1. Who We Are
PIXADO ("we", "us", or "our") is based in Montréal, Québec, Canada, and is the controller of your personal data when you use our website and AI Studio. This Privacy Policy explains what we collect, why, how we use it, and your rights under Canadian privacy laws (PIPEDA and Québec's Law 25), the California Consumer Privacy Act (CCPA), the EU/UK GDPR, and other similar laws.
Contact: contact@pixado.ai
2. Data We Collect
2.1 Account Data
When you sign up, we collect: full name, email address, password (hashed), preferred language, and (optionally) a profile picture.
2.2 Billing Data
Handled by Stripe on our behalf. We store only the billing email, country, last four digits of your card, and Stripe customer ID. Full card numbers are never stored on our servers.
2.3 Content Data
Images, prompts, face references, and thumbnails you upload or generate. We store these in encrypted cloud storage (AWS S3, EU region) for as long as your account is active.
2.4 Usage Data
Pages visited, features used, generation history, click events, and device/browser type. Used for product improvement and security.
2.5 Technical Data
IP address, user agent, language, time zone, and approximate location (country/city level only).
3. How We Use Your Data
| Purpose | Legal Basis |
|---|---|
| Provide the Service (account, generation, billing) | Contract performance |
| Process payments via Stripe | Contract performance |
| Send transactional emails (receipts, password resets) | Contract performance |
| Send product updates & marketing emails | Consent (opt-in, unsubscribe anytime) |
| Analyze usage to improve the platform | Legitimate interest |
| Detect fraud, abuse, and security threats | Legitimate interest / Legal obligation |
| Comply with tax and accounting laws | Legal obligation |
4. AI Processing
Your prompts and uploaded images are processed by our AI models (and sub-processors listed below) to generate thumbnails. We do not use your private content to train our public models without explicit consent. Aggregated, anonymized usage statistics may be used to improve the Service.
5. Sub-Processors
We share data with the following service providers, all of which are bound by data processing agreements:
- Stripe (payments) — Ireland / USA
- Amazon Web Services (AWS) (hosting, storage) — EU (Frankfurt)
- Google Analytics 4 (analytics, anonymized IP) — USA
- Crisp (live chat support) — France
- Postmark / Resend (transactional email delivery) — USA
- OpenAI / Anthropic / Replicate (AI model inference, where applicable) — USA
6. International Transfers
Pixado is based in Canada, and certain processors listed above are located in the United States, the European Union, or other jurisdictions. When personal data is transferred across borders, we rely on appropriate safeguards — including contractual commitments, Standard Contractual Clauses where applicable, and processor compliance with recognized privacy frameworks — to ensure your data remains protected to a comparable standard.
7. Data Retention
- Account data: kept while your account is active, then deleted 30 days after closure.
- Generated thumbnails: retained while subscribed; deleted 90 days after subscription ends unless you export them.
- Billing records: retained 10 years (legal obligation, accounting law).
- Support tickets: 3 years after resolution.
8. Your Rights
Under PIPEDA, Québec Law 25, the GDPR, the CCPA, and similar laws, you may have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate or incomplete data.
- Erase your data ("right to be forgotten").
- Restrict or object to processing.
- Port your data to another provider.
- Withdraw consent at any time (for marketing).
- Lodge a complaint with a supervisory authority — for example, the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, or your local data protection authority.
To exercise any right, email contact@pixado.ai. We will respond within 30 days.
9. Security
We use industry-standard measures including TLS 1.3 encryption in transit, AES-256 encryption at rest, regular security audits, principle-of-least-privilege access controls, and automated backups. No system is 100% secure — please use a strong, unique password.
10. Children
PIXADO is not intended for children under 16. We do not knowingly collect data from children. If you believe a child has provided us data, contact contact@pixado.ai for immediate deletion.
11. Changes to this Policy
Material changes will be notified by email or via a website banner at least 14 days before they take effect. The "Last updated" date at the top of this page indicates the latest revision.
12. Contact
Questions, requests, or complaints? Contact contact@pixado.ai.