Privacy Policy

This policy explains what PixelMagic collects when you use our website, apps, API, MCP server and plugins (the “Service”), why, and what we do with it. The Service is operated by PixelMagic, S2 Jayavijaya Apts, 5th St, Chennai, Tamil Nadu, 600100, India (“we”, “us”).

What we collect

• Account data — your email address, a display name and profile picture if you add them, your plan, and team or workspace membership.
• Your content — images, videos, audio and documents you upload; the prompts and instructions you write; masks and reference images; and the images, videos and layers the Service creates for you.
• Usage and security data — credits used, jobs and their status, timestamps, your IP address, approximate country, browser type, and security events such as failed sign-ins. We use these to run the Service, prevent abuse and fraud, and fix problems.
• Payment data — handled by our payment processors (Razorpay for India; Paddle, our merchant of record, for other countries). We never see or store your full card details; we keep only payment references and what you bought.
• Connected services — if you connect Google Drive, Dropbox or your own S3-compatible storage, we store the access tokens or keys needed to save files there, encrypted.
• API keys — we store only a hash and a short prefix of each key, never the key itself.
• Messages — emails and support or refund requests you send us.

How we use it

To provide the Service (process your requests, store your library, meter credits), to support you, to keep the Service secure and prevent abuse, to send transactional emails (for example “your batch is ready”), to improve reliability and pricing using aggregated usage, and to meet legal and tax obligations.

We do not use your content to train AI models, and we do not sell your personal data. We do not use advertising trackers.

AI processing

To produce your results, your content and prompts are sent to the AI model that handles your request. Some models run on servers we operate; others are provided by third-party AI infrastructure providers that process the content on our behalf, solely to return the result to us. We choose providers that do not use API content to train their models. Some features, such as prompt enhancement, AI video composition and the daily news summaries on our Knowledge pages, use third-party large language models.

Where it's stored

Files are stored in private Cloudflare R2 storage and served only through short-lived signed links or to your signed-in account. Account and usage data are stored in Supabase (PostgreSQL) with row-level security, so each account can only reach its own records.

Retention

Original uploads are automatically deleted 30 days after processing. Results stay in your library until you delete them or close your account. Security logs are kept for a limited period to protect the Service. Deleting your account (from Account settings) removes your content, files and personal data. We keep your payment and invoice records (amounts, dates, plan and payment IDs) after account deletion, as required for tax and accounting. Records our payment processors keep for tax, payment or legal reasons are held by them under their own policies.

Who processes data for us

We share the minimum data needed with service providers that act on our instructions:

• Supabase — database and authentication
• Cloudflare — file storage (R2), bot protection on sign-in (Turnstile) and some AI image generation
• Vercel — website hosting
• Modal — GPU servers for the models we run ourselves
• Trigger.dev — background jobs such as bulk processing and workflows
• Resend — transactional email
• Razorpay and Paddle — payments
• Third-party AI infrastructure and language-model providers — processing of AI requests, as described above

A current list of the AI providers we use is available on request. Some of these providers are located outside your country, including in the United States; where required, we rely on appropriate safeguards for these transfers.

Your rights

You can access, correct, export (“Download my data”) or permanently delete your data yourself from your Account settings, or by contacting us. If you are in the EEA or UK you also have the right to object to or restrict processing and to complain to your data protection authority. If you are in India, you have the rights given by the Digital Personal Data Protection Act, 2023, including correction, erasure and grievance redressal.

Cookies and local storage

We use essential cookies to keep you signed in and to protect sign-in from bots, and your browser’s local storage to remember app settings and drafts. Our payment providers set their own cookies during checkout. We do not run advertising or cross-site tracking cookies.

Children

The Service is not directed at children under 18 and we do not knowingly collect their data.

Changes

We will post any changes here and update the date above. Material changes will be emailed to you.

Contact

Privacy questions, requests or grievances: contact us or email support@pixelmagic.studio.