Privacy policy
This policy explains what data the Pixfact app (“the app”, “we”) processes when a merchant installs and uses it in their Shopify store, why, with whom it is shared, and how long it is kept.
1. Who we are
The app is operated by Andrei Velent, a sole trader registered in the Polish business register (CEIDG), ul. Straganiarska 20/22 lok. 35, 80-837 Gdańsk, Poland. NIP (tax ID): 5223258005, REGON: 525284838. Contact for privacy questions: privacy@pixfact.com.
2. Data we process
The app only asks Shopify for read access to products and to the store’s languages
(read_products, read_locales). It does not access customers, orders or payments.
- Store data: store domain and name, primary language, currency, and the access token Shopify issues to the app.
- Product data you choose: for each product you create an ad for, its title, description, type, options, variant names and prices, and the product photo you select.
- Content the app creates: the cut-out of your product photo, the generated background scene, the ad text, your edits to it, and the finished images in 1:1, 4:5 and 9:16.
- Brand settings: your logo, colours, font and tone, if you set them.
- Usage records: which creatives were made, downloaded or reported as defective (with your optional note), credits and plan, processing times, and the cost of each call to the AI services we use.
We do not process personal data of your customers. The app sets no cookies and uses no advertising or analytics trackers; it signs you in with the session token Shopify provides. Payments for plans are handled entirely by Shopify’s billing; we never see card or bank details.
3. Why we use it
- To provide the app: cut out the product, build a scene around it, write the ad text from your product facts and render the creatives (performance of our contract with you, GDPR Art. 6(1)(b)).
- To run credits and plans, and to give the free welcome credits once per store (contract; legitimate interest in preventing abuse, Art. 6(1)(f)).
- To keep quality and costs under control and to improve the app: defect reports, processing times, cost records and usage statistics such as which steps are used (legitimate interest).
- To answer support requests and meet legal obligations (Art. 6(1)(c)).
We do not sell data, and we do not use your products, photos or creatives to train AI models.
4. Service providers (sub-processors)
| Provider | What it receives | Purpose | Location |
|---|---|---|---|
| Shopify | Everything the app does runs inside your Shopify admin | Platform, sign-in, billing | Per Shopify’s terms |
| Hetzner Online GmbH | All data listed in section 2 | Servers, database, file storage | Finland (EU) |
| Cloudflare, Inc. (R2 storage) | Encrypted backups of the database and stored images; Cloudflare cannot read them | Disaster recovery | European Union |
| Photoroom SAS | The product photo you select | Removing the background (cut-out) | France (EU) |
| Google LLC (Gemini API) | Product facts (title, description, type, options, variant names), the cut-out on a placeholder canvas, the ad text | Writing the scene and the ad text, generating the background scene, checking the text against your product facts | Any country where Google operates |
Photoroom states that images processed through its API are not used for model improvement. Google states that on paid Gemini API services it does not use prompts, images or responses to improve its products, and keeps them for a limited period only to detect abuse. Transfers outside the EEA rely on appropriate safeguards such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
5. How long we keep data
Creatives (their images and texts) are deleted automatically 180 days after you last opened, downloaded or edited them, and you can delete any creative yourself at any time. The cut-out of a product photo is kept so that more creatives from the same photo need no new background removal; it is deleted 180 days after it was last used.
We keep the rest of your data while the app is installed. When you uninstall it, Shopify notifies us, and 48 hours later sends a deletion request; we then delete all data of your store: store record, product snapshots, photos, cut-outs, scenes, creatives, brand settings and usage records.
Three things remain after that, none of which identifies your store:
- a one-way hash (SHA-256) of the store domain, so the free welcome credits and trial credits are not given twice;
- cost records of AI service calls, without any link to your store, for our accounting;
- usage statistics (for example “a creative was downloaded”, “a plan was started”) under a random ID; once your store record is deleted, nothing links that ID back to your store.
Technical server logs (request time, address and IP address of the requesting browser, which can include a store domain) are kept for up to 30 days to investigate errors and abuse, then deleted automatically. A nightly encrypted backup of the database and of stored images (product cut-outs, creatives, brand logos) is kept for up to 30 days: data deleted from the app, for example after you uninstall it, leaves the backups within 30 days.
Our website (pixfact.com). The public pages set no cookies and load nothing from other companies. To count visits we record the page, the referring site, campaign tags in the link (utm_*), whether the device is a phone or a computer, the first language set in the browser, the country derived from the IP address on our own server (IP geolocation by DB-IP), and a one-way hash of the IP address and browser made with a key that changes every day and is never stored: it lets us count visitors per day but not recognise anyone or follow them across days. The IP address itself is not stored. These records are deleted after 12 months.
6. Your rights
You can ask us for a copy of your data, its correction or deletion, restrict or object to processing, or ask for portability, by writing to privacy@pixfact.com. You can also lodge a complaint with your data protection authority. Uninstalling the app deletes your data as described above.
Because the app holds no data about your customers, requests Shopify forwards on behalf of customers (data access or deletion) are answered with “no data held”.
7. Security
Traffic is encrypted with TLS. Access to Shopify is limited to the two read permissions above. Requests from Shopify are verified (session tokens, signed webhooks). Shopify access tokens are stored encrypted. Internal reporting uses a read-only database account without access to access tokens.
8. AI-generated content
Backgrounds and ad texts are created with AI. Your product photo itself is not changed: the original pixels are placed on top of the generated scene. The text is checked against your product facts, but please review every creative before you publish it.
9. Changes
We will update this page when the app’s data handling changes and show the date at the top.