The personal data controller within the meaning of the Georgian Law on Personal Data Protection (No. 3144 of 14.06.2023) is Individual Entrepreneur Dzmitry Ishchanka (ID 306486585), hereinafter referred to as "we" or "the Service".
Contact information:
— Email for personal data inquiries: hello@xfix.ge
— Address: Georgia, Tbilisi, Samgori district, Police lane I, N5
No separate Data Protection Officer has been appointed — please write to the email above with any questions about personal data processing.
2.1. Data you provide directly:
— Identification data: first name, last name, mobile phone number, email (if provided), profile photo.
— Profile data (for Masters): specialization, biography, years of experience, portfolio, rates, payout details.
2.4. In-app call data: the fact, time, duration and participants of a call, plus technical connection parameters. We do not record or store the content of voice and video calls: audio and video are transmitted directly between devices, and when a direct connection is impossible they are relayed through our server without being stored. Microphone and camera access is requested only for calls and taking photos, and only with your permission.
Pursuant to Article 5 of the Georgian Law on Personal Data Protection, processing is permitted only on a lawful basis.
3.1. Registration and authentication — basis: performance of contract (Terms of Service).
3.2. Search and matching of Masters, chat, order placement — basis: performance of contract.
3.3. Payment and subscription processing — basis: performance of contract and compliance with payment systems legislation.
3.4. Push and email notifications about order statuses — basis: performance of contract.
3.5. Marketing communications and offers — only with your explicit consent (which can be withdrawn at any time).
3.6. Analytics and service improvement — basis: legitimate interest of the Service; data is anonymized.
3.7. Compliance with legal requirements (accounting, tax reporting) — basis: legal obligation.
3.8. Disclosure to law enforcement authorities — only upon a lawful request.
3.9. Voice and video calls between a Client and a Master — basis: performance of the contract.
3.10. Automatic translation of user content into the interface languages — basis: performance of the contract and the legitimate interest of the Service (availability of the platform in Russian, English and Georgian).
4.1. Other Users: your name, photo, and public profile parts are visible to other platform participants (Masters see order descriptions; Clients see the Master's profile and reviews).
4.2. To infrastructure providers: Hetzner Online GmbH (Germany; our servers and database are located in Helsinki, Finland) — hosting; Apple and Google — push notification delivery; an SMS provider — sending verification codes; Yandex (Russia) and OpenStreetMap — address geocoding; OpenRouter Inc. (USA) and the language model providers connected through it — automatic translation of user content (order descriptions, service names, reviews, Master profiles).
— Supabase Inc. (US/EU) — cloud database and storage. Processing under a Data Processing Agreement (DPA), GDPR-compliant.
— Apple, Google — push notifications.
Our servers and database are located in Finland (European Union). Some data is transferred outside Georgia:
— European Union (Finland, Germany) — hosting, database storage and backups;
— United States (Apple and Google — push notifications; OpenRouter — automatic content translation) — on the basis of standard contractual clauses or your consent;
Transfers are carried out using technical and organizational protection measures.
— Russia (Yandex Maps API) — address strings and coordinates for geocoding only, without name, phone number or any other user identifiers.
6.1. Active account data — for as long as you use the Service.
6.2. After account deletion, personal data (name, phone number, email, photo, addresses, contacts, messages) is deleted or anonymised within 30 days. Anonymised history of orders, offers and reviews is retained without any link to you — it is needed for Service statistics and for the integrity of other Users' ratings. Financial and tax records are kept for 6 years under the Tax Code of Georgia; data required to resolve legal disputes — until the limitation periods expire.
Under the Georgian Law on Personal Data Protection (Arts. 16–22), you have the right to:
— receive information about what data of yours is processed, the purposes and grounds of processing;
— request a copy of your data in a structured, machine-readable format (right to data portability);
— request rectification of inaccurate or completion of incomplete data;
— request erasure of data ("right to be forgotten") if the grounds for processing no longer apply;
— restrict processing (e.g., while accuracy of data is disputed);
— object to processing based on legitimate interest or for marketing purposes;
— withdraw consent at any time (this does not affect the lawfulness of processing prior to withdrawal);
— file a complaint with the Personal Data Protection Service of Georgia: https://personaldata.ge.
Send your requests to hello@xfix.ge. We will respond within 10 business days.
We apply technical and organisational measures: encryption of data in transit (HTTPS/TLS); encryption of database backups; access control (only staff with a business need); regular backups; Row-Level Security in the database (a user sees only their own data); action logging and security monitoring.
— encryption of data in transit (HTTPS/TLS) and at rest (AES-256 on Supabase servers);
9.1. In the mobile app, we use the device's local storage (AsyncStorage) to save authorization tokens and user settings (selected city, theme).
9.2. In the web version, cookies and localStorage are used to preserve the session. The Service does not use analytics trackers (Google Analytics, Facebook Pixel, etc.).
9.3. Device push tokens are stored to send notifications and are deleted after sign-out.
The Service is not intended for persons under 18. We do not knowingly collect data from minors. If you become aware that a minor has provided us with data, please notify hello@xfix.ge — the data will be deleted immediately.
We may update this Policy. We notify users of material changes via push notification, email, or an in-app screen on first launch after the change. The date of last update is indicated at the end of the document.
Continued use of the Service after a change to the Policy constitutes your acceptance of the new version.
For all questions regarding the processing of personal data:
Email: hello@xfix.ge
Address: Georgia, Tbilisi, Samgori district, Police lane I, N5
Registration number: 306486585, registered on 26/09/2024. Registering authority: LEPL National Agency of Public Registry.
Last updated: 10 August 2026.
Supervisory authority: Personal Data Protection Service of Georgia — https://personaldata.ge
