Privacy Policy

1. Introduction

PixelUnik ("we," "our," or "us") is an image optimization application for Shopify merchants. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Shopify application and our website at pixelunik.com.

We are committed to protecting your privacy and complying with applicable data protection laws, including the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and other applicable privacy regulations.

2. Information We Collect

2.1 Shopify Application Data

When you install and use the PixelUnik Shopify app, we collect:

Data Type	Description	Purpose
Shop Information	Shop domain (myshopify.com), Shopify Shop ID, installation date	Account identification and service delivery
User Information	First name, last name, email address of store administrators	Account management and communication
Session Data	Authentication tokens, session identifiers	Secure access to your store
Product Data	Product IDs, titles, handles, descriptions	AI-powered optimization and renaming
Image Data	Image URLs, file sizes, dimensions, formats	Image optimization services
Settings & Preferences	Compression quality, format preferences, AI settings	Customizing the service to your needs
Usage Data	Operation history, tokens used, optimization statistics	Analytics and service improvement

2.2 Website Data

When you sign up on our website (for example, our email list) or use our website, we collect:

• Email address: For email updates, promotional offers, and product news
• Signup timestamp: For managing signups and communications

2.3 Image Processing

For image optimization services, we temporarily process:

• Product images: Downloaded from your Shopify store for compression and optimization
• Backup copies: Original images are preserved for the duration of your subscription
• Staging files: Temporary files during processing (auto-deleted after 48 hours)

3. How We Use Your Information

We use the collected information for the following purposes:

• Service Delivery: To provide image compression, optimization, AI alt-text generation, and SEO renaming services
• Account Management: To manage your subscription, billing, and tokens
• AI Processing: To generate descriptive alt-text, meta descriptions, and product translations using AI
• Analytics: To provide you with optimization statistics and usage reports
• Support: To respond to your inquiries and provide technical assistance
• Improvements: To improve our services based on usage patterns
• Legal Compliance: To comply with legal obligations and respond to lawful requests

4. Data Storage and Security

4.1 Where Your Data is Stored

Your data is stored on secure servers provided by our infrastructure partners:

• Database: PostgreSQL hosted on Railway (United States)
• Image Storage: Cloudflare R2 object storage (global edge network with primary storage in the United States)
• Caching: Redis for temporary job processing data

4.2 Security Measures

We implement industry-standard security measures to protect your data:

• Encryption at Rest: All sensitive data is encrypted using AES-256-GCM encryption
• Encryption in Transit: All data transfers use HTTPS/TLS encryption
• Access Control: Multi-tenant data isolation ensures your data is accessible only to you
• Token Security: OAuth tokens and API keys are encrypted before storage
• Log Redaction: Sensitive information is automatically redacted from logs
• Webhook Verification: All Shopify webhooks are cryptographically verified

5. Third-Party Services

We share data with the following third-party service providers to deliver our services:

Service Provider	Purpose	Data Shared	Location
Shopify	Platform integration	Product/image data via API	Global
Anthropic (Claude AI)	AI processing for alt-text, meta descriptions, translations	Product images (for visual analysis), product titles and descriptions	United States
Cloudflare R2	Image storage and backup	Product images	United States (primary)
Railway	Database hosting	All application data	United States
Meta (Facebook)	Advertising measurement on pixelunik.com	Pages viewed and free audit started or completed, with advertising cookies. The domain you type into the audit is never sent.	United States

Each third-party service provider is bound by their own privacy policies and data protection agreements. We only share the minimum data necessary to provide our services.

6. Data Retention

We retain your data for the following periods:

• Account Data: For the duration of your subscription, plus 90 days after cancellation
• Image Backups: For the duration of your subscription (allowing you to revert changes)
• Staging Files: 48 hours (automatically deleted)
• Operation History: For the duration of your subscription (for audit trail and analytics)
• Session Data: Until session expiry or logout
• Website signup emails: Until you unsubscribe or we no longer use the list for these purposes

6.1 Data Deletion

When you uninstall the PixelUnik app from your Shopify store:

• Within 48 hours of receiving Shopify's shop/redact webhook, we initiate complete data deletion
• All your data is permanently deleted, including: account information, settings, operation history, image backups, and any stored metadata
• Optimized images that have been uploaded to your Shopify store remain on Shopify (as they are now part of your store)

7. Your Rights

7.1 Under GDPR (European Users)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights:

• Right to Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate personal data
• Right to Erasure: Request deletion of your personal data
• Right to Restrict Processing: Request limitation of how we process your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

7.2 Under CCPA/CPRA (California Residents)

If you are a California resident, you have the following rights:

• Right to Know: Request information about the categories and specific pieces of personal information we collect
• Right to Delete: Request deletion of your personal information
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out: Opt-out of the sale or sharing of personal information (Note: We do NOT sell your personal information)
• Right to Non-Discrimination: Not receive discriminatory treatment for exercising your rights

7.3 Exercising Your Rights

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days (or as required by applicable law). We may need to verify your identity before processing your request.

8. International Data Transfers

As our servers are located in the United States, your data may be transferred to and processed in the United States. For users in the EEA, UK, or other regions with data transfer restrictions:

• We rely on Standard Contractual Clauses (SCCs) approved by the European Commission for data transfers to the United States
• Our service providers maintain appropriate data protection agreements
• We implement supplementary security measures as required under the Schrems II decision

9. Children's Privacy

PixelUnik is a business-to-business service intended for Shopify merchants. We do not knowingly collect personal information from children under 16 years of age. If you believe we have inadvertently collected such information, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last updated" date
• Sending an email notification for significant changes (if you have provided your email)

We encourage you to review this Privacy Policy periodically for any changes.

11. Contact Us

Supervisory Authority

If you are located in the EEA and believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection supervisory authority.