pixmoat / legal
Privacy policy
Last updated: 12 August 2026
This Privacy Policy explains how pixmoat processes personal data through pixmoat.com and the pixmoat service.
Controller and contact
The controller is pixmoat, based in Slovenia. Contact: info@pixmoat.com.
Data we process
- Website data: IP address, browser/device information, request timestamps, pages requested, and security logs.
- Waitlist data: email address submitted through the website and the time of submission.
- Service data: account and authentication details, organisation and project information, screenshots, baselines, builds, diffs, comments, integration configuration, webhook information, and support communications.
- Billing data: subscription, transaction, and billing identifiers received from or handled by Creem. Payment card details are handled by Creem, not stored by pixmoat.
- Analytics data: aggregate website-usage data from a self-hosted Umami instance operated by pixmoat. Session recording is disabled.
Purposes and legal bases
- To provide, secure, maintain, and improve the service: performance of a contract or steps before entering a contract, and legitimate interests in operating a secure service.
- To respond to requests and manage the waitlist: steps before a contract, consent where applicable, or legitimate interests in responding to an explicit request.
- To process payments and maintain financial records: performance of a contract and compliance with legal obligations.
- To understand website usage through Umami: our legitimate interest in measuring and improving the public website, using a privacy-focused, self-hosted configuration.
- To comply with legal obligations and establish, exercise, or defend legal claims: legal obligation or legitimate interests.
Service data and customer content
When you use pixmoat, your organisation may provide screenshots, source-related metadata, CI information, and other project content. We process that information to provide the service and according to your organisation’s instructions where pixmoat acts as a processor. Do not upload personal, confidential, or regulated data unless your organisation has authorised that use.
Recipients and providers
We share data only as needed to operate the service, comply with law, or protect the service and its users. Current provider categories include:
- Netcup infrastructure for hosting and databases;
- Creem for checkout, payment processing, merchant-of-record services, tax handling, and billing;
- self-hosted Umami analytics operated by pixmoat on the hosting infrastructure;
- email delivery providers configured for transactional or service email, where used;
- Git providers, webhook destinations, and other integrations selected or configured by a customer.
Retention
We keep personal data only for as long as it is needed for the purpose collected, to provide the service, to meet legal and accounting requirements, or to resolve disputes. Account and project data is retained while the account is active and for a reasonable period after termination for recovery and legal obligations. Waitlist data is retained until it is no longer needed or you request deletion. Security and access logs are retained for a period appropriate to security monitoring. Backup copies may persist until they are rotated in the ordinary backup cycle.
International transfers
Provider locations and transfer mechanisms can vary by service and configuration. We use providers with appropriate contractual and technical safeguards and will update this policy if the processing arrangement materially changes.
Your rights
Subject to applicable law, you may request access, correction, deletion, restriction, portability, or objection to processing, and withdraw consent where processing is based on consent. Contact info@pixmoat.com. You may also complain to the Slovenian Information Commissioner at ip-rs.si or the supervisory authority where you live or work.
Security and changes
We use reasonable technical and organisational measures appropriate to the risk. See the Security page for a high-level description. We may update this policy when the service or legal requirements change; the date above indicates the latest revision.