Privacy Policy

1. Two kinds of people, two roles

Our customers are the people who sign up at pixelglass.co, and the staff they invite to their sites. For their data we are the controller: we decide what is kept and why.

Readers are the people who read, subscribe to, comment on or pay for a site that a customer runs on PixelGlass. The site's publisher decides what is kept about their readers and why; we keep it for them and act only on their instructions. A reader with a question about their data should write to the publisher first. We will help the publisher answer.

2. Our customers

• Your account: your email address and, when you give it, your name. You sign in with a six-digit code we email you; we keep only a one-way hash of the code, and it expires after ten minutes.
• Your sessions: for each sign-in, the IP address and the browser's user agent, so you and we can recognise a session that is not yours.
• Billing: Stripe takes your card and your billing details. We keep Stripe's customer and subscription identifiers, your plan, its status and its dates — never your card number.
• Your sites: everything you and your staff put in them — posts, pages, pictures and other files, themes, settings — and the staff accounts: email address, name, role, and a profile (picture, bio, location) when filled in. Staff can sign in with a password, which we keep only as a one-way hash, or with an emailed code.
• Gravatar: when a staff member has no picture, we ask Gravatar for one with a hash of their email address.
• Usage: how many newsletter emails each site sends a month and how much storage it uses, measured against its plan.
• Agents and keys: the API keys and app connections you make for AI agents (kept as a one-way hash, with the time each was last used), and a revision for every change an agent makes, under the name of the person whose key it used.
• Your messages: what you write to us, and our replies.

When an account is confirmed (its first code typed) or a trial starts, our team is told in a private Telegram chat: the email address, the site's address and the plan.

3. Visitors to pixelglass.co

The company site runs no analytics and no advertising, and sets no cookie until you sign in. Our server logs each request (IP address, browser, page) for security and to find faults. The pages load their fonts from Google Fonts and some pictures from Unsplash, so those services receive your IP address and browser.

4. Readers of sites on PixelGlass

On a publisher's behalf, a site on PixelGlass may keep:

• Membership: the reader's email address and name, the newsletters they joined, labels the publisher gives them, and when they confirmed their address. Readers sign in with an emailed code, kept only as a hash for ten minutes.
• Sign-ins: for each sign-in, the IP address, the browser, and the country that IP address is in (asked of GeoJS).
• Newsletters: each email sent to the reader, and whether it was delivered, bounced, marked as spam, opened (Amazon SES reports an open through a small picture in the email) and which links were clicked (each link passes through the site).
• Comments: what the reader writes, and their votes on comments.
• Payments: when a reader pays, the payment is taken by the publisher's own payment provider — Stripe, Paystack or Dodo Payments — under that provider's privacy policy. The site keeps the provider's identifiers, the plan, the amounts and the dates, never a card number.
• Page views: counted without cookies and without keeping an IP address. Each view keeps the page, the referring site, the kind of device, the country, and a visitor code made from the IP address and browser with a key that changes every day, so the same person cannot be followed from one day to the next and the code cannot be turned back into an address. To find the country, the IP address is sent to GeoJS and the answer is remembered for a day.

Every newsletter carries a link to change or stop it, and a reader can leave every list from their account.

5. Cookies

We set only cookies that the service needs to work. None is for advertising or tracking across sites.

• saas_session_id — keeps you signed in at pixelglass.co.
• session_id — keeps staff signed in to a site's admin at /pixel.
• member_session_id — keeps a reader signed in to a site.
• theme_draft, site_draft and site_sample — show staff a preview of unpublished changes, only while they preview.

Sites also remember a reader's light or dark choice in the browser's own storage, which never leaves the browser.

6. How we use data, and on what basis

• To run the service you signed up for — sign-in, your sites, sending your newsletters, billing (performance of our contract with you).
• To keep it safe and working — logs, preventing abuse and spam, fixing faults, telling our team of new accounts (our legitimate interests).
• To meet the law — tax and accounting records, answering lawful requests (legal obligation).
• Readers' data — only for the publisher, and only to provide the service to them.

We do not sell personal data, share it for advertising, or use your content or your readers' data to train AI models. We send you email about your account and your billing; we will ask before sending anything else.

7. Who else holds it

These services hold or receive personal data so that PixelGlass can work. Each is bound to use it only for that.

Some services are chosen by the publisher, not by us, and receive data under their own terms: the payment provider they connect (Stripe, Paystack or Dodo Payments), their own domain's DNS provider, and the AI apps they connect to their site (such as Claude or ChatGPT), which read and write what that person's role allows.

We may also disclose data when the law requires it, or to a buyer of the business, who would be bound by this policy.

8. Where it is

Our servers and databases are in the European Union. The services above process some data in the United States, South Korea, Japan and elsewhere. Where the law asks for it, these transfers rely on safeguards such as the European Commission's standard contractual clauses.

9. How long we keep it

• Your account, for as long as you have it. Ask us and we delete it.
• A site's data, while its subscription lasts, and for up to 30 days after it ends, so a mistake can be undone; then it is deleted.
• Sign-in codes, ten minutes.
• Billing records, for as long as tax and accounting law requires.
• Server logs, only as long as needed to keep the service safe and find faults.

10. Your rights

Wherever you live, you can ask us for a copy of your personal data, to correct it, to delete it, or to stop a use of it you object to. Write to ronald@pixelglass.co; we answer within 30 days, and we may ask you to prove the data is yours. If you are in the European Economic Area or the United Kingdom, you may also complain to your data protection authority. If you are in California, we do not sell or share personal information as the CCPA defines it.

Readers: write to the publisher of the site; we help them answer. You can also leave any newsletter from the link in its email.

11. Security

Every page is served over HTTPS. Each site has its own databases. Sign-in codes, passwords and API keys are kept only as one-way hashes, and the keys of a publisher's payment provider are encrypted. No system is perfectly secure; if a breach puts your data at risk, we will tell you without undue delay.

12. Children

PixelGlass is not for children under 16, and we do not knowingly keep their data. If you think a child has given us data, write to us and we delete it.

13. Changes

When we change this policy, the date at the top changes. If a change matters, we will email our customers before it takes effect.