Pixeria Privacy Policy

Effective date: 28 October 2026

This policy explains what personal data we process in Pixeria, why, who we share it with and what rights you have. It provides the information required by Articles 13 and 14 of the GDPR (Regulation (EU) 2016/679).

1. Controller

The controller is Marcin Frątczak, running a sole proprietorship under the business name Marcin Frątczak Framar, ul. Warszawska 40/2A, 40-008 Katowice, Poland, VAT No.: PL6252163911 (“we”).

For anything related to personal data, write to support@pixeria.io. We have not appointed a data protection officer.

2. Who this policy covers

• Photographers - people who have created a Pixeria account (and their collaborators with access to the account). We are the controller of this data.
• Visitors to the Pixeria application pages. We are the controller of this data.
• Photographers' clients - people who view photographers' sites and galleries, choose photos or place orders. The controller of their data is the photographer who runs the site or gallery. We process this data on the photographer's behalf under the data processing agreement in the Terms of Service (§ 15). Please contact the photographer first with questions about this data - if you write to us, we will forward your request to the photographer and help them handle it. The exception is the data described in points 4.4 and 4.5 (security and statistics), which we process on our own behalf.

3. What data we process

Photographer account data: email address, name (by default the part of the email address before “@” or the name from the Google account), account identifier in the login service, sign-in method, whether the Terms were accepted, preferred email language, country.

Site and business data: site name, pixeria.io subdomain and own domains, settings, price lists, payment instructions (e.g. a bank account number given to clients), site and gallery content.

Plan data: plan, billing period, currency, trial and paid-period dates, subscription status, and the customer and subscription identifiers assigned by Dodo Payments. We do not receive card details - they go directly to Dodo Payments.

Photos and their metadata, including EXIF data stored in files (e.g. date taken, camera model and - if the camera recorded it - location).

Photographers' clients' data (processed on the photographer's behalf): email address, name, phone number, delivery address, photo selections, favourites, comments, orders and payment status.

Technical data: IP address, browser and device type, pages visited, request dates and times, error information, and information about undelivered emails and spam complaints.

Correspondence: the content of support requests and messages sent to us.

4. Purposes and legal bases

1. Creating an account and providing the Service (sign-in, site, galleries, photo storage, orders, account emails such as confirmation links, sign-in links and order notifications) - Article 6(1)(b) GDPR (contract).
2. Handling requests and complaints - Article 6(1)(b) GDPR, or Article 6(1)(f) GDPR (our legitimate interest in replying) where the request is not related to the contract.
3. Demonstrating acceptance of the Terms and establishing or defending legal claims - Article 6(1)(f) GDPR.
4. Service security - abuse prevention (e.g. limits on sign-in attempts and emails sent, counted per IP address and email), error detection and protecting our email sender reputation - Article 6(1)(f) GDPR.
5. Usage statistics (PostHog, see section 5) - Article 6(1)(f) GDPR (our legitimate interest in improving the Service). We collect statistics only in the photographer app (app.pixeria.io), not on photographers’ sites and galleries.
6. Legal obligations, e.g. tax and accounting related to paid plans - Article 6(1)(c) GDPR.

Providing an email address is required to create an account. Other data is optional, but some features may not work without it. We do not make decisions based solely on automated processing that produce legal effects for you.

5. Who we share data with

We use the providers below. They process data on our behalf (and photographers' clients' data as sub-processors), only as needed to provide their service.

Data may also be received by:

• the photographer - data a client provides in the photographer's gallery or order,
• Dodo Payments - the seller of paid plans (merchant of record): at purchase we pass on the photographer's email address and name, and the photographer gives any other data (e.g. billing address, card details) directly to Dodo Payments. Dodo Payments processes it as a separate controller, under its own privacy policy made available during checkout,
• Google (Google Fonts) - your browser's IP address, when a site or gallery template loads fonts from Google servers,
• public authorities - only where the law requires it,
• our advisers (e.g. accountants, lawyers) - as needed for their work and under confidentiality obligations.

Transfers outside the EEA. Some providers (Google, Cloudflare, Prisma, PostHog) are US companies or have US affiliates. Transfers to the USA are based on the European Commission adequacy decision (EU-US Data Privacy Framework) where the provider participates in it, or on standard contractual clauses approved by the Commission. You can request a copy of these safeguards at the address in section 1.

6. How long we keep data

• Account and site data and photos - for as long as you use the Service. After an account is deleted, the site, domains and galleries become unavailable immediately and the data is deleted within 90 days. Backups are overwritten within a further 30 days.
• Photographers' clients' data - until the photographer deletes it (e.g. with a gallery or order) or deletes their account, and then as above.
• Data needed to demonstrate acceptance of the Terms and to defend against claims - until the relevant limitation periods expire.
• Accounting records - 5 years from the end of the year in which the tax payment deadline passed.
• Server logs and security data - up to 90 days.
• Information about undelivered emails and spam complaints - as long as needed to protect our sender address, no longer than 2 years.
• Statistics in PostHog - up to 12 months.
• Correspondence - up to 2 years after the matter is closed.

7. Your rights

You have the right to:

• access your data and receive a copy (Article 15 GDPR),
• rectify your data (Article 16 GDPR),
• have your data erased (Article 17 GDPR) - you can delete your account yourself in the settings,
• restrict processing (Article 18 GDPR),
• data portability for data you provided to us (Article 20 GDPR),
• object to processing based on our legitimate interest, including statistics (Article 21 GDPR),
• lodge a complaint with the President of the Polish Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) or with the supervisory authority in your country.

To exercise your rights, write to support@pixeria.io. We will reply within one month. We may ask you to confirm your identity, e.g. by writing from the email address linked to your account.

8. Security

Connections to the Service are encrypted (HTTPS). Passwords are stored by the login service only as cryptographic hashes - we do not know them. Your sign-in session is signed and bound to the domain you sign in on. Access to data is limited to the people and systems that need it.

9. Cookies and browser storage

We use cookies and browser storage (localStorage, IndexedDB). Most of them are necessary for the Service to work - without them you cannot sign in or open a password-protected gallery. You can delete or block cookies in your browser settings, but some features will then stop working.

We also use browser storage for the Firebase sign-in state and interface settings (e.g. expanded sections, dismissed hints). PostHog statistics work without cookies and without storing anything in your browser - every visit is counted as anonymous. They record page views and basic events, and PostHog receives your IP address and browser information in the process. We do not link statistics to your email address or use them for advertising. We do not use advertising cookies.

10. Changes to this policy

We may change this policy, e.g. when a provider or the way the Service works changes. We will notify photographers of material changes by email. The current version is always available on the Privacy Policy page.

The Polish version of this policy prevails in case of discrepancies.