GDPR Compliance

Last Updated: December 6, 2024

At Pixivo Limited, we are committed to protecting your personal data and complying with the General Data Protection Regulation (GDPR) and other applicable data protection laws. This page explains how we ensure your data rights are respected and how you can exercise those rights.

1. Who We Are (Data Controller)

Pixivo Limited is the data controller responsible for processing your personal data when you use our Services.

2. Lawful Basis for Processing

Under GDPR, we must have a lawful basis to process your personal data. We rely on the following legal grounds:

2.1 Contractual Necessity

Processing is necessary to perform our contract with you (providing AI generation services) when you:

• Create an account
• Subscribe to a paid plan
• Use our AI tools

2.2 Legitimate Interests

We process certain data based on our legitimate interests, such as:

• Improving our Services and user experience
• Detecting and preventing fraud
• Analyzing website performance (analytics)

2.3 Consent

For non-essential cookies and marketing communications, we obtain your explicit consent, which you can withdraw at any time.

2.4 Legal Obligations

We may process data to comply with legal requirements, such as tax laws or responding to lawful requests from authorities.

3. Your GDPR Rights

Under the GDPR, you have the following rights regarding your personal data:

4. How to Exercise Your Rights

To exercise any of your GDPR rights, please contact us using the methods below. We will respond to your request within 30 days (or as required by law).

4.1 Contact Methods

4.2 Information We May Request

To verify your identity and protect your data, we may ask for:

• Your registered email address
• Account username or name
• Additional verification information if necessary

4.3 Processing Timeline

• Standard Requests: Within 30 days of receipt
• Complex Requests: Up to 60 days (with notification of the extension)
• Urgent Requests: We will prioritize data deletion requests

5. Data We Collect

5.1 Personal Data

• Account Data: Name, email address, password (hashed)
• Payment Data: Billing information (processed by Stripe)
• Uploaded Content: Photos you upload (automatically deleted within 30 minutes)

5.2 Analytics and Tracking Data

We use the following tools to improve our Services:

• Google Analytics 4 (GA4): Website usage and performance
• Google Search Console: Search traffic analysis
• Microsoft Clarity: User behavior and session recordings
• Google Tag Manager: Tag management for analytics

Data Collected:

• IP address (anonymized where possible)
• Browser type and version
• Device information
• Pages visited and duration
• Referral sources

6. Data Retention and Deletion

6.1 Account Data Retention

• Active Accounts: Data is retained as long as your account remains active
• Inactive Accounts: Accounts inactive for over 2 years may be deleted (with prior notice)
• Deleted Accounts: Data is permanently deleted within 30 days of account deletion request

6.2 Legal Retention

In limited cases, we may retain certain data for legal or regulatory purposes, such as:

• Financial records (for tax and accounting purposes)
• Fraud prevention records
• Legal claims or disputes

7. Data Sharing and Third Parties

We DO NOT sell your personal data to third parties.

7.1 Service Providers (Data Processors)

We share data with trusted third-party processors who help us provide our Services:

Service Provider	Purpose	Data Shared
Stripe	Payment processing	Name, email, billing info
Google (GA4, Search Console)	Analytics	IP address, usage data
Microsoft Clarity	User experience analysis	Session data, interactions

All processors are contractually obligated to comply with GDPR and protect your data.

8. International Data Transfers

Pixivo Limited is based in the United Kingdom. Your data may be transferred to and processed in:

• The United Kingdom
• European Economic Area (EEA)
• United States (for analytics and payment processing)

8.1 Transfer Safeguards

When transferring data outside the UK/EEA, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs): EU-approved contracts with processors
• Adequacy Decisions: Transfers to countries with adequate data protection (e.g., UK-EU adequacy)
• Privacy Shield Replacement Mechanisms: For US-based services

9. Data Security Measures

We implement industry-standard security measures to protect your data:

• Encryption: All data transmitted over HTTPS/SSL
• Secure Storage: Encrypted databases and secure servers
• Access Controls: Role-based access for employees
• Regular Audits: Security assessments and vulnerability testing
• Automatic Deletion: Content deleted within 30 minutes

10. Cookies and Tracking

10.1 Essential Cookies

Required for website functionality (cannot be disabled):

• Session cookies for login
• Security and authentication

10.2 Analytics Cookies

Used with your consent for:

• Google Analytics 4
• Microsoft Clarity
• Google Tag Manager

Cookie Management: You can manage cookie preferences through your browser settings or our cookie consent banner.

11. Right to Lodge a Complaint

If you believe we have not complied with GDPR or your data rights have been violated, you have the right to lodge a complaint with a supervisory authority.

12. Updates to This Policy

We may update this GDPR Compliance page to reflect changes in our practices or legal requirements. We will notify you of significant changes by:

• Updating the "Last Updated" date
• Posting a notice on our website
• Sending an email notification (for material changes)

13. Contact Us

For any GDPR-related questions, requests, or concerns, please contact us:

Your privacy and data protection are our top priorities. We are committed to full GDPR compliance and transparency in all our data practices.