Privacy policy

Data controller

PIXL FACTORY SAS, 61 RUE de Lyon, 75012 Paris - FRANCE, is the controller of the processing described here, related to this website and to the management of customer accounts. Contact: [email protected]. For the content and data customers manage in pixlova, the publisher acts as a processor: see the data processing agreement.

Data processed, purposes and legal bases

• Account and members (name, email address, role, organization): account creation and security, access management. Legal basis: performance of the contract.
• Billing (billing details, plan, payment history): subscription management and accounting obligations. Legal bases: performance of the contract and legal obligation. Card data is processed by Stripe and never stored by pixlova.
• Service emails (invitations, password reset, alerts, billing): operation of the service. Legal basis: performance of the contract.
• Technical and audit logs (IP address, date, action performed): security of the service and traceability of sensitive actions. Legal basis: legitimate interest.
• Exchanges with support: answering requests. Legal basis: legitimate interest or performance of the contract.

Cookies

This website sets no cookies. Its traffic is measured with Umami, a tool installed by the publisher on its own server: pages viewed, referring website, device and browser type, approximate country, and clicks on the sign-up, log-in and language buttons. The IP address is not stored, no visitor is tracked from one website to another and nothing is measured if the browser asks not to be tracked (“Do Not Track”). These statistics are used solely to improve the website. Legal basis: legitimate interest.

The dashboard only uses the cookies strictly necessary for signing in, which do not require consent.

Recipients and processors

The data is accessible only to the publisher’s authorized staff and to the following processors, within the limits of their assignment:

• OVH SAS (France): hosting of the website, the service and the data, in data centers located in France.
• Cloudflare, Inc. (United States): network, protection and traffic security.
• Stripe Payments Europe, Ltd. (Ireland): payment and invoicing.
• Brevo (Sendinblue SAS, France): sending of service emails.

No data is sold or used for advertising purposes.

Transfers outside the European Union

Cloudflare and Stripe may process some data in the United States. These transfers are governed by the EU–US Data Privacy Framework, to which these companies adhere, and by the European Commission’s standard contractual clauses.

Retention periods

• Account data: for the duration of the contractual relationship, then erased within thirty (30) days of the account’s deletion.
• Accounting records and invoices: ten (10) years, in accordance with article L. 123-22 of the French Commercial Code.
• Technical and audit logs: twelve (12) months.
• Exchanges with support: three (3) years after the last contact.

Security

Exchanges are encrypted (HTTPS), passwords are stored in hashed form, access is controlled by role and two-factor authentication is available. Each organization’s data is isolated and backed up regularly.

Your rights

You have the right to access, rectify, erase, restrict, object to and port your data, as well as the right to set guidelines on what happens to it after your death. Write to [email protected]; you will receive an answer within one month. You may also lodge a complaint with the CNIL, the French data protection authority (cnil.fr).