Privacy Notice

1Who we are and scope

1.1 Controller. PrimeInstall LLC, a New York limited liability company (New York Department of State ID 7758956), doing business as FixItFast.NYC (“we,” “us”), decides how and why personal information is processed on fixitfast.nyc and primeinstall-llc.com, the installable web app, and in connection with our home services in New York City. This notice explains what we collect, why, and the choices you have.

1.2 Scope. This notice applies to visitors, customers (including guests who book without an account), people who chat with our assistant Mason, applicants and members of the FixItFast Pros network (see Section 14), and people who contact us. It is part of our Terms of Service.

1.3 We do not sell your information. We do not sell personal information and we do not share it for cross-context behavioral advertising. We do not use advertising cookies unless you allow optional analytics in the cookie banner, and even then we do not use the data to sell advertising.

1.4 Contact. To contact us about privacy, use the form at /contact.

2Information we collect

2.1 Categories. Depending on how you use the Services, we collect:

• Identifiers and contact details: name, email address, telephone number, service address, borough, and account login records (email, hashed password, sign-in times).
• Booking and job information: the service requested, preferred window, access notes (such as building rules, doorman, parking, pets), descriptions, Quotes, schedules, technician assignments and completion records.
• Photos and files you upload: images of the work area or equipment, which may show your home and, incidentally, people or other personal details.
• Chat transcripts: messages you exchange with Mason and with our team.
• Payment information: payment status, amount, date and the last four digits and brand of a card as returned by Stripe. We do not see or store full card numbers.
• Consent and acceptance records: the version of the Terms you accepted and the date and time, cookie choices, and text message consent records.
• Security and device data: IP address, user agent, timestamps and basic security logs used to protect accounts and detect abuse.
• Cookies: an essential session cookie and, only if you allow it, optional analytics. See the Cookie Notice.
• Communications: the content of messages you send through the contact form and related correspondence.

2.2 What we do not collect. We do not intentionally collect government identification numbers, precise geolocation from your device, biometric identifiers or health information from customers. Please do not send them to us.

3Sources

We collect personal information (a) directly from you, when you create an account, submit a Booking Request, upload a photo, chat or contact us; (b) automatically, through your browser or device when you use the Site; (c) from Stripe, which tells us whether a payment succeeded, failed or was refunded; (d) from our technicians and staff, who record job notes and completion details; and (e) from building managers, landlords or boards, when they communicate with us about access or permissions for your job.

4How we use information

4.1 Purposes. We use personal information to:

1. create and secure your account and verify who is using it;
2. review Booking Requests, prepare Quotes, schedule and perform Work, and keep you informed, including appointment texts, calls and emails;
3. process payments, refunds and disputes, and keep financial and tax records;
4. operate Mason and let our team follow up on chats;
5. provide customer support and respond to your requests;
6. detect, prevent and investigate fraud, abuse, security incidents and violations of our Terms;
7. maintain and improve the Services, fix errors, and measure performance, using analytics only with your consent where the law requires it;
8. comply with legal obligations, enforce our agreements and defend legal claims; and
9. send marketing messages, only where you have opted in separately.

4.2 No automated decisions with legal effect. We do not use automated decision-making that produces legal or similarly significant effects about you. Mason can start a booking request and look up your booking status, but people on our team review requests and prepare Quotes.

5Who receives information

5.1 Recipients by role. We share personal information only as needed with:

• Payment processor: Stripe, to process payments. Stripe handles card data under its own privacy notice.
• Cloud hosting provider: which operates the servers where the Site, App and database run. Servers may be located outside the United States, including in the European Union.
• Email delivery provider: to send transactional messages such as confirmations and receipts.
• AI model providers: which may include OpenAI, Google (Gemini), Anthropic, Groq and other providers, which receive the text of chat messages to generate replies (Section 6).
• Text and call providers: communications platforms that deliver appointment texts and calls, if you have given us your number.
• Technicians and subcontractors: who receive the details needed to perform your job, such as your address, access instructions and scope.
• Buildings: your landlord, board or managing agent, when a building requires information about the vendor or the work, and then only what is needed.
• Professional advisers and insurers: accountants, insurers and similar advisers under confidentiality duties.
• Authorities and others as required by law: in response to valid legal process, to protect rights, safety or property, or to prevent fraud.
• Successors: in a merger, financing, sale or reorganization, subject to this notice.

5.2 Service providers. Our service providers act on our instructions under contracts that limit their use of personal information to providing services to us, and require appropriate security. We do not allow them to use your information for their own advertising.

5.3 No sale or sharing. In the last 12 months we have not sold personal information or shared it for cross-context behavioral advertising, and we do not knowingly sell or share the information of anyone under 16.

6AI chat processing

6.1 Mason is an AI. Mason is an artificial intelligence system and says so. It can answer questions, start a booking request and, if you are signed in, look up the status of your bookings. A member of our team can take over a conversation.

6.2 What is sent. To generate a reply, the text of your conversation, and where you are signed in and ask about a booking, the relevant booking details, are sent to AI providers, which may include OpenAI, Google (Gemini), Anthropic, Groq and other providers. These providers process the text under their own terms and our agreements with them. We do not send full payment card numbers or passwords to them, because we do not hold them.

6.3 Storage. We store chat transcripts so that staff can follow up, resolve issues and keep a record of what was discussed.

6.4 Your choices. Please do not enter sensitive information into chat. You can ask for a human by saying so in the chat or by using the contact form. You can book without using Mason.

6.5 Safety. Mason does not give safety-critical electrical or gas instructions. For emergencies it points you to 911 and your utility.

7Retention

7.1 Periods. We keep personal information only as long as needed for the purposes in this notice, and for the periods below, after which we delete or de-identify it, unless a longer period is required by law or needed for a pending claim or dispute.

7.2 Deletion on request. If you ask us to delete your account or data, we will delete what we can, and keep only what the retention periods above, or a legal obligation, require, restricted to that purpose.

7.3 Backups. Deleted data may remain in encrypted backups for a limited period, after which it is overwritten in the ordinary cycle.

8Security

8.1 Safeguards. We use administrative, technical and physical safeguards appropriate to the sensitivity of the information, including encryption in transit, hashed passwords, role-based access (customer, staff, administrator, owner), access logging, and payment processing by Stripe so that we do not store full card numbers.

8.2 Your part. Use a unique password, keep it confidential, and tell us through the contact form if you suspect unauthorized access.

8.3 No guarantee. No system is perfectly secure. If a breach affects your personal information, we will notify you and regulators as the law requires.

8.4 Reporting vulnerabilities. If you find a security issue, report it through the contact form with the subject “Security.” Please give us a reasonable time to fix it before disclosing it and do not access other people’s data.

9California privacy rights (CCPA/CPRA)

9.1 Categories collected. In the last 12 months we collected the following categories of personal information, as defined in the California Consumer Privacy Act as amended (“CCPA”), and disclosed them for a business purpose to the recipients shown. We did not sell or share any category.

9.2 Sensitive personal information. We collect account log-in credentials, which the CCPA treats as sensitive. We use this information only to provide the Services you request, to secure your account and as the law permits. We do not use or disclose sensitive personal information to infer characteristics about you, and we do not use it for purposes that would give you a right to limit under the CCPA. Because of that, a separate “Limit the Use of My Sensitive Personal Information” link is not needed. You can still ask us to confirm this through the contact form.

9.3 Your rights. If you are a California resident, you have the right to:

1. Know the categories and specific pieces of personal information we collected about you, the sources, purposes and the categories of recipients;
2. Delete personal information we collected from you, subject to exceptions such as legal obligations and completing transactions;
3. Correct inaccurate personal information;
4. Opt out of the sale or sharing of personal information (we do neither);
5. Limit the use of sensitive personal information (we use it only for the permitted purposes described above); and
6. Non-discrimination: we will not deny you service, charge you a different price or provide a different level of service because you exercise these rights.

9.4 How to make a request. Signed-in customers can use Download my data and Delete my account in the account dashboard. Anyone else can use the contact form with the subject “Privacy request” and tell us what you are asking for. You may make a request up to twice in 12 months for the right to know.

9.5 Verification. We must verify that the person making a request is the person it concerns. For requests made from a signed-in account, being signed in is usually sufficient. For requests to know specific pieces of information, delete or correct, made through the contact form, we will ask you to confirm information we already hold, such as the email address and a recent booking detail, and for requests to know specific pieces, we may require a signed declaration under penalty of perjury. We will not ask for more information than we need and will use it only to verify the request.

9.6 Authorized agents. You may use an authorized agent. We may require a signed written permission from you, or a power of attorney, and may require you to verify your identity directly with us.

9.7 Timing. We will confirm receipt of a request within 10 business days and respond within 45 days, and may extend by up to another 45 days with notice if reasonably necessary.

