Privacy Policy

Effective 6 August 2026

Who we are

PixelFlow is operated by Titan Ventures Ltd, a company registered in Ireland under company number 773679, with its registered office at Peace Cottage, Nicholastown, Slieverue, Co. Waterford, Ireland.

For the data described in this policy, Titan Ventures Ltd is the data Controller. You can contact us about privacy matters at support@pixelflow.so.

Data Protection Officer. Our Data Protection Officer is Emmett Cooke, who can be contacted at support@pixelflow.so or by post at the registered office above.

What this policy covers, and what it does not

This policy explains how we handle personal data where we decide why and how it is processed. That means data about our customers, prospective customers and visitors to our website.

It does not cover the end-user data our customers send through the platform. When a customer installs tracking on their own website, that customer is the Controller and we act as their Processor. That relationship is governed by our Data Processing Agreement. If you are an end user of a business that uses PixelFlow and you want to exercise your rights over that data, contact that business directly.

1. What we collect, why, and on what legal basis

Account information

  • What: Email address (required), name, company name and other business details you choose to provide.

  • Why: To create and operate your account, authenticate you, and provide the Service.

  • Legal basis: Performance of a contract (Article 6(1)(b) GDPR).

  • Retention: For the life of your account, then deleted within 30 days, except where we are required to retain it for legal or accounting purposes.

Billing information

  • What: Billing status, subscription plan, transaction history, billing address and country, and VAT number where provided. We do not store your card details. Stripe processes all payments and we receive only confirmation of charges and billing status.

  • Why: To take payment, issue invoices and meet our tax and accounting obligations.

  • Legal basis: Performance of a contract (Article 6(1)(b)) and compliance with a legal obligation (Article 6(1)(c)) for tax records.

  • Retention: 6 years, as required by Irish tax law.

Platform usage data

  • What: API logs, configuration metadata, feature usage, error logs and diagnostic data associated with your account.

  • Why: To operate and secure the platform, diagnose faults, prevent abuse and improve the product.

  • Legal basis: Legitimate interests (Article 6(1)(f)), being our interest in running a secure and functional service. We have assessed that this does not override your rights, as the data is limited to what is needed to operate the platform.

  • Retention: 12 months for detailed logs, unless retained longer for an active security or fraud investigation.

Support and communications

  • What: Support requests, email correspondence, call recordings and notes where you have agreed to them, and messages sent through our support channels.

  • Why: To resolve issues, provide support and improve the product.

  • Legal basis: Performance of a contract (Article 6(1)(b)) for support relating to your subscription, and legitimate interests (Article 6(1)(f)) for product improvement.

  • Retention: 24 months.

Website visitors

  • What: IP address, browser and device information, pages viewed and interactions on pixelflow.so.

  • Why: To understand how the website is used and to measure the effectiveness of our marketing.

  • Legal basis: Consent (Article 6(1)(a)) for any non-essential cookies and tracking, obtained through our cookie banner. Legitimate interests (Article 6(1)(f)) for strictly necessary logging such as security and abuse prevention.

  • Retention: Up to 24 months.

  • More detail: see our Cookie Notice.

Marketing

  • What: Email address, engagement data such as whether an email was opened or a link clicked, and marketing preferences.

  • Why: To send product updates, onboarding guidance and marketing communications.

  • Legal basis: Consent (Article 6(1)(a)) where required, or legitimate interests (Article 6(1)(f)) for communications to existing customers about similar services. You can withdraw consent or unsubscribe at any time using the link in any email.

  • Retention: Until you unsubscribe, then we keep a suppression record so we do not contact you again.

Trial accounts

Data from free trial accounts is collected, used and retained on the same basis as data from paying accounts.

2. How we use this information

We use personal data to operate the platform, authenticate users, process payments, provide support, monitor and improve performance, prevent fraud and abuse, communicate with you, and meet our legal obligations.

We do not sell personal data. We do not use customer or end-user data to build profiles for our own advertising purposes.

3. Automated decision-making

We do not carry out automated decision-making that produces legal or similarly significant effects concerning you, within the meaning of Article 22 GDPR.

4. Who we share it with

We share personal data with service providers who help us run the business. Each is bound by a written data processing agreement and may only process data on our instructions. These currently include:

  • Amazon Web Services for infrastructure and hosting

  • Stripe for payment processing

  • Framer for hosting our marketing website

  • PostHog for website and product analytics

  • Resend for transactional and marketing email

  • Google Workspace for support email

A current and complete list is maintained on our subprocessor page.

We may also disclose personal data where required by law, to enforce our Terms, or in connection with a merger, acquisition or sale of assets, in which case we will notify you.

5. International transfers

Some of our providers are located outside the European Economic Area, including in the United States. Where personal data is transferred outside the EEA, we rely on one or more of the following safeguards:

  • An adequacy decision by the European Commission, including the EU-US Data Privacy Framework where the recipient is certified

  • Standard Contractual Clauses adopted under Commission Implementing Decision (EU) 2021/914, supported by a transfer impact assessment and supplementary technical measures including encryption in transit and at rest

You can request a copy of the relevant safeguards by emailing support@pixelflow.so.

6. How we protect your data

Our infrastructure runs on Amazon Web Services. We apply encryption in transit and at rest, access controls and authentication, network-level protection, segregation of customer data, and regular backups. Access to production data is limited to personnel who need it and who are bound by confidentiality obligations.

No system is completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Data Protection Commission within 72 hours where required, and notify you without undue delay where the breach is likely to result in a high risk.

7. Your rights

Under the GDPR you have the right to:

  • Access the personal data we hold about you

  • Rectify inaccurate or incomplete data

  • Erase your data in certain circumstances

  • Restrict processing in certain circumstances

  • Data portability, receiving your data in a structured, commonly used, machine-readable format

  • Object to processing carried out on the basis of legitimate interests, and to object at any time to processing for direct marketing

  • Withdraw consent at any time where we rely on consent, without affecting the lawfulness of processing before withdrawal

To exercise any of these, email support@pixelflow.so. We will respond within one month, and will tell you if we need to extend that period.

Right to complain. If you are unhappy with how we have handled your personal data, you can lodge a complaint with the Irish Data Protection Commission:

Data Protection Commission

6 Pembroke Row, Dublin 2, D02 X963, Ireland

www.dataprotection.ie

You may also complain to the supervisory authority in the EU member state where you live or work.

8. Is providing data required?

Providing your email address is a contractual requirement. Without it we cannot create an account or provide the Service. All other information is optional, and choosing not to provide it does not affect your access to the Service.

9. Changes to this policy

We may update this policy. Where a change is material, we will notify you by email or through the platform before it takes effect. The effective date at the top of this page always reflects the current version.