Privacy Policy
Last updated: September 2026
1. Who we are
Pix Online ("we", "us") runs pix-online.com, a gallery platform for photographers, and is based in Israel. For the personal data of photographers who hold an account with us, and of visitors to our website, we are the data controller. For the photos and personal data of a photographer's own clients and guests, the photographer is the controller and we act only as their processor, on their instructions. Contact: support@pix-online.com
2. What we collect
Photographers: name, email address, business name, username, country, language, password (stored hashed by our authentication provider), sign-in method, subscription and payment status, and the photos, galleries, forms and messages you create or upload. How you found us: if you arrive from an advertisement or link, we keep the campaign parameters (such as utm values or an ad-click identifier), the page you first landed on and the time you signed up, so we can tell which channels bring photographers to us. Clients and guests of photographers: the photos in a gallery, and details a photographer or a client enters, such as a name, email address, favourite selections or form answers. Technical data: IP address, device and browser type, and basic logs needed to keep the service secure and running.
3. Photos of your clients and guests, and face grouping
When a photographer uploads photos, the photographer decides what is uploaded and who can see it, and is responsible for having a lawful basis to do so, including telling the people photographed. Our platform can group photos by the faces that appear in them so a guest can find their own photos. This creates a numerical face template, which is biometric data and a special category of personal data under UK and EU law. It is used only to group and find photos within that one gallery, never to identify a person outside it, and is not shared or sold. The photographer is responsible for having the explicit consent of the people photographed where this feature is used, and can switch it off. These templates are deleted automatically a few months after a gallery is created; the photos themselves stay until deleted or until the retention period below ends. A guest who does not want their face grouped can ask us or the photographer to remove it.
4. Why we use your data, and our legal basis
To create your account and provide the service, including storing and delivering galleries and taking payment: performance of our contract with you. To keep the service secure, prevent abuse and fix problems, and to understand in general how the service is used: our legitimate interests. To send service messages such as a welcome email, receipts, security notices and gallery delivery: performance of our contract, and our legitimate interests. To measure how well our advertising works: your consent, which you can refuse or withdraw at any time without affecting your use of the service. To meet legal obligations, such as tax and accounting records: legal obligation. Face grouping in a photographer's gallery: the photographer's lawful basis and explicit consent of the people photographed, as set out in section 3.
5. Cookies and advertising measurement
Strictly necessary: we use browser storage to keep you signed in, remember your language and remember your cookie choice. These do not need consent. Advertising measurement: when you visit our public marketing and sign-up pages, we ask whether you agree to a measurement cookie from OpenAI (used for ads shown in ChatGPT). Until you press "Accept", it sends nothing and sets no tracking cookie. If you accept, OpenAI receives information about your visit and, when you sign up as a photographer, that a sign-up happened, so we can see which ads led to registrations. OpenAI may also derive matching data from details on the page. We do not load it on galleries, stores, forms or a photographer's dashboard, so your clients' and guests' details are never sent to it. To change your choice, clear this site's data in your browser, after which the notice appears again, or contact us.
6. Who we share data with
We do not sell your personal data. We share it only with service providers who process it for us under contract: cloud hosting and delivery (Vercel, Cloudflare), database and authentication (Supabase), file storage (Cloudflare R2), email delivery (Resend), payment processing (PayPal), a server we operate for face grouping, and, only with your consent, OpenAI for advertising measurement. We may disclose data where the law requires it, or to protect our rights, and to a successor if our business is sold, with the same protections.
7. International transfers
We are based in Israel, and our providers operate in several countries, including the United States. The UK and the European Commission have each recognised Israel as providing an adequate level of data protection. Where data goes to a provider in another country without an adequacy decision, we rely on approved safeguards, such as the EU-US Data Privacy Framework or the standard contractual clauses (with the UK addendum or the UK International Data Transfer Agreement for UK data). You can ask us for details of the safeguards.
8. How long we keep data
Account data is kept while your account is open and deleted or anonymised after it is closed, except what we must keep for tax and legal reasons, such as billing records, for the period the law requires. Photos and galleries are kept until you delete them or close your account, and may be moved to archive storage or removed automatically after a retention period. Face templates are deleted automatically as described in section 3. Advertising-source data is kept with your account record. Security and error logs are kept for a short period.
9. Security
We use encryption in transit and access controls on our database and file storage. No system is completely secure, so we also work to detect and respond quickly to problems. If a personal data breach puts your rights at risk, we will notify you and the relevant authority as the law requires.
10. Your rights
If you are in the UK or the European Economic Area, you have the right to: be informed about how we use your data; access a copy of it; have inaccurate data corrected; have it erased; restrict how we use it; receive it in a portable format; object to processing based on our legitimate interests; and withdraw consent at any time. You also have the right not to be subject to a decision based solely on automated processing that significantly affects you, and we do not make such decisions. To use a right, email support@pix-online.com. We will reply within one month. If you are a client or guest of a photographer, we may pass your request to that photographer, who controls your data. You can complain to your data protection authority: in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, the authority in the country where you live or work. We would appreciate the chance to resolve your concern first.
11. Children
The service is for photographers and is not directed at children under 16. We do not knowingly collect data from them for our own purposes. Photos of children uploaded by a photographer are the photographer's responsibility, and a parent or guardian can contact us or the photographer to have them removed.
12. Changes to this policy
We may update this policy from time to time. We will change the date above, and tell you by email or a notice on the platform about material changes, and ask again for your consent where the law requires it.