9.8 Declining. If we decline a request in whole or part, we will explain why, to the extent the law allows.

9.9 Deidentified data. We do not attempt to reidentify deidentified information.

10Global Privacy Control

We treat a browser signal that is a valid Global Privacy Control (“GPC”) signal as a request to opt out of sale and sharing, and also as a rejection of optional analytics cookies for that browser. Because we do not sell or share personal information, the signal does not change those practices, and we honor it by keeping optional analytics off. You can turn GPC on in a browser or extension that supports it.

11California Shine the Light

California Civil Code Section 1798.83 permits California residents to request information about the disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes. To confirm, use the contact form with the subject “Shine the Light.”

12EU and UK rights

12.1 Application. Our services are directed to customers in New York City. If you visit from the European Economic Area or the United Kingdom, the following applies to personal information we process about you.

12.2 Legal bases. We rely on:

• Contract: to respond to your request, provide a Quote and perform Work, and to run your account;
• Legitimate interests: to secure the Services, prevent fraud, keep business records, operate Mason and improve the Services, balanced against your rights;
• Legal obligation: for tax, accounting and compliance records;
• Consent: for optional analytics and for marketing texts or emails, which you can withdraw at any time without affecting past processing.

12.3 Your rights. You have the right to access, rectify, erase, restrict and object to processing, to data portability, to withdraw consent, and not to be subject to certain solely automated decisions. You can also complain to your local data protection authority.

12.4 International transfers. We are based in the United States, and our servers may be located in the United States or the European Union. If we transfer personal information from the EEA or UK to a country without an adequacy decision, we rely on safeguards such as the European Commission’s Standard Contractual Clauses and the UK addendum, with our providers.

12.5 Exercise. Use the methods in Section 15. We respond within one month, extendable where the law permits.

13Children

The Services are for adults. We do not target children under 13 and do not knowingly collect their personal information. We do not knowingly contract with anyone under 18. If you believe a child has given us personal information, tell us through the contact form and we will delete it. Photos of your home may incidentally include children; please avoid including them.

14FixItFast Pros

14.1 Who this covers. This section applies to people who apply to become, or who are, FixItFast Pros: independent specialists who apply through the Pros application and accept jobs dispatched through the platform under the FixItFast Pro Agreement.

14.2 What we collect. We collect: name, contact details, business name, trade and service areas; trade license and registration details and numbers (for example, New York City Department of Buildings or Department of Consumer and Worker Protection credentials where the work requires them); insurance documents, such as certificates of general liability and workers’ compensation coverage or exemption; the results of identity and work-eligibility checks; the results of a background check, only if you separately authorize it in writing; job history, ratings, and performance and safety records on the platform; and payout details.

14.3 Payout details. Bank or payout account details are collected and handled by our payment processor, not stored by us in full. We keep the status of your payout account and a record of payouts.

14.4 Background checks. We obtain a consumer report or background check only with your separate written authorization, and we follow the Fair Credit Reporting Act and the New York City Fair Chance Act, including the required sequencing, notices and opportunity to respond. We use the results only to evaluate your eligibility for the network.

14.5 Purposes. We use this information to evaluate and verify applicants, confirm licenses and insurance, dispatch and pay for jobs, protect customers and the platform, meet tax and legal obligations, and enforce our agreement. We share limited details, such as your first name, photo if you provide one, trade and rating, with customers whose jobs you accept.

14.6 Retention. Applications that are not approved are deleted after 12 months. For active Pros, we keep records for the duration of your participation plus 7 years for tax and accounting records, and delete or de-identify other applicant documents sooner when no longer needed. Expired insurance and license documents are replaced when you provide renewals.

14.6A Your rights. The rights described in this notice apply to you as well. Use the contact form with the subject “Privacy request.”

15How to exercise your rights

15.1 Account dashboard. If you have an account, sign in and use Download my data to receive a copy of the personal information associated with your account, and Delete my account to request deletion.

15.2 Contact form. Without an account, or for any other request, including access, correction, objection, withdrawal of consent, text opt-out, Shine the Light, or an appeal, use /contact and choose a subject that names your request. We may need to verify your identity as described in Section 9.5.

15.3 Appeals. If we decline your request, you may appeal through the contact form with the subject “Privacy appeal.” We will respond within the time the law requires. You may also contact your state attorney general.

15.4 Marketing preferences. You can opt out of marketing texts by replying STOP and of marketing emails with the unsubscribe link. Service messages about your booking will continue.

16Changes to this notice

We may update this notice. We will post the new version with a new effective date and version, and for material changes we will notify you by email or in the App where practical. The version in effect is shown at the top of this page.