1. Who we are and what this Policy covers

This Privacy Policy (“Policy”) explains how Pixop ApS, CVR / VAT No. DK39188430, Sverigesgade 5, 3, 5000 Odense C, Denmark (“Pixop”, “we”, “us”, or “our”) collects, uses, and protects personal data in connection with the pixop.com website (the “Website”), your Pixop account, and our sales and marketing activities. Questions: legal@pixop.com.

2. Controller and processor roles (important)

Pixop plays two different roles depending on the data:

Website, account, and marketing data - Pixop is the controller. This Policy governs the personal data we collect about visitors, account holders, and prospects (for example, contact details, account information, and website-usage data).

Content you process through the Pixop Platform - Pixop is a processor. When you use the Pixop Platform (the “Service”) to process your video and other content, that content may contain personal data (for example, individuals appearing in the footage). We process that content only on your behalf and on your instructions, as a data processor. That processing is governed by our Data Processing Agreement (DPA), available at pixop.com/data-processing-agreement, and by the Terms of Service, not by this Policy.

3. Information we collect

3.1 Information you provide. When you create an account, make a purchase, subscribe to our newsletter, contact support, or fill in a form, we may collect: your name and contact details (such as email address); account details (such as username and user ID); and payment details (handled by our payment processor, see Section 4).

3.2 Information collected automatically. When you visit the Website, our systems may record technical information such as IP address, browser type and version, operating system, referring page, pages visited, and access times. We use this to operate and secure the Website and to understand aggregate usage. Our website analytics (Plausible) are cookieless and do not collect personal data (see Section 4).

4. Third-party services we use

We use a limited number of third parties to operate the Website and our services. Each processes personal data only as needed to perform its function and under its own privacy terms.

Amazon Web Services (AWS) - cloud infrastructure, databases, storage, media processing and telemetry for the Website and the Pixop products, including Pixop Platform / FILE, Pixop Pulse and applicable Pixop Prime deployments; primary region AWS Europe (Ireland), within the EEA.

Plausible Analytics - privacy-focused, cookieless website analytics. It does not use cookies and does not store personal data or create cross-site profiles. See plausible.io/privacy.

EmailOctopus - newsletter subscription and delivery, if you subscribe. See emailoctopus.com/legal/privacy.

Intercom - support chat and related product-usage insights; hosted in the United States. Where you supply support material through chat in connection with your use of the Platform, Intercom acts as a sub-processor and is listed on our Sub-processor List. See intercom.com/legal.

Stripe - payment processing for customers billed directly by Pixop; Stripe handles card and payment data on our behalf. See stripe.com/privacy.

Heroku (a Salesforce company) - application hosting for the legacy Pixop Platform / Pixop FILE service only (processing jobs and job metadata, user accounts, teams and organisations, billing and account records). Video files are not stored on Heroku. Not used by Pixop Prime or Pixop Pulse. See salesforce.com/company/privacy.

We do not use Google Analytics, Google Tag Manager, Meta/Facebook Pixel, or LinkedIn advertising tags.

5. How we use personal data

We use personal data to: create and manage accounts; provide and improve the Website and our services; process orders and payments; respond to enquiries and provide support; send administrative messages and, where permitted, newsletters; ensure security and prevent abuse; and comply with legal obligations.

6. Legal bases (GDPR)

Where the GDPR applies, we process personal data on one or more of the following bases: your consent; performance of a contract with you (or steps prior to a contract); compliance with a legal obligation; or our legitimate interests (for example, securing and improving the Website), balanced against your rights. Where we rely on consent, you may withdraw it at any time.

7. Sharing and disclosure

We share personal data only with the service providers listed in Section 4 (as processors acting on our behalf), and where required or permitted by law (for example, to comply with a legal request, or to protect our rights and the safety of others). In a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction. We do not sell personal data.

8. International transfers

The Website and the media-processing components of the Pixop Platform are hosted in AWS Europe (Ireland), within the EEA. Application hosting for the legacy Pixop Platform / Pixop FILE service is provided by Heroku in the United States and the European Union, and payment data is processed by our payment provider in Ireland and the United States. Our support chat provider hosts its service in the United States, so support conversations and anything supplied through them - including screenshots and other files you attach - are stored there. An EEA hosting region does not by itself mean that no personal data leaves the EEA: where a service provider, or our own personnel, process or access personal data from outside the EEA, that is a transfer and is made under an appropriate safeguard - the EU-U.S. Data Privacy Framework where the recipient is certified under it, or the EU Standard Contractual Clauses, in each case together with any necessary supplementary measures. The safeguard that applies to each of our sub-processors is stated on our Sub-processor List.

9. Retention

We retain personal data only for as long as necessary to provide our services, comply with our legal obligations, resolve disputes, and enforce our agreements, after which it is deleted or anonymised. For personal data processed through the Platform on your behalf, retention and deletion follow the DPA and the Terms of Service.

Security and audit logs. We keep audit logs of security-relevant events, such as access to and administration of our production environment, for up to 14 months. These logs may contain personal data such as identifiers, IP addresses, and timestamps. We process them as controller (see Section 2), for security, abuse prevention, incident investigation, and compliance, and not on your behalf as processor - so this period applies to them rather than the shorter periods that apply to support data under the DPA and the Terms of Service. Where you ask us to erase personal data contained in them, Article 17(3) GDPR permits us to retain them for these purposes, and we will restrict any further processing of the entries concerned rather than delete them early.

Where these logs are held in immutable or append-only storage, or where removing individual entries would compromise the integrity of the security record, we will restrict any further processing of those entries rather than delete them, and delete them when the retention period ends.

10. Your rights

Depending on your location, you may have the right to access, correct, delete, restrict, or object to the processing of your personal data; to data portability; and to withdraw consent. If you are in the EEA, you also have the right to lodge a complaint with your local Data Protection Authority. To exercise any right, contact legal@pixop.com; we may need to verify your identity before responding.

11. California privacy rights

California residents may request, once a year, information about any personal information we shared with third parties for their direct marketing, and may exercise the access and deletion rights described above. Contact us to make a request.

12. Children

The Website and our services are not directed to children. We do not knowingly collect personal data from children under 18 (or the applicable age of digital consent in your country). If you believe a child has provided us personal data, contact us and we will delete it.

13. Cookies

Our website analytics (Plausible) are cookieless, and pixop.com sets no advertising or cross-site tracking cookies. Because the Website sets nothing that requires your consent, we do not ask you for it. Your Pixop account and our support chat are on the Pixop Platform rather than on the Website, and cookies used there are described in our Cookie Policy, along with how to control cookies in your browser.

14. Security

We maintain reasonable administrative, technical, and organisational safeguards designed to protect personal data against unauthorised access, use, alteration, or disclosure, including encryption in transit, and encryption at rest where the relevant cloud service and configuration support it. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

15. Data breach

If we become aware of a personal-data breach, we will take appropriate steps to investigate and mitigate it, and will notify affected individuals and relevant authorities where required by law and without undue delay.

16. Changes to this Policy

We may update this Policy from time to time. We will post the updated Policy here with a new “Last updated” date and, where changes are material, provide additional notice. Continued use of the Website after the effective date does not by itself constitute acceptance: the updated Policy applies from the effective date stated in it.

17. Related documents and contact

This Policy sits alongside our Terms of Service, Data Processing Agreement, our Sub-processor List, and Cookie Policy. For any privacy question or request, contact legal@pixop.com.