do not ask for passwords or access to your website, and we do not install scripts or overlays on it. We only read public pages.

Free scan

When you use the free scan, we scan one public page of the URL you submit. We do not store personal information from the free scan other than the URL and, if you came from a Google ad, the Google click ID (see Cookies below). Your IP address is used only in memory to limit abuse, and is not saved.

If you ask us to email you the results, we keep your email address, the scanned site and the results to send that email. If you also tick the box for follow-up emails, we send them only after you confirm by clicking the link in that email: at most 3 emails over about 10 days, with fixes and offers for FixRamp reports. We record when you agreed, when you confirmed and the wording you agreed to. Every email has an unsubscribe link, and we stop if you order a report. Scan results that nobody asked to receive by email are deleted after 90 days.

Business outreach emails

We may send business-to-business emails to addresses that companies publish on their websites, sometimes including a free automated scan of the company's public homepage. For businesses in the United States only, when the website publishes no address or only a general one (such as info@), we may use a business email address found by a business-contact data provider (Hunter.io), preferably that of a person at the company such as the owner, and checked with its verification service. We keep a record of where each address came from, as required by Canada's Anti-Spam Legislation (CASL) and the U.S. CAN-SPAM Act. Every email includes an unsubscribe link, and we honour it immediately. After you unsubscribe, we keep your address on a suppression list only so that we never email you again.

Service providers

We share personal information only with providers that help us run the service, and only what they need:

• Stripe: payment processing and tax calculation.
• Vercel (United States): website hosting and report storage.
• Resend (United States): email delivery, such as reports, receipts, and free scan results and follow-ups you asked for.
• Instantly: sending business outreach emails.
• Hunter.io: finding and verifying business email addresses of U.S. companies for outreach, when none, or only a general address, is published on their website.
• Google Ads (United States): measuring which of our ads lead to free scans and orders, using only the Google click ID, the date and the order amount.
• Anthropic: AI assistance to draft replies to support emails. We do not share payment data with Anthropic.

We do not sell or rent personal information.

Information stored outside Quebec

Your personal information may be stored and processed outside Quebec, mainly in the United States, by the providers listed above. Before any such transfer, we assess whether the information will be adequately protected, and we rely on contractual commitments from these providers. Information held outside Canada may be accessible to foreign authorities under the laws of those countries.

How long we keep it

• Orders, invoices and reports: 3 years, for accounting and tax purposes.
• Outreach records: until you unsubscribe or ask us to delete them, and no longer than 12 months. If you unsubscribe or ask for deletion, a one-way coded form of your address stays on our suppression list so we never contact you again.
• Free scan email requests: no longer than 12 months, or until you ask us to delete them. If you unsubscribe, we stop immediately and keep the request only as a record of your consent and its withdrawal, and a coded form of your address stays on our suppression list.
• Support correspondence: as long as needed to handle your request, and no longer than 2 years.
• Backups: we keep daily backups for 30 days, so deleted information disappears from backups within 30 days.

When information is no longer needed, we delete or anonymize it.

AI assistance

Replies to support emails may be drafted and sent by an AI assistant, with human oversight. Fix guidance in reports comes from a reviewed library assembled with AI assistance. No decision about you is made solely by automated processing. If you would rather talk to a person, say so in your email.

Cookies

This site uses no advertising or analytics cookies. We only use what is strictly necessary for the site and checkout to work. If this ever changes, we will add a consent banner and ask for your consent first.

To understand how people find us, we count page visits in aggregate: the page, the referring site or campaign, the country and the device type, summed per day. We do not use cookies or any identifier for this. IP addresses are used only momentarily to block abuse and are never stored with visit data, and no individual visit can be traced back to you.

If you arrive from a Google ad, the link carries a Google click ID. Your browser keeps it in session storage until you close the tab (not a cookie). When you then run a free scan or place an order, we keep that click ID on our servers with the date and, for orders, the amount, and share it back with Google Ads so we can tell which ads lead to scans and sales. We do not share your email, your store address or your scan results. Click IDs are deleted from our servers within 100 days.

Your rights

You can ask us to:

• access the personal information we hold about you;
• correct information that is inaccurate or incomplete;
• delete your information, or stop using it, subject to what we must keep by law (for example, tax records);
• withdraw your consent to a use of your information;
• receive your information in a structured, commonly used technological format (portability).

Write to privacy@fixramp.com. We answer within 30 days. We may need to confirm your identity before acting on a request.

Security

We use encrypted connections (HTTPS), limit access to personal information to those who need it, and use unlisted, hard-to-guess links for reports. If a confidentiality incident poses a risk of serious injury, we will notify the people affected and the Commission d'accès à l'information as the law requires.

Complaints

If you have a concern, contact our person in charge of privacy first at privacy@fixramp.com. You can also file a complaint with the Commission d'accès à l'information du Québec (cai.gouv.qc.ca) or, outside Quebec, the Office of the Privacy Commissioner of Canada.

Changes

If we change this policy, we will update the date at the top of this page. Significant changes will be announced on this page before they take effect.