Privacy – WeFixIt

2. Your Rights at a Glance

Under the General Data Protection Regulation (GDPR) you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw consent (Art. 7(3) GDPR) with future effect
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR) — the competent authority is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg

To exercise these rights, simply email info@simplynext.de. For account deletion, a direct in-app option is also available (see Section 18).

3. General Information on Data Processing

We only process personal data of our users to the extent necessary to provide a functioning app and our content and services. The legal basis is generally Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures); for optional AI features, additionally Art. 6(1)(a) GDPR (consent), which you grant in a separate consent dialog before first using an AI feature and may withdraw at any time with future effect (see Section 7).

4. Registration and Account

Using the app requires creating an account. We collect:

• Email address
• Password (stored only in encrypted/hashed form, never in plain text)

Authentication is handled via our backend provider Supabase (see Section 14). You may optionally add a display name and profile picture. We send confirmation emails, password reset emails and other account-related system emails via the email delivery service Resend (Resend, Inc., USA) as a data processor; this involves processing your email address and the content of the respective email.

5. Vehicle, Cost, and Maintenance Data You Enter

The app's core functionality involves the voluntary entry of the following data by you:

• Vehicle data: manufacturer key number (HSN), type key number (TSN), vehicle identification number (VIN), mileage
• Diagnostic data: scanned OBD2 error codes and their history
• Cost data: maintenance and repair costs you record, including category
• Maintenance reminders: appointments you create (e.g., next oil change)
• Feedback data: voluntary feedback on repair guides or error code analyses

This data is visible only to you (technically enforced via row-level security in our database) and is never shared with other users or displayed publicly.

6. Photos and File Uploads

You may optionally upload vehicle photos and a profile picture and attach a photo in Ask Toni. You select vehicle and profile pictures from your photo gallery. In Ask Toni you can also take a photo directly with the camera; the camera only opens when you actively choose "Take photo", and only with the camera permission you grant in the operating system. Vehicle and profile pictures are stored encrypted in a private cloud storage (Supabase Storage) accessible only to your own account. Photos in Ask Toni are sent to the AI services to answer your question (see Section 7) and stored with the chat history in your account until you delete the chat, but no longer than six months.

7. AI Features (Ask Toni, AI Diagnosis, Parts Lookup)

The app offers AI-powered diagnostic features and a chat assistant ("Ask Toni"). When you use these features, the following data is sent for analysis to external AI providers: error codes, your chat text, technical vehicle data (e.g., make, model, engine, mileage and vehicle identification number/VIN — if you have allowed sharing for your vehicle) and — if you attach or take one — the photo.

For parts research, Gemini additionally uses Google Search ("Grounding with Google Search"). A search query derived from your request (e.g., vehicle model and component) is sent to Google.

No directly identifying data such as name, address, or email is transmitted to these AI services. The vehicle identification number (VIN) may, however, allow identification; it is only transmitted if you have allowed vehicle data sharing for your vehicle. According to the providers, data submitted via their paid application programming interfaces (APIs) is not used to train their AI models.

Consent and withdrawal: We only use the AI features on the basis of your explicit consent (Art. 6(1)(a) GDPR), which you give in a separate dialog before first using an AI feature. We store the time and version of your consent in your account so that we can demonstrate it (Art. 7(1) GDPR). You can withdraw your consent at any time under Settings → Privacy & Consents → AI processing. Ask Toni, the AI diagnosis and AI repair guides are then no longer available until you turn them back on; all other features of the app remain usable. The lawfulness of processing carried out before the withdrawal remains unaffected.

Note: Responses from the AI features are generated automatically and may contain errors (flagged accordingly in the app). For safety-relevant repairs, we recommend also consulting a professional. Part numbers are shown without guarantee.

8. Caching Infrastructure

To speed up repeated diagnostic requests, we use a cache (Upstash Redis). Diagnostic results are cached solely under the key "error code + language" — with no link whatsoever to your account or identity. It is not possible to identify individual users via this cache.

