Privacy Policy
BlackPixel Labs, LLC runs PixelMap Studio from California, United States. This policy explains what we collect, why, and what you can tell us to do about it.
The short version
- We do not sell or share your personal information, and we never have — including under the specific meanings those words have in the CCPA/CPRA.
- We show no third-party advertising and run no advertising or cross-site trackers.
- The only cookie we set is the one that keeps you logged in. Our analytics are cookieless and aggregate, so there is no consent banner to click through.
- Your projects are yours. You can export them or delete everything, at any time, yourself.
1. What we collect
Information you give us
- Account: your name, email address and a hashed password. We store passwords using bcrypt and never in a form we can read.
- Project content: everything you create in the Studio — screen and panel configurations, custom panel inventories, branding assets you upload, project names and version history.
- Billing: if you buy Pro, Stripe collects your payment details and billing address directly. We receive only the customer and subscription identifiers, the plan status and the country needed for tax — never your full card number.
- Support: whatever you write to us when you ask for help.
Information we collect automatically
- Server logs: IP address, user agent, requested path and timestamp, kept for security and debugging.
- Error reports: if the app breaks in your browser, it sends us the error message, stack trace and page URL. It does not send your project content.
- Aggregate analytics: page views and feature events via Plausible, which does not use cookies, does not fingerprint, and does not build a profile of you.
We do not collect precise geolocation, biometric data, or any of the categories the CPRA calls “sensitive personal information”.
2. Why we use it
- To give you the service: run your account, save your projects, produce your exports.
- To bill you and to comply with tax and accounting law.
- To send service email you need: verification, password resets, renewal notices, invitations.
- To keep the service secure — rate limiting, abuse detection, incident investigation.
- To fix bugs and decide what to build next, using aggregate usage data.
We do not use your project content to train machine learning models, and we do not give it to anyone else to do so.
We only send marketing email if you ask for it, and every one has an unsubscribe link. Unsubscribing never stops the service email you need to run your account.
3. Your California privacy rights (CCPA/CPRA)
If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act gives you the rights below. We honor them for everyone, wherever you live.
- Know and access. Ask what personal information we have collected about you, where it came from, why we collected it, and who we disclosed it to.
- Delete. Ask us to delete the personal information we hold about you.
- Correct. Ask us to fix personal information that is inaccurate.
- Portability. Get a copy of your data in a portable, machine-readable format.
- Opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of. We have not done so in the preceding twelve months, and we do not sell or share the personal information of anyone under 16.
- Limit the use of sensitive personal information. We do not collect it, so this right has nothing to act on.
- No retaliation. We will never deny you service, charge you a different price, or give you a worse experience for exercising any of these rights.
How to exercise them
The fastest way is to do it yourself: your account page has one-click buttons to export all of your data and to delete your account permanently. You can also email privacy@pixelmap.studio from the address on your account, or write to us at 1100 Wilshire Blvd, Los Angeles, CA 90017, USA.
We confirm requests within 10 business days and respond within 45 calendar days, extending once by another 45 days if the request is complex (we will tell you if that happens). We verify a request by confirming control of the account email. An authorized agent may act for you with written permission that we can verify.
Categories of personal information we collect
| Category | Examples | Source | Purpose | Sold or shared? |
|---|---|---|---|---|
| Identifiers | Name, email address, account ID, IP address | You, when you register | Run your account, authenticate you, send service email | No |
| Commercial information | Plan, subscription status, licenses, payment history | You and Stripe | Billing, renewals, support | No |
| Internet or network activity | Server logs, error reports, aggregate page views | Automatically, as you use the service | Security, debugging, understanding which features get used | No |
| Your project content | Screen layouts, panel data, logos, uploaded video, project names | You, when you use the Studio | Store, calculate and export your projects | No |
California “Shine the Light”
California Civil Code § 1798.83 lets California residents ask what personal information a business disclosed to third parties for their own direct marketing. We disclose none, and never have. You can confirm that in writing at privacy@pixelmap.studio.
4. Who we share it with
We disclose personal information only to the service providers below, only for the purpose listed, and only under contracts that forbid them from using it for anything else. This is not a sale or a sharing under the CCPA.
| Provider | What they do for us | Where |
|---|---|---|
| Stripe, Inc. | Payment processing, invoicing and tax calculation | United States |
| Resend (Plus Five Five, Inc.) | Transactional email (verification, billing, invitations) | United States |
| Railway Corp. | Application hosting and managed PostgreSQL | United States |
| Plausible Analytics | Cookieless, aggregate product analytics | European Union |
We also disclose information when the law requires it — a valid subpoena, court order or legal process — and we will tell you when we are permitted to. If the business is ever sold or merged, your information may transfer to the buyer under this same policy.
5. How long we keep it
- Account and project data: as long as your account is open. When you delete your account we remove it from our live systems immediately.
- Backups: encrypted database backups are kept for 30 days and then overwritten, so deleted data can persist there for up to 30 days.
- Billing records: seven years, because tax law requires it.
- Server logs: 30 days.
- Version history: the 20 most recent versions of each project.
6. How we protect it
Traffic is encrypted with TLS, passwords are hashed with bcrypt, sessions use signed httpOnly cookies, authentication endpoints are rate limited, and the database is not reachable from the public internet. No system is perfect: if a breach affects your personal information we will notify you and the relevant authorities as the law requires, without unreasonable delay.
7. Cookies
We set exactly one cookie, pms_session, which keeps you logged in. It is httpOnly, SameSite=Lax, secure in production, and lasts 30 days. It is strictly necessary to provide a service you asked for, so no consent is required for it and there is no banner.
We use no advertising cookies, no cross-site trackers and no session recording. Our analytics provider is cookieless by design. Blocking cookies entirely will stop you from logging in, but the Studio still works as a guest.
8. If you are in the EU, the UK or Switzerland
You have the rights to access, rectify, erase, restrict and object to processing, and to data portability, under the GDPR and UK GDPR. The rights and the process in section 3 apply to you as well.
Our legal bases are:
- Contract — running your account, storing your projects, billing you.
- Legitimate interests — security, abuse prevention, aggregate analytics and product improvement, balanced against your rights.
- Legal obligation — keeping tax and accounting records.
- Consent — marketing email, which you can withdraw at any time.
Your data is processed in the United States. For transfers out of the EEA, the UK or Switzerland we rely on the European Commission’s Standard Contractual Clauses with our providers. You have the right to complain to your local supervisory authority; we would rather you told us first at privacy@pixelmap.studio.
9. Children
PixelMap Studio is a professional tool and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, write to privacy@pixelmap.studio and we will delete it.
10. Changes
If we change this policy materially we will email account holders and update the effective date at the top. Continuing to use the service after a change means you accept the updated policy.
11. Contact
BlackPixel Labs, LLC
1100 Wilshire Blvd, Los Angeles, CA 90017, USA
Privacy requests: privacy@pixelmap.studio
Everything else: support@pixelmap.studio