Privacy Policy

We collect only what we need to provide the service. This includes:

• Account information: your name and email address when you register.
• Payment information: billing details (processed securely by our payment provider; we never store your full card number).
• Photos and media: the photos, videos, and metadata you upload to your library.
• Usage data: basic service logs such as login events and storage usage, used to operate and improve the service.
• Support communications: emails or messages you send to us when seeking help.

We do not collect sensitive information (such as health or biometric data) beyond what may be incidentally present in photos you choose to upload.

We use your information to:

• Provide, operate, and maintain the Pixly service.
• Process payments and manage your account.
• Send transactional communications (e.g. invoices, service notices).
• Respond to your support requests.
• Monitor and improve service performance and security.

We will only send marketing communications if you have opted in, and you can withdraw consent at any time.

We will never sell your personal information to any third party.

We will never share your personal information with third parties for their own marketing or commercial purposes.

We share your information only as strictly required to deliver the service:

• Infrastructure providers: we host and run Pixly on third-party cloud and server infrastructure located in Sydney, Australia. We never share your data with these providers for their own purposes, and they are bound by confidentiality. Your stored photos are encrypted at rest.
• Payment processor: we use Stripe to process subscription payments. Stripe is a global payment provider certified to PCI-DSS Level 1 and ISO 27001, so your payment information is handled on Stripe's secure infrastructure overseas, primarily in the United States. We never store your full card details ourselves.

We may also disclose information if required by Australian law, a court order, or to protect the safety of our users or the public.

Your photos, account details, and service logs are stored on servers located in Sydney, Australia. The main exception is payment: when you subscribe, your payment information is handled by Stripe and processed overseas (primarily the United States) on its PCI-DSS Level 1 and ISO 27001 certified infrastructure. Where personal information is handled overseas, we take reasonable steps to protect it consistent with the Australian Privacy Principles (APP 8).

We keep your personal information for as long as your account is active or as needed to provide the service.

If you close your account, we will delete your personal data and media within 30 days, except where we are required to retain certain records for legal or accounting purposes (for example, billing records for up to 7 years as required under Australian tax law).

We take reasonable steps to protect your information from misuse, interference, loss, unauthorised access, modification, or disclosure. Our security measures include:

• Encrypted connections (HTTPS) for all data in transit.
• Encrypted storage for data at rest.
• Each account has its own database and its own storage, kept logically separated from other customers' data.
• Access controls limiting which staff can access production systems.

No method of transmission over the internet or electronic storage is 100% secure. If you become aware of a security concern, please contact us immediately at [email protected].

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you.
• Request correction of any personal information that is inaccurate, out of date, or incomplete.
• Request deletion of your personal information (subject to any legal obligations we have to retain certain records).
• Make a complaint about how we have handled your information.

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

Our public marketing site uses Google Analytics to measure how the site performs, for example which pages visitors view. That is the only tracking we use, and it applies to the marketing site only.

Your private photo library carries no analytics or advertising trackers. It uses only the cookies needed to keep you securely signed in. We never use advertising networks, and we never sell your data.

The Pixly service is not directed at children under 13 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information without parental consent, please contact us so we can delete it.

We may update this Privacy Policy from time to time. When we do, we will update the “last updated” date at the top of this page and, where the changes are material, notify you by email. Continued use of the service after any changes constitutes your acceptance of the revised policy.

For any questions, requests, or complaints regarding your privacy, please contact: