Privacy Policy
In short: we collect what we need to run your account, your audits and your subscription. Your data is stored with Supabase, payments are handled by Stripe, and audit content is sent to AI model providers to produce your results. We do not sell personal data, we do not use your content to train AI models, and this website sets no cookies.
1. Who is responsible for your data
[COMPANY LEGAL NAME], registered in [COUNTRY OF REGISTRATION] (company number [COMPANY REGISTRATION NUMBER]), [REGISTERED ADDRESS], is the controller of personal data processed through Pixatom. Contact us about privacy at hello@pixatom.app.
2. What we collect
| Kind of data | Examples | Where it comes from |
|---|---|---|
| Account details | Name, email address, profile picture, sign-in provider and account ID | Google or Figma when you sign in, or you |
| Audit content | Flow descriptions, answers, notes, your verdicts on gaps, brand details such as a logo, colours or website address, test results you log, and the maps, briefs and prototypes produced | You, and the service |
| Billing details | Plan, subscription status, billing period, Stripe customer ID, invoices and the last four digits and expiry of your card | Stripe |
| Usage and technical data | Audits started, prototype builds used, error logs, IP address, browser and device type, dates and times of requests | Your use of the service |
| Messages | Emails you send us and our replies | You |
We do not ask for sensitive data such as health information, and we ask you not to put personal data about other people in audit content unless you need to. Use made-up examples in flow descriptions where you can.
This website (pixatom.app) sets no cookies and uses no analytics or advertising tools. Our hosting provider records technical data such as IP addresses in server logs to deliver the site and keep it secure.
3. How we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Create and run your account, run your audits, produce briefs and prototypes, and share them when you ask | Performance of our contract with you |
| Take payment, manage your subscription, send receipts and billing messages | Performance of our contract with you |
| Keep accounting and tax records | Legal obligation |
| Keep the service secure, prevent fraud and abuse, enforce usage limits | Legitimate interests in running a safe service |
| Fix problems and improve the quality of the service, including reviewing audit results when something goes wrong or you ask for help | Legitimate interests in a working, improving product |
| Send product news, where you have agreed to receive it | Consent, which you can withdraw at any time |
We do not sell personal data, we do not share it for advertising, and we do not use your audit content to train AI models. Pixatom does not make decisions about you that have legal or similarly significant effects based only on automated processing; the AI works on the flows you describe, not on you.
4. Who processes your data for us
We use service providers who process personal data on our behalf, under contracts that require them to protect it and use it only to provide their service to us.
| Provider | What they do | Data involved |
|---|---|---|
| Supabase | Database, file storage and sign-in. Data is stored in [SUPABASE DATA REGION]. | Account details, audit content, usage data |
| Stripe | Payment processing, subscriptions, invoices and the billing portal. Stripe also processes some payment data as an independent controller, for example to prevent fraud and meet financial rules (see Stripe's privacy policy). | Billing details, email address, card details (held by Stripe only) |
| AI model providers: [AI MODEL PROVIDERS IN USE] | Run each audit step: questions, flow map, findings, the second check, the brief and the prototype. They process audit content to return results and do not use it to train their models under the terms we use them on. | Audit content |
| Vercel | Hosting for the app and this website | Technical data, and data passing through the app |
| Google, Figma | Sign-in, if you choose to sign in with them | Account details |
| [EMAIL PROVIDER] | Sending and receiving email | Email address, messages |
We may also share data if the law requires it, to protect our rights or the safety of others, or with a buyer if the business is sold, in which case this policy will continue to apply to your data.
5. International transfers
Some of these providers process data outside your country, including in the United States. Where data protection law requires it, we rely on adequacy decisions or standard contractual clauses approved by the relevant authorities, with extra safeguards where needed.
6. How long we keep it
- Account and audit content: while your account is open. If you close your account, we delete it within [DAYS TO DELETE DATA AFTER ACCOUNT CLOSURE], apart from what we must keep below. Shared brief and prototype links stop working when the audit is deleted.
- Billing records: for [YEARS BILLING RECORDS ARE KEPT], as accounting and tax law requires.
- Server logs: for up to [DAYS SERVER LOGS ARE KEPT].
- Emails with us: for as long as needed to deal with your request, and then for up to two years.
7. Your rights
Depending on where you live, you have the right to:
- access the personal data we hold about you and get a copy of it;
- correct data that is wrong;
- delete your data;
- receive your data in a portable format;
- object to, or ask us to restrict, some processing;
- withdraw consent where we rely on it;
- complain to a data protection authority. Our lead authority is [DATA PROTECTION AUTHORITY], and you can also complain to the authority where you live.
To use any of these rights, email hello@pixatom.app from the address on your account. We will reply within one month. If you live in California or another US state with a privacy law, you have similar rights to know, delete and correct your data, and we do not sell or share personal data as those laws define it.
8. Security
Data is encrypted in transit and stored with providers that encrypt it at rest. Access to production data is limited to the people who need it to run the service. Each user's audits are protected by database access rules so that only they can read them, unless they share a link. Prototypes run in a sandbox that blocks network requests. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.
9. Children
Pixatom is for business use by adults. It is not meant for anyone under 18, and we do not knowingly collect data from children.
10. Changes to this policy
We will update this policy when our practices change, and we will tell you by email or in the app before a significant change applies. The effective date at the top shows when it last changed.
11. Contact
[COMPANY LEGAL NAME]
[REGISTERED ADDRESS]
Email: hello@pixatom.app