Privacy Policy

1. Data Controller and Data Protection Officer

PixPort acts as the data controller for the personal data you provide when using the Service. We are responsible for determining the purposes and means of processing your personal data in accordance with applicable data protection laws.

For GDPR-related inquiries, you may contact our Data Protection Officer (DPO) at: dpo@pixport.tv. For all other privacy matters, contact: privacy@pixport.tv.

If you are a California resident, the section titled "California Privacy Rights (CCPA/CPRA)" below provides additional information about your specific rights.

2. Personal Data We Collect

We collect the following categories of personal data:

1. Account Data: When you register, we collect your email address, username, display name, profile picture, and identity information provided through third-party authentication (Google OAuth, GitHub OAuth).
2. Usage Data: We automatically collect device information (device type, operating system, browser version, screen resolution), network information (IP address), log data (access time, pages visited, actions taken, crash reports), and the content you input and receive when interacting with AI models.
3. Transaction Data: When you purchase paid services, we collect order information (order number, product name, amount, timestamp) and receive transaction status from payment processors. We never access your full payment card details or third-party payment account passwords.
4. Cookies and Similar Technologies: We use cookies, local storage, and session storage to maintain your login session, save preferences, and analyze usage. See the "Cookies" section below.

3. Lawful Basis for Processing (GDPR)

Under Article 6 of the GDPR, we process your personal data on the following lawful bases:

• Consent (Art. 6(1)(a)): For non-essential cookies, marketing communications, and other processing activities where we ask for your consent. You may withdraw consent at any time.
• Contract Performance (Art. 6(1)(b)): For processing necessary to provide the Service you requested, including account creation, AI content generation, and order fulfillment.
• Legal Obligation (Art. 6(1)(c)): For processing required to comply with applicable laws, such as tax record retention and responding to lawful government requests.
• Legitimate Interests (Art. 6(1)(f)): For processing that is necessary for our legitimate business interests, such as fraud prevention, security monitoring, and service improvement, provided such interests are not overridden by your rights and freedoms.
• Vital Interests (Art. 6(1)(d)): If necessary to protect your or another person's vital interests in an emergency.

4. How We Use Your Personal Data

We process your personal data for the following purposes:

• Providing account registration, authentication, and core Service functionality;
• Processing your AI content generation requests, returning results, and maintaining your history;
• Processing payments, granting entitlements, and providing billing and usage records;
• Ensuring account and system security, detecting and preventing fraud, abuse, and attacks;
• Troubleshooting, improving system performance, and enhancing features and user experience;
• Sending service notifications, security alerts, and essential announcements;
• With your explicit opt-in consent, sending marketing communications and personalized recommendations;
• Complying with legal obligations and responding to lawful requests from authorities.

We will not use your personal data for purposes incompatible with those for which it was originally collected. If we intend to process data for a new purpose, we will provide you with notice and obtain consent where required.

5. Data Sharing and Recipients

We may share your personal data with the following categories of recipients:

1. Service Providers (Processors): Cloud hosting providers, email and SMS service providers, payment processors, and AI model API providers. These processors act on our behalf under written agreements that include appropriate data protection clauses, and may only process data as instructed by us.
2. Legal Authorities: Where required by law, court order, or lawful government request, we may disclose personal data to law enforcement, regulatory, or judicial authorities.
3. Business Transfers: In connection with a merger, acquisition, reorganization, or sale of assets, personal data may be transferred as part of the transaction. We will notify you before your data is transferred or becomes subject to a different privacy policy.
4. Safety and Rights Protection: To protect the rights, property, or safety of our users, the public, or ourselves, as permitted by law.

We do not sell your personal data to any third party. Under the CCPA, "sell" includes sharing for cross-context behavioral advertising, and we do not engage in such practices.

6. International Data Transfers

PixPort operates globally, and your personal data may be processed in countries outside your country of residence, including the United States, member states of the European Union, the United Kingdom, and other jurisdictions. These countries may have different data protection standards than your country of residence.

• For transfers of personal data from the EU/EEA or UK to third countries, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission, or other transfer mechanisms recognized under applicable law;
• When relying on your explicit consent for international transfers, you may withdraw that consent at any time, though this may affect your ability to use certain Service features;
• If you use Google or GitHub login, your authentication data will be processed by those providers in accordance with their own privacy policies and the laws of their operating jurisdictions.

You may request a copy of the safeguards we have put in place for international transfers by contacting us at privacy@pixport.tv.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including for legal, accounting, or reporting requirements:

• Account data: Retained until you delete your account. After deletion, we will erase your data within 30 days, except where retention is required by law;
• Transaction records: Retained for the period required by applicable tax and commercial laws (typically 3–7 years depending on jurisdiction);
• Log data: Retained for up to 6 months, unless a longer period is required for security or legal purposes;
• AI-generated content: Retained until you delete it or delete your account, except for content you have exported or shared.

When data is no longer needed, we will either delete it or anonymize it so that it can no longer be used to identify you.

