02 - Privacy Policy

Last updated: 2026-09-23

This policy explains what personal information PyxelJam.Studio ("PXLJ", "we", "us") collects, why, who we share it with, how long we keep it, and what rights you have.

PXLJ is operated from the United States. Wherever you are, the whole of this policy applies to you. Two sections add rights that depend on where you live: Section 9 for residents of California and the other US states with comprehensive privacy statutes, and Section 10 for people in the European Economic Area and the United Kingdom.

We have written this in plain language on purpose. If anything is unclear, ask us at privacy@pyxeljam.studio.

---

1. Who we are

• The business: PyxelJam, based in Maricopa County, Arizona, United States
• Postal address: available on request from privacy@pyxeljam.studio
• Privacy contact: privacy@pyxeljam.studio
• General contact: support@pyxeljam.studio

Data Protection Officer. We have not appointed a DPO. PXLJ is a small operation whose core activity is not large-scale monitoring or large-scale processing of special category data, so GDPR art. 37 does not require one.

2. Which privacy law applies to you

• If you are in the United States, the relevant law is your state's. Six comprehensive state statutes are directly in view for a product like this: the California Consumer Privacy Act as amended by the CPRA, and the comparable statutes in Virginia, Colorado, Connecticut, Utah and Texas. More states are adding them. Section 9 sets out those rights. Some of these statutes only apply to a business once it crosses a revenue or volume threshold; we describe the rights here regardless, because we would rather offer them than argue about thresholds.
• If you are in the EEA or the UK, the GDPR (and the UK GDPR) applies to us under art. 3(2) because we offer a service to people there. Section 10 sets out those additional rights.
• Everyone gets everything else in this policy: the same disclosures, the same retention, the same security, and the same ability to ask us to delete your account.

3. When you are the controller instead of us

Two different relationships exist here and it matters which one you are in.

We decide why and how we process your account, your billing, your support conversations, our security logs and our product analytics. In GDPR language we are the controller for that; in US state-law language we are the business.

You decide, and we act on your instruction, for personal information you choose to put into the platform as project content: a real person's photograph used as a character reference, a recorded voice, an on-camera performance, a client's name in your project notes, a script naming real people. We only process that material to run the Service for you. In GDPR language we are your processor for it; in US state-law language we are your service provider. You are responsible for having a lawful basis and the necessary consents for that material (see the AI Content Terms, Section 7).

Data processing agreement. If you are a business customer on a paid plan and need a data processing agreement for the project content you put into PXLJ (for example under GDPR Article 28, or a service-provider contract under the CCPA), email privacy@pyxeljam.studio and we will send one for countersignature.

4. What personal information we collect

4.1 Account and identity data

Collected when you sign up and when you use the Service.

4.2 Authentication and security data

4.3 Billing data

We never receive, process or store your card number, CVC or expiry date. Card details go directly to Stripe.

4.4 Your content

Everything you create in, or upload to, the platform:

• Projects, scripts, script drafts, scenes, shots, takes and scene elements
• Character, location and prop library entries, including reference images, character sheets, outfit images, physical descriptions and voice profiles
• Acting performances: audio recordings and on-camera video you record in the browser or upload, together with the normalised media file, a poster frame or waveform, the duration, the performer's name if you enter one, and any transcript
• Custom LoRA training material and trained model references
• Generated output: storyboard images, video clips, audio, foley, transcripts and final exports
• Generation job records, prompts, AI decision logs and continuity logs
• Prompt presets, style presets and custom directing vocabulary
• Review shares and public shares you create, and the name, comment text and verdict left by any external reviewer you invite through a share link
• Client records (name, company, email, phone, industry) if you use the client feature
• Publishing accounts and microdrama submission records
• Notifications and generation digests

Content may contain personal information about other people - your cast, your clients, your reviewers. Section 3 explains who is responsible for it.

4.5 Connected third-party accounts

If you connect Google Drive, Dropbox, your own S3-compatible bucket, a Telegram bot or an outgoing webhook, we store the OAuth access token, refresh token, token expiry, granted scope, the connected account's email address, and a record of files synced. You can disconnect an integration at any time from Settings, which removes the stored tokens.

