Privacy Policy

This policy explains how [Company legal name] (“Pixnesto”, “we”) handles personal data, in line with the EU General Data Protection Regulation and UK GDPR (“GDPR”), India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) and other data protection laws that apply where our users live. It covers two groups of people:

• Studios and their team members who sign up and use Pixnesto. For this data, we are the controller (the “data fiduciary” under the DPDP Act).
• Studios’ clients (for example a couple whose wedding a studio shoots, and family members who open a gallery). The studio decides why and how this data is used, so the studio is the controller (data fiduciary) and we act as its processor.

• Account data: name, email, password (stored only as a secure hash), phone number if you add it, studio name, country, address and tax ID (such as a GSTIN or VAT number).
• Studio content: clients, enquiries, quotes, shoots, invoices, payments, expenses and photos you upload.
• Billing data: plan, billing country and currency, invoices and payment status. Card, UPI and bank details are handled by Razorpay for domestic INR Pixnesto subscriptions. Client online payments are unavailable at launch.; we do not store full card numbers.
• Usage and device data: log-ins, IP address, browser and device type, and error reports, used to keep the Service secure and working.
• Gallery visitors: the photos a visitor selects or favourites, and basic technical data needed to deliver the gallery. Visitors do not need an account.

We use personal data only for these purposes:

• to provide the Service you signed up for, including sending the quotes, invoices and galleries you ask us to send;
• to process subscription payments and issue invoices with the right tax (GST, VAT or sales tax);
• to show prices for your country, using the approximate location from your IP address or your choice;
• to keