Privacy Policy

1. Who we are (data controller)

PixelForge AI ("PixelForge", "we", "us") is an AI image generation service operated by its founder, Nico Jaroszewski, based in Switzerland. For the purposes of the EU/UK General Data Protection Regulation and the Swiss Federal Act on Data Protection (FADP), we are the data controller for the personal data described below.

Registered controller: [[ Registered legal entity name and legal form ]]. Postal address: [[ Registered postal address, Switzerland ]]. Register number (where applicable): [[ Commercial register / UID number ]].

For any privacy question or to exercise your rights, contact us at privacy@pixelforgeai.dev or via our contact page. We have not appointed a statutory Data Protection Officer; where a DPO or EU/UK representative is required, their details will appear here: [[ DPO / Art. 27 representative, if appointed ]].

2. What data we collect

We collect only the data we need to run the service:

• Account & authentication data - your email address, name (if provided), and authentication identifiers, handled through our authentication provider, Clerk. If you sign in with a social provider, we receive the basic profile information that provider shares.
• Prompts & generated images - the text prompts you enter and the images PixelForge generates for you, so we can deliver, display, and store your creations.
• Usage & credit data - generation counts, credit balance, plan tier, and basic product analytics (such as which features you use) so we can run billing, prevent abuse, and improve the product.
• Payment data - when you subscribe or buy credits, payments are processed by Stripe. Stripe handles and stores your card details directly; we never see or store your full card number. We retain only billing records such as plan, amount, and the last four digits Stripe returns to us.
• Technical data - IP address, device/browser type, and log data automatically generated when you connect to our servers, used for security, rate-limiting, and diagnostics.
• Communications - messages you send us by email or through the contact page, and any newsletter opt-in if you subscribe.

We do not knowingly collect special-category data (e.g. health, biometric, or political data). Please do not submit such data in prompts.

3. Why we process it, and our legal bases

Under GDPR/UK GDPR Article 6 (and the equivalent FADP grounds), we rely on the following legal bases:

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You can object at any time (see your rights below).

4. Who processes your data (sub-processors)

We share personal data only with the service providers we need to operate PixelForge. Each acts as a processor under our instructions and a data-processing agreement. We do not sell your personal data.

We may also disclose data where required by law, to protect our rights or users' safety, or in connection with a merger or acquisition (in which case this policy will continue to apply to your data). A current, dated list of sub-processors is available on request and at [[ link to live sub-processor list, if published ]].

5. International data transfers

Several of our processors are located in the United States, so your data may be transferred outside Switzerland, the EEA, and the UK. Where we transfer personal data internationally, we rely on appropriate safeguards - principally the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, and the Swiss FADP-recognised transfer mechanisms - together with the providers' own certifications (such as the EU-US Data Privacy Framework, where applicable). Copies of the relevant safeguards are available on request.

6. How long we keep it

We keep personal data only as long as needed for the purposes above:

• Account & generated content - for as long as your account is active. When you delete your account, we delete or anonymise your account data and generated images within a reasonable period, except where we must retain limited records.
• Billing & tax records - retained for the period required by Swiss and applicable tax/accounting law (generally up to 10 years).
• Security & log data - retained for a short period for diagnostics and abuse prevention, then deleted or aggregated.

7. Your rights under GDPR and UK GDPR

If you are in the European Economic Area or the United Kingdom, you have the right to:

• Access - obtain a copy of the personal data we hold about you.
• Rectification - correct inaccurate or incomplete data.
• Erasure - ask us to delete your data ("right to be forgotten").
• Portability - receive your data in a structured, machine-readable format.
• Restriction - ask us to limit how we process your data.
• Objection - object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent - where we rely on consent, withdraw it at any time without affecting prior processing.
• Lodge a complaint- with your local supervisory authority. In the UK this is the Information Commissioner's Office (ICO); in the EU it is the authority in your country of residence.

8. Your rights under the Swiss FADP

If you are in Switzerland, the revised Federal Act on Data Protection (revFADP) gives you equivalent rights, including the right to information about whether we process your data, access to that data, rectification, deletion, and the right to object to processing. You may also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC). PixelForge is operated from Switzerland and built with Swiss data protection standards in mind.

9. Your US privacy rights (CCPA/CPRA and state laws)

California (CCPA / CPRA)

If you are a California resident, you have the right to know what personal information we collect and how we use it, to access and delete that information, to correct inaccurate information, and to opt out of the "sale" or "sharing" of personal information. We do not sell your personal information and we do not share it for cross-context behavioural advertising, so there is no "Do Not Sell or Share My Personal Information" action you need to take - but you may still contact us to confirm this. We do not discriminate against you for exercising any of these rights.

Other US state privacy rights

If you are a resident of a state with a comprehensive privacy law - including Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), Iowa (ICDPA), Delaware (DPDPA), New Jersey (NJDPA), New Hampshire (NHDPA), Maryland (MODPA), and Minnesota (MCDPA), among others - you have comparable rights to access, correct, delete, and obtain a portable copy of your personal data, and to opt out of targeted advertising, the sale of personal data, and certain profiling. We honour these rights regardless of your state of residence. To exercise any of them, contact us at privacy@pixelforgeai.dev. You may use an authorised agent, and you may appeal a decision by replying to our response.

10. How to exercise your rights

Email privacy@pixelforgeai.dev or use our contact page. We will verify your identity (usually via your account email) and respond within the timeframe required by the applicable law - generally within one month under GDPR/UK GDPR/FADP and within 45 days under US state laws, with an extension where permitted. Many requests, including deleting your account, can also be actioned from your account settings.

11. Cookies and similar technologies

We use strictly necessary cookies and local storage to keep you signed in (via Clerk) and to remember preferences such as your theme and language. For full details on what we use, the categories involved, and how to control them, see our Cookie Policy.

12. How we protect your data

We apply technical and organisational measures appropriate to the risk - including encryption in transit (HTTPS), access controls, reputable infrastructure providers, and data minimisation. No method of transmission or storage is perfectly secure, but we work to protect your data and to notify you and the relevant authorities of a qualifying breach as required by law.

13. Children's privacy

PixelForge is not directed to children. You must be at least 16 years old (or the minimum age of digital consent in your country) to use the service. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

14. Changes to this policy

We may update this policy as the service evolves or the law changes. We will revise the "Last updated" date above and, for material changes, take additional steps to notify you (such as an in-app notice or email). Your continued use after an update means you accept the revised policy.

15. Contact us

Privacy questions or requests: privacy@pixelforgeai.dev. General support: support@pixelforgeai.dev. You can also reach us through our contact page.