Last updated: October 18, 2026
1. Who we are
HomeFixPaid (homefixpaid.com) is run by Bast Arts d.o.o., Ljubljana, Slovenia. We decide how the information described here is used, so under EU law we are the "data controller". Contact us at [email protected]. We have not appointed a data protection officer, because the law doesn't require one for a site like ours.
2. The short version
- The report form never asks for your name or email address.
- We don't use analytics cookies, advertising cookies, or tracking tools.
- Amounts you type into the estimate checker stay in your browser, unless you choose to send them as a report.
- Homeowner reports are saved without your IP address or any device ID.
- We don't sell your information or share it for advertising.
- You never have to give us any information. Sending a report or an email is your choice.
3. Information we handle
3.1 Server and security logs
When you open a page, your browser sends standard technical information: your IP address, the date and time, the page you asked for, your browser type, and the page that sent you here. Our hosting provider and Cloudflare record this in logs to deliver pages and keep the site safe. We don't use these logs to identify visitors or build profiles, except to stop attacks or abuse. These logs are kept on our hosting account for 60 days, then deleted automatically. Cloudflare keeps security records, which can include your IP address, for up to about 31 days.
3.2 Homeowner reports
If you send a report, we save what you enter, the city of the page you sent it from, the date you sent it, and our own review notes, such as "unusual amount" or "possible duplicate":
- your estimates (up to 4) and your final bill, if you have one; the job, the year, and the house type;
- any optional details you choose: roof covering, roof area, whether the deck was replaced, number of stories, neighborhood, and whether it was an insurance claim.
We don't save your IP address or any device ID with a report, and the form has no free-text box. While your report is being sent, your IP address passes through the security checks in 3.1 and 3.3, but the saved report contains nothing that identifies you. We review every report by hand. Reports waiting for review stay until we review them. Approved full-replacement reports appear on the city page, marked "reported by the homeowner". We publish each amount, marked as an estimate or a final bill, with the job, the year of the job and any details you gave: roof covering, roof area, house type, stories, deck work and insurance claim. Until a city has 10 reports, the list on the page shows only the amount, whether it is an estimate or a final bill, the job, the roof covering and the year. The other details are already in the page's code, where anyone can read them. We never show your neighborhood or the date you sent the report. Approved reports for other jobs (recover or repair) are kept but not shown for now. We delete rejected reports within 7 days of review. Approved reports stay as long as they are published.
3.3 Spam protection on the report form
The report form uses Cloudflare Turnstile to stop automated spam. On city pages, Turnstile starts when the report form comes close to your screen, often as soon as the page opens, even if you don't send a report. Turnstile checks technical signals from your browser, such as your IP address and browser type, to tell people from bots. Cloudflare says it uses these signals only to detect bots, not to identify or target you. Cloudflare also uses these signals for its own purpose, to improve its bot detection. For that use, Cloudflare decides how the data is handled. See Cloudflare's Turnstile Privacy Addendum.
3.4 The estimate checker and city search
Amounts you type into "Where does your estimate land?" and city names you type into "Find your city" are handled in your browser. They are not sent to us and not saved, unless you choose to send an amount as a homeowner report (see 3.2).
3.5 Emails
If you email us, we receive your email address and whatever you write. We use it only to answer you or to handle your request, for example to fix an error, remove information, or answer a privacy request. We keep your email until your matter is resolved, and no longer than 12 months, unless the law requires us to keep it longer.
3.6 Public building-permit records
Part of our cost numbers come from building permits that U.S. cities publish as open data. These records can include street addresses, names of owners or contractors, and permit numbers. In the data we work with, we remove names and street addresses. Where we need to spot repeat permits for the same property, we replace the parcel number with a scrambled code. On the site we show only totals and permit details such as the year, the roof covering, the roof size and the permit value. We never show addresses, names, parcel numbers, permit numbers or exact dates. We keep the original downloads offline only as a record of where our numbers come from, for as long as our pages use numbers based on them, and we never publish them. If you think a permit on our site is about your home and you want it removed, email us and we will remove it. Our survey numbers come from the U.S. Census Bureau's American Housing Survey, which publishes only combined numbers and nothing about individual households.
3.7 Search statistics
We use Google Search Console and Bing Webmaster Tools. They show us totals: how often our pages appear in Google and Bing search results and how many people click on them. They don't run any code in your browser and don't tell us who you are.
5. Why we use this information (legal bases under the GDPR)
- Server logs, Cloudflare and Turnstile: we need them to run the site safely. In legal terms, this is our "legitimate interest" (GDPR Article 6(1)(f)).
- Public permit records: our legitimate interest in showing what home repairs cost, based on public records (Article 6(1)(f)).
- Emails: our legitimate interest in answering you (Article 6(1)(f)). For privacy requests: our legal obligation (Article 6(1)(c)).
- Homeowner reports: we don't ask for your name or contact details, and we don't think a report can identify you. In case one could, for example when compared with other public records, we rely on our legitimate interest in showing what home repairs really cost (Article 6(1)(f) GDPR). Sending a report is your choice.
6. Who handles information for us
- Avant.Si d.o.o. (NEOSERV), Šenčur, Slovenia: web hosting and email. Data is stored in the EU.
- Cloudflare, Inc., USA: page delivery, security and Turnstile. Cloudflare may process data in the United States and other countries. Transfers to the U.S. rely on the EU-U.S. Data Privacy Framework. Other transfers, or all transfers if that framework stops applying, use the EU Standard Contractual Clauses. Both are EU-approved rules for sending data outside the EU. You can read them in Cloudflare's data processing terms.
We don't sell your information or share it for advertising. We don't let a computer make decisions about you.
7. Your rights
Everyone
Because we are based in the EU, the GDPR protects you wherever you live. You can ask us for a copy of your personal information, and you can ask us to correct it, delete it, or limit how we use it.
Right to object
Where we rely on our legitimate interest, you can object at any time. We will then stop, unless we have strong reasons that outweigh yours.
U.S. residents
Some U.S. state laws give you the right to know, access, correct and delete personal information, and to opt out of its sale, sharing or use for targeted advertising. We give these rights to everyone. We don't sell or share personal information or use it for targeted advertising. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out.
Reports
Because we don't store anything that links a report to you, we usually can't tell which report is yours. If you want a report removed, email us the city, the job, the amount and the year, and we will remove matching reports.
How to ask
Email [email protected]. We answer within one month. If a request is complex, we may need up to two more months, and we will tell you within the first month. Using your rights will never change how the site works for you.
Complaints
You can complain to the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, Slovenia, www.ip-rs.si. You can also complain to the data protection authority in the EU country where you live or work.
8. Children
This site is for adults planning home repairs. It is not directed at children, and we don't knowingly collect personal information from anyone under 16.
9. Security
The site uses HTTPS. Only our team has a login to the admin area where reports are reviewed.
10. Changes to this policy
When we change this policy, we post the new version on this page with a new "Last updated" date. If a change is important, for example adding analytics or advertising, we will say so at the top of this page.
11. Contact
Bast Arts d.o.o., Ljubljana, Slovenia · [email protected]