How it works What we fix Sustainability Journal Become a fixer

Privacy notice.

What we hold about you, why we hold it, who else sees it, and how to make us stop.

Last updated 19 September 2026.

Who is responsible

Qfix is the data controller for everything described here — we decide what is collected and why. The tailor who repairs your garment is a separate controller for what they do with your order once it reaches them.

What we collect

Contact details — your name, email address and phone number, as you typed them at checkout, plus the delivery address and any company details if you gave them.
Your orders — the garments, the repairs booked, the prices, the shop, the status and the dates.
Photographs — the pictures you upload of your garments, any markup or notes you draw on them, and what our automated reading made of them.
Account activity — when you signed in, and the sign-in links we issued (stored as a one-way hash, never as a usable link).
Technical data — IP address, browser and pages visited, through the analytics described below.

What we collect

Contact details — your name, email address and phone number, as you typed them at checkout, plus the delivery address and any company details if you gave them.
Your orders — the garments, the repairs booked, the prices, the shop, the status and the dates.
Photographs — the pictures you upload of your garments, any markup or notes you draw on them, and what our automated reading made of them.
Account activity — when you signed in, and the sign-in links we issued (stored as a one-way hash, never as a usable link).
Technical data — IP address, browser and pages visited, through the analytics described below.

Why, and on what legal basis

To arrange and carry out your repair — because we need to, in order to perform the contract you entered into. Without your contact details and your garment's details there is no repair to arrange.
To keep your account and show you your orders — performance of the contract.
To run and improve the platform, and to keep it secure — our legitimate interest in a service that works, balanced against your interest in not being over-measured.
To send you offers and the mending list — only with your consent, which you can withdraw at any time from your account or from any email we send.
To keep accounting records — because Swedish law requires it.

Why, and on what legal basis

To arrange and carry out your repair — because we need to, in order to perform the contract you entered into. Without your contact details and your garment's details there is no repair to arrange.
To keep your account and show you your orders — performance of the contract.
To run and improve the platform, and to keep it secure — our legitimate interest in a service that works, balanced against your interest in not being over-measured.
To send you offers and the mending list — only with your consent, which you can withdraw at any time from your account or from any email we send.
To keep accounting records — because Swedish law requires it.

Your photographs, and the model that reads them

When you upload a photograph of a garment, a copy is sent to a third-party AI provider to suggest what the garment is, what it is made of and what repairs it might need. Today that provider is Google (Gemini). The image and a short instruction go out; a structured answer comes back.

Nothing is decided by that answer. It fills in a form you then correct and confirm, so there is no automated decision-making with legal or similarly significant effects on you within the meaning of Article 22 GDPR.

We keep the model's raw answer alongside the photograph so we can tell whether the detection is getting better or worse over time. Your original upload is never altered — markup you draw is stored as a separate document and rendered onto a copy.

If you would rather no model read your photographs, book without uploading any: the flow asks you what the garment is instead, and works fine that way.

Your photographs, and the model that reads them

If you would rather no model read your photographs, book without uploading any: the flow asks you what the garment is instead, and works fine that way.

Who else sees your data

The tailor you choose. They receive your name, contact details, the garment details and your photographs — they cannot do the work otherwise. A shop that has only been offered your job sees the garment and not you, until it accepts.
Our service providers, acting on our instructions under a data processing agreement: hosting and storage, email delivery, and the AI provider described above.
Payment providers, when you pay. Card details go to them and never reach us.
Authorities, where the law requires it.

We do not sell your data. We never have.

Who else sees your data

The tailor you choose. They receive your name, contact details, the garment details and your photographs — they cannot do the work otherwise. A shop that has only been offered your job sees the garment and not you, until it accepts.
Our service providers, acting on our instructions under a data processing agreement: hosting and storage, email delivery, and the AI provider described above.
Payment providers, when you pay. Card details go to them and never reach us.
Authorities, where the law requires it.

We do not sell your data. We never have.

Where your data is

Our servers and storage are in the EU. Some providers — the AI provider above, and Google's analytics and advertising products — may process data outside the EU/EEA. Where they do, the transfer rests on the European Commission's standard contractual clauses or on an adequacy decision.

How long we keep it

Orders and the photographs attached to them — for as long as your account exists, and at least as long as any claim about the repair could still be made.
Accounting records — seven years, as Swedish bookkeeping law requires.
Sign-in links — minutes. They expire shortly after being issued and are deleted after that.
Analytics — according to the retention set in the tools, and no longer than 26 months.

Ask us to delete your account and we delete what we are not required to keep, and tell you plainly what is left and why.

How long we keep it

Orders and the photographs attached to them — for as long as your account exists, and at least as long as any claim about the repair could still be made.
Accounting records — seven years, as Swedish bookkeeping law requires.
Sign-in links — minutes. They expire shortly after being issued and are deleted after that.
Analytics — according to the retention set in the tools, and no longer than 26 months.

Ask us to delete your account and we delete what we are not required to keep, and tell you plainly what is left and why.

Cookies

Necessary cookies keep you signed in, keep the site secure and remember your language. Analytics and marketing cookies — Google Analytics and Google Ads — only run if you agree to them in the cookie banner. You can change that choice at any time through Cookie settings in the footer.

Your rights

Under the GDPR you can ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, and ask for your data in a portable format. Where we rely on consent you can withdraw it at any time; where we rely on legitimate interest you can object.

Write to privacy@qfix.se. If you are not happy with how we handle it, you can complain to the Swedish Authority for Privacy Protection, IMY (imy.se).

Your rights

Write to privacy@qfix.se. If you are not happy with how we handle it, you can complain to the Swedish Authority for Privacy Protection, IMY (imy.se).

Changes to this notice

We update this notice as the service changes. The date at the top says when it last changed, and a change that materially affects you will be told to you directly rather than left here to be discovered.

Asking us about your data

Write to privacy@qfix.se. We answer data requests within one month, and usually a great deal sooner.