8. Your Data Protection Rights (GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights under the GDPR:

1. Right of Access (Art. 15): You may request access to your personal data and information about how we process it.
2. Right to Rectification (Art. 16): You may request correction of inaccurate or incomplete personal data.
3. Right to Erasure / Right to be Forgotten (Art. 17): You may request deletion of your personal data, subject to certain exceptions (e.g., legal retention obligations).
4. Right to Restriction of Processing (Art. 18): You may request that we limit processing of your personal data in certain circumstances.
5. Right to Data Portability (Art. 20): You may request a copy of your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.
6. Right to Object (Art. 21): You may object to processing based on legitimate interests or for direct marketing.
7. Right to Withdraw Consent (Art. 7(3)): Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
8. Rights Related to Automated Decision-Making (Art. 22): You have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, and to request human intervention.

To exercise these rights, contact us at privacy@pixport.tv. We will respond within one month of receiving your request (extendable by two further months for complex requests, in which case we will inform you of the extension within the first month).

9. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

1. Right to Know: You may request disclosure of: (a) the categories of personal information we collect; (b) the specific pieces of personal information we hold about you; (c) the categories of sources; (d) the business or commercial purpose for collecting; and (e) the categories of third parties to whom we disclose.
2. Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
3. Right to Correct: You may request correction of inaccurate personal information.
4. Right to Opt-Out of Sale or Sharing: We do not sell or share your personal information for cross-context behavioral advertising. If our practices change, we will provide a clear "Do Not Sell or Share My Personal Information" link.
5. Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information (as defined by CPRA) for purposes other than as necessary to provide the Service.
6. Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

To exercise your California privacy rights, submit a verifiable consumer request by emailing privacy@pixport.tv. We will verify your identity before processing your request and respond within 45 days (extendable by an additional 45 days where necessary, with notice to you).

Shine the Light: California Civil Code Section 1798.83 permits California residents to request information about our disclosures of personal information to third parties for their direct marketing purposes. We do not disclose personal information for such purposes.

10. Cookies and Tracking Technologies

We use cookies and similar technologies (local storage, session storage) for the following purposes:

• Strictly Necessary: Login session management, security, and fraud prevention. These are essential and cannot be disabled.
• Functional: Remembering your preferences (theme, language, canvas settings).
• Analytics: Measuring traffic and usage patterns to improve the Service.
• Marketing (with consent): Personalized communications, only when you have opted in.

Where required by law (e.g., under the ePrivacy Directive in the EU/UK), we will obtain your consent before placing non-essential cookies. You can manage or withdraw cookie consent at any time through our cookie banner or your browser settings. Disabling cookies may affect the functionality of the Service.

11. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• HTTPS/TLS encryption for data in transit;
• Encryption and one-way hashing for sensitive data at rest (passwords, payment credentials);
• Role-based access controls limiting access to personal data on a need-to-know basis;
• Security audit logging and anomaly detection;
• Regular security assessments, penetration testing, and vulnerability remediation;
• Incident response plans and data backup procedures;
• Staff training on data protection and information security.

Despite our efforts, no system is 100% secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of the breach, as required by Article 33 of the GDPR, and will communicate the breach to you without undue delay where the risk is high, as required by Article 34.

12. Children's Privacy

The Service is not directed to children under 13 years of age (or the equivalent minimum age in the relevant jurisdiction, such as 16 in certain EU member states). We do not knowingly collect personal data from children under this age threshold.

If you believe that we have collected personal data from a child without parental consent, please contact us at privacy@pixport.tv, and we will take steps to delete such information promptly.

In jurisdictions where the age of digital consent is higher (e.g., 16 in some EU member states under Article 8 of the GDPR), we will apply the higher threshold for consent-based processing.

13. Third-Party Services

The Service integrates the following third-party services. When you use these features, your data will be processed by the respective third party under its own privacy policy:

• Google OAuth: Processes authentication data when you sign in with Google (Google Privacy Policy);
• GitHub OAuth: Processes authentication data when you sign in with GitHub (GitHub Privacy Statement);
• AI Model Providers: When you use AI generation features, your input and parameters are transmitted to the respective model API provider for processing under their privacy policy;
• Payment Processors: Transaction data is handled by payment providers; we only receive transaction status and order results.

We are not responsible for the privacy practices of these third parties and encourage you to review their policies.

14. Privacy Policy Updates

We may update this Privacy Policy to reflect changes in our practices, legal requirements, or Service features. We will post the updated policy on this page and update the "Last updated" date at the top.

For material changes (such as new categories of data collected, new processing purposes, or changes to your rights), we will provide prominent notice within the Service or via email. If you continue to use the Service after the effective date, you are deemed to accept the updated policy. If you do not agree, you may stop using the Service and delete your account.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

• Email (General Privacy): privacy@pixport.tv
• Email (GDPR / DPO): dpo@pixport.tv
• In-app: Use the "Feedback" or "Help Center" feature within the Service.

We will respond to your request within the timeframes specified by applicable law (generally within 30 days, extendable as permitted by law).