4.6 Support communications

If you use the contact form or email us, we process your name, email address, subject and message.

4.7 Product analytics

In production, PXLJ uses PostHog for product analytics. It records page views and interaction events (clicks, form submissions) and keeps an anonymous identifier in your browser's local storage. Analytics sets no cookies, and session recording is switched off.

Once you have verified your account, analytics events are linked to your internal PXLJ account ID and your plan, so we can see how the product is used from sign-up onward. We do not send your email address or name to PostHog. We do not build advertising profiles, we do not sell personal information, and we do not run advertising or cross-site tracking pixels.

Your browser does not send your IP address as part of analytics events. Like any web service, the analytics provider can see the network address a request comes from; we do not use it to identify you.

If your browser sends a Global Privacy Control signal, analytics starts in an opted-out state and sends nothing.

4.8 Error reporting

If error reporting is enabled in production, PXLJ sends crash and exception reports to Sentry with a 10% performance-trace sample rate. Session replay is explicitly disabled. Reports can incidentally contain a URL, a user identifier or a fragment of request data present at the moment of the error.

4.9 What we do not collect

We do not collect sensitive personal information about you as a customer: no government identifiers, no financial account numbers, no precise geolocation, no health, racial, religious, union, or sexual-orientation data, and no biometric identifiers used to identify you. Note that a face or voice recording you upload as project content may be biometric or otherwise sensitive; that is your content and Section 3 applies to it.

We do not knowingly collect information from anyone under 18.

5. Why we process it

Where we rely on legitimate interest, we have considered whether our interest is overridden by your rights, and you may object at any time (Section 10).

We do not use your content to train AI models. See the AI Content Terms, Section 8, including what upstream providers do and do not do.

6. Who we share it with (subprocessors)

We use the following third parties to run the Service. Each has access only to what it needs for its function. None of them is permitted to use your information for their own purposes, and we do not receive money for any of these disclosures.

6.1 Infrastructure

6.2 Payments

6.3 AI model providers

These providers receive the content you submit for a generation: prompts, scripts, reference images, character sheets, still frames, and for the Acting feature the audio or on-camera video you recorded.

Read this if you use the Acting feature or upload a person's photo. A recording of a real person's face or voice is, in many jurisdictions, biometric or otherwise sensitive personal information, and several US states (Illinois' BIPA and Texas' CUBI in particular) regulate it specifically. When you run a generation with it, that recording leaves our systems and is processed by FAL.ai and its underlying model vendor. Do not upload a person's face or voice unless you have their informed consent for exactly that.

6.4 Communications, support and observability

6.5 Data processing agreements

We rely on each provider's data processing agreement, and, for our EEA and UK users, on the transfer mechanisms described in Section 10.4.

6.6 Optional integrations you turn on yourself

If you connect Google Drive, Dropbox, your own storage bucket, Telegram or an outgoing webhook, we send data to that destination on your instruction. Those destinations are controlled by you, not by us, and their own privacy terms apply.

6.7 Other disclosure

We may disclose personal information where required by law, court order, subpoena or a valid authority request, and where necessary to establish, exercise or defend legal claims. We report child sexual abuse material as described in the Acceptable Use Policy.

If the business is sold or merged, your information may transfer to the acquirer. We will tell you before that happens and you will be able to delete your account first.

7. We do not sell or share your personal information

We do not sell your personal information, and we have not sold it in the preceding 12 months. We do not sell or share the personal information of anyone under 16.

"Sharing" has a specific, wider meaning under the CPRA. In California, "sharing" means disclosing personal information for cross-context behavioural advertising, even where no money changes hands, and some common analytics and advertising configurations are treated as sharing on that definition.

Our position: PXLJ runs no advertising pixels, no retargeting tags and no ad-network integrations, and does not disclose personal information for behavioural advertising. On that configuration we do not "share" as the CPRA defines it. Our analytics provider is engaged as a service provider, processing only on our instruction and not for its own advertising purposes.

8. How long we keep it

Backups. Deleted database records may persist in the database provider's point-in-time restore history for up to 7 days after deletion, until that history rolls over. The object-storage bucket has no object versioning enabled, so a deleted file is not retained in an earlier version. Backups are not used to restore individual deleted records.

9. Your US privacy rights

This section applies to residents of California, Virginia, Colorado, Connecticut, Utah and Texas, and we extend the same rights to residents of every other US state as a matter of policy rather than argue about which statute reaches us.

9.1 Categories of personal information we collect

The CCPA requires this disclosure by statutory category. Over the preceding 12 months we have collected:

9.2 Your rights

Wherever you live in the US, you may ask us to:

1. Know what personal information we hold about you, where we got it, why we process it, and who we disclosed it to.
2. Get a copy of it, in a portable format.
3. Delete it, subject to information we must keep by law (tax and invoice records) or need to defend legal claims.
4. Correct information that is inaccurate.
5. Opt out of sale, of sharing for cross-context behavioural advertising, and of profiling for decisions with legal or similarly significant effects. We do none of those (Section 7), so there is nothing to opt out of, but the right stands if that ever changes.
6. Limit the use of sensitive personal information. We do not use sensitive personal information for purposes that trigger this right.
7. Appeal a refusal. If we decline a request, we will say why, and residents of Virginia, Colorado, Connecticut and Texas may appeal by replying to that response. We will answer an appeal within 45 days and tell you how to contact your state attorney general if you are still unhappy.

9.3 Non-discrimination

We will not discriminate against you for exercising any of these rights. We will not deny you the Service, charge you a different price, give you a lower quality of service, or suggest that we might. There is no financial incentive programme attached to your personal information.

9.4 How to exercise them

Email privacy@pyxeljam.studio from your account's registered email address, or use the contact form in the help centre. We will:

• acknowledge within 10 business days;
• verify you are who you say you are, which for an account holder normally means sending the request from the registered address or confirming from inside the account;
• respond within 45 days, extendable once by a further 45 days where the request is complex, in which case we will tell you before the first period ends.

There is no charge unless a request is manifestly unfounded, excessive or repetitive.

Authorised agents. You may use an authorised agent to make a request. We will ask for written proof of the authorisation and may ask you to confirm it directly.

9.5 Account deletion and data export

You can delete your account and export your data by writing to privacy@pyxeljam.studio. We will:

• export your projects, assets and generated media, and your account and billing records, and send them to you; and
• delete your account, your content, your uploaded and generated media, your performances, your integration tokens and your sessions, retaining only what tax and accounting law requires us to keep.

9.6 Complaints

If you think we have handled your information wrongly, tell us first and we will try to fix it. You may also complain to your state attorney general, and Californians may complain to the California Privacy Protection Agency.

10. Additional rights if you are in the EEA or the UK

The GDPR and the UK GDPR apply to us under art. 3(2) because we offer the Service to people in those territories. If you are there, the following applies in addition to everything above.

10.1 Your rights

Under GDPR articles 15 to 22 you have the right to:

1. Access (art. 15) - get a copy of the personal data we hold about you.
2. Rectification (art. 16) - correct data that is wrong or incomplete. You can edit most of it yourself in Settings.
3. Erasure (art. 17) - have your data deleted, subject to data we must keep by law or need to defend legal claims.
4. Restriction (art. 18) - have processing paused while a dispute about accuracy or lawfulness is resolved.
5. Portability (art. 20) - receive the data you gave us in a structured, commonly used, machine-readable format.
6. Object (art. 21) - object to processing based on legitimate interest, including profiling. You can object to analytics at any time.
7. Not be subject to solely automated decisions (art. 22) - we do not make decisions producing legal or similarly significant effects about you by automated means alone. Automated model selection, credit metering and abuse flagging do not fall into that category, and account termination for a serious policy breach involves a human.
8. Withdraw consent at any time, where we rely on consent. Withdrawing does not affect processing already carried out.

Email privacy@pyxeljam.studio. We will respond within one month, extendable by two further months for complex requests, and we will tell you if we need the extension.

10.2 Where your data is processed

PXLJ is operated from the United States. If you are in the EEA or the UK, your personal data is transferred to and processed in the United States by us and by the providers listed in Section 6, and it may be accessed by US authorities under US law in circumstances that differ from those in your own country.

10.3 EU and UK representative

We have not appointed a representative in the EU or the UK under Article 27 of the GDPR and the UK GDPR. We rely on the exemption in Article 27(2)(a): our processing of personal data of people in the EEA and the UK is occasional, does not include large-scale processing of special categories of data, and is unlikely to result in a risk to your rights and freedoms given its nature, context, scope and purposes. We review this position as our EEA and UK user base grows, and we will appoint a representative and name them here if the exemption ceases to apply. Until then, you may contact us directly about your data at privacy@pyxeljam.studio.

10.4 Transfer mechanism

When you use PXLJ directly, we are the controller and the GDPR and UK GDPR apply to us under Article 3(2); your personal data is processed in the United States as described in Section 10.2, on the legal bases in Section 5.

Where a business customer established in the EEA or the UK gives us personal data as its processor, the transfer to us is made under the EU Standard Contractual Clauses (Commission Decision 2021/914, Module 2, controller to processor) and, for UK data, the UK International Data Transfer Addendum, incorporated into our data processing agreement, supported by a transfer impact assessment we keep on file and will share on request.

Our onward transfers to the providers listed in Section 6 are made under those providers' own Standard Contractual Clauses and, where the provider holds it, their EU-US Data Privacy Framework certification. PXLJ itself is not certified under the Data Privacy Framework and does not claim to be.

10.5 Supervisory authority

You may complain to the data protection authority in your EEA member state or, in the UK, to the Information Commissioner's Office.

11. How we protect it

• Passwords are hashed with bcrypt and are never stored or transmitted in the clear.
• Verification and password-reset tokens are stored only as SHA-256 hashes.
• All traffic to the platform runs over HTTPS.
• Sessions are JWT-based and expire after 30 days; role and tier are re-checked against the database periodically.
• Data is scoped per account at the query layer, so one account cannot read another's projects, assets or billing.
• Outgoing webhooks are signed with HMAC-SHA256 so a receiver can verify the call came from us.
• Session replay in error reporting is disabled.

No system is perfectly secure. If we become aware of a breach of your personal information we will notify you and the relevant authorities as required by law. That means, in the US, the breach-notification statute of every state whose residents are affected (all fifty have one, with differing content and timing requirements, several requiring notice to the state attorney general as well as to individuals), and, for EEA and UK users, notification to the lead supervisory authority within 72 hours where the breach is likely to result in a risk to your rights.

12. Cookies and similar technologies

PXLJ sets:

• Essential cookies - your authentication session, and a cookie recording your locale and interface preferences. These are strictly necessary to provide the Service you asked for.
• Analytics storage - an anonymous identifier kept in your browser's local storage. It is not a cookie, and analytics sets no cookies.

We do not use advertising cookies, retargeting pixels or cross-site trackers.

Opt-out preference signals. We treat a Global Privacy Control signal from your browser as an opt-out of any sale or sharing (we do neither today, Section 7) and as an instruction not to send analytics. California, Colorado and Connecticut require this, and we apply it to every visitor.

Refusing analytics. Wherever you are, you can refuse analytics by turning on Global Privacy Control in your browser, by clearing this site's local storage, or by asking us at privacy@pyxeljam.studio.

You can block or delete cookies in your browser. Blocking essential cookies will stop you being able to log in.

13. Children

The Service is not for anyone under 18. We do not knowingly collect personal information from children, and we do not direct the Service to children. Under the US Children's Online Privacy Protection Act we do not knowingly collect personal information from a child under 13. If you believe a child has given us personal information, contact privacy@pyxeljam.studio and we will delete it.

14. Changes to this policy

We may update this policy. The current version always lives at this URL with a "Last updated" date. For changes that materially affect how we use your information, we will notify you by email or in-product before they take effect.

---

Privacy contact: privacy@pyxeljam.studio