Privacy Policy

Last updated: 21 September 2026

This policy describes how SpotMyPixel ([OPERATOR LEGAL NAME], [REGISTERED ADDRESS]) processes personal data when you use the website and related services. For cookies and similar storage, see the Cookie Policy.

We minimise personal data. We do not use advertising analytics pixels, session replay, or third-party marketing trackers on the SpotMyPixel site.

Who we are

The intended controller is the SpotMyPixel operator identified in the Terms. Privacy requests: Contact.

Data we process

  • Payments and billing location (Stripe). Checkout, billing details, and payment method data are collected and processed by Stripe. We require collection of a billing address at Checkout. After payment we may store billing country, region/state, city, postal code, and street address together with the country/state you declared before checkout, a supporting network-country hint where available, and the geographic eligibility decision. We store Stripe Checkout session and payment-intent identifiers, amounts, currency, and payment status. We do not store card numbers or CVV on our servers. Access to these records is limited to payment fulfilment, refunds, geographic eligibility review, and operators with admin access. Retention follows order, refund, and accounting needs; unpaid checkout holds are short-lived.
  • Affiliate accounts. Email address for magic-link login, referral code, session token hashes, login-token hashes, commission and payout records, declared EU country of establishment, business/professional declaration timestamp, Affiliate Terms acceptance timestamp, VAT identification number and Member State, VIES validation outcome/timestamp and available validation evidence, selected Connect country, and Stripe Connect operational status (connected account id and capability/payout flags). SMTP delivers the login email. The European Commission VIES service is used to check VAT numbers; a VIES outage is not treated as a successful check. Stripe processes affiliate identity, KYC, and payout details on Stripe-hosted onboarding. SpotMyPixel does not store affiliate bank account numbers, IBANs, card numbers, or identity documents. VAT and eligibility records are available to operators for approval, suspension, and accounting export. They are retained while the affiliate account and related commission/payout records are needed for accounting.
  • Administrators. Admin email in server-side sessions; password hash is stored in server environment, not in the buyer database.
  • Advertising images. Uploaded files are validated, re-encoded, stored on our hosting disk, and displayed on the canvas if published.
  • Destination URLs and scan metadata. Optional links, normalised and final URLs, redirect counts, page title, a short extract of visible text, and a content fingerprint may be processed to detect prohibited advertising. Full destination HTML is not stored as a page archive. Scan metadata may be retained with the placement or moderation attempt.
  • Automated content moderation (OpenRouter / Google Vertex). Advertising images and bounded destination-page fields may be sent to OpenRouter, which is configured to route classification to Google Vertex with zero-data-retention and no Google AI Studio fallback. We do not send buyer email, affiliate identity, Stripe customer IDs, IP addresses, or unrelated account information to that classifier. OpenRouter’s and Google’s processing is still a third-party processing activity. We do not claim that zero retention is guaranteed beyond that provider configuration and their terms.
  • Cloudflare Turnstile. Bot/abuse protection on the pre-payment content-check, purchaser image replacement, public placement-report form, and admin login. Cloudflare may process a token and related technical data. See also the Cookie Policy for third-party cookies that Cloudflare may set.
  • Purchaser management. After verified Stripe payment we store the Checkout customer email on the order so we can send a one-time magic link for image-only replacement. A hashed session token is stored server-side; the raw token is kept only in an HttpOnly cookie. We do not expose Stripe customer IDs or card details in that flow.
  • Referral attribution. If you consent to optional affiliate attribution, we may store a referral code in a first-party cookie. You may also type a referral code at checkout. Affiliates see aggregated purchase amounts and commission status, not purchaser payment identity.
  • Public reports. A category and optional message submitted with “Report this placement”, stored internally and grouped by placement and image revision for operator review. An anonymous first-party reporter cookie may be stored as a hash for duplicate-report prevention. Reports do not require an account or email address.
  • Admin moderation logs. Status changes, reason codes, and internal notes associated with the acting admin email.
  • Security / rate-limit keys. Client IP addresses may be hashed (HMAC) and used as short-lived rate-limit keys. Raw IP addresses are not stored on moderation or report rows. Rate-limit rows are intended to be short-lived; automated purge is operator-dependent.
  • Operational logs. Error tags and safe messages. We aim not to log raw tokens, session cookies, Stripe secrets, passwords, or full webhook bodies with unnecessary personal data. Intended log rotation is an infrastructure setting (about 90 days in operator docs), not a guarantee of deletion on a fixed public schedule.

After payment, the Stripe Checkout email may be used for a purchaser management session so you can replace artwork on placements you paid for. That session is scoped to paid orders for that email. Status is also shown via the Stripe checkout success flow using the Checkout session identifier.

Why we process data

To provide the canvas and checkout, take payment, moderate advertising content, operate affiliate commissions, secure the Service, and meet legal accounting and dispute needs.

Processors and hosting

Typical processors / subprocessors in the current architecture:

  • Hosting VPS (intended: EU, e.g. Hetzner) running the app, PostgreSQL, and upload disk
  • Stripe — customer Checkout, Connect onboarding/transfers, and webhooks
  • Configured SMTP provider — affiliate and purchaser magic-link email
  • Cloudflare Turnstile — bot protection on content check and image replacement
  • OpenRouter — automated image and page classification, routed to Google Vertex as configured
  • Isolated URL-scanner service (our infrastructure) — fetches public destination pages

International transfers may occur where a processor is outside your country (for example Stripe, OpenRouter, Google Vertex, or Cloudflare).

Retention

Placements, orders, commissions, and uploaded images are kept while needed for the Service, accounting, and dispute handling (period to be confirmed). Affiliate sessions expire after about 14 days; admin sessions after about 7 days; unused magic-link tokens after about 30 minutes; used login-token hashes are intended for about 7 days. Expired unpaid reservations are intended for later cleanup (operator note: about 30 days). We do not claim universal zero retention. Provider zero-data-retention settings, where used, apply only to that provider’s described configuration.

Your rights

Depending on applicable law (including the GDPR where it applies), you may have rights to access, rectify, erase, restrict, object, or port personal data, and to withdraw consent for optional storage. Use Contact. You may also complain to a supervisory authority in your country of residence.

Children

The Service is not directed at children. Eligibility is described in the Terms.