9. Payments, Subscriptions, and Credits

For paid subscriptions and credit purchases we use RevenueCat to manage purchase transactions and Google Play Billing for the actual payment processing. Only a pseudonymous, randomly generated account ID is transmitted to RevenueCat — no email address and no payment data. Your actual payment details (credit card, Google account, etc.) remain entirely with Google and are never seen or stored by us.

10. Advertising (Google AdMob)

The app offers optional, voluntary rewarded video ads via Google AdMob (Google Ireland Limited), through which you can earn additional credits. Ads are only loaded when you actively choose to watch an ad video. Where legally required (e.g., in the European Economic Area), we first obtain your consent via Google's consent platform (User Messaging Platform based on the IAB Transparency & Consent Framework), where you also decide whether ads may be personalised. AdMob may process a device-level advertising identifier (Android Advertising ID or Apple IDFA) and ad interaction data to serve, measure and bill for advertising. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can change or withdraw your choice at any time under Settings → Privacy & Consents → Privacy options for ads. Use of the advertising feature is voluntary.

11. Push Notifications and Reminders

Maintenance reminders are scheduled and displayed solely locally on your device (via the Android/iOS system notification scheduling features). No external push service such as Firebase Cloud Messaging is used; your reminder data never leaves your device for this purpose. We only ask for notification permission when you create a reminder or turn on notifications in the settings; you can revoke it at any time in your device's system settings.

12. Bluetooth and Location Permission

To connect to your OBD2 diagnostic adapter, the app requires Bluetooth permissions. Older Android versions additionally require the "Location" permission for technical/system reasons before a Bluetooth device scan can be performed at all. Your actual location is never read, stored, or transmitted — the permission serves solely to technically unlock Bluetooth scanning at the operating-system level. The permissions are only requested when you start searching for an adapter.

13. Camera, Microphone, Tracking, and Analytics Tools

• Camera: only used when you actively choose "Take photo" in Ask Toni (see Section 6); the operating system asks for permission on first use
• Microphone: not used or requested by the app
• Tracking/analytics tools: we do not use analytics or tracking services such as Firebase Analytics, Firebase Crashlytics, Google Analytics, Meta/Facebook SDK, Mixpanel, or Amplitude
• Cookies: as a native mobile application, the app does not use cookies

14. All Service Providers at a Glance

15. International Data Transfers

Some of the above providers (Google, OpenAI, Perplexity, RevenueCat, Resend) are based in or operate servers in the USA, a third country under the GDPR. Our backend provider Supabase is based in Singapore and uses sub-processors including in the USA; your data is stored in the EU (Frankfurt). Transfers of personal data there are based on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and/or, where the respective provider is certified, an adequacy decision under the EU-US Data Privacy Framework. You can check the current certification status of each provider on their respective website.

16. Retention Period and Statutory Retention Obligations

Your data is generally stored as long as your account exists. Upon account deletion, all personal data is removed immediately and irrevocably (see Section 18).

Exempt from this are data we must retain beyond account deletion due to statutory retention obligations (e.g., German tax and commercial law requirements under § 147 AO, § 257 HGB for billing-relevant purchase records, typically 6–10 years). Such data is stored under access restriction solely for this purpose and is not otherwise processed.

17. Data Security

All data transfers between the app and our servers are encrypted (TLS). Access to your data in our database is technically restricted to your own account via row-level access controls (Row Level Security).

18. Account and Data Deletion

You can permanently delete your account at any time directly in the app under Settings → Delete Account & Data. This removes all data linked to your account: vehicles, cost data, maintenance appointments, chat history, error code history, photos, and profile data.

If you have already uninstalled the app, you can also request deletion here: Request account deletion online (www.simplynext.de/en/apps/wefixit/konto-loeschen)

19. Minors

The app is not specifically directed at children in content or function. Users under 16 should only use the app with the consent of a legal guardian.

20. Changes to This Policy

We update this privacy policy whenever our data processing, the service providers used, or the legal situation changes. The current version is always available at this URL and within the app.

21. Contact

For privacy-related questions, reach us at info@simplynext.de or by phone at +49 174 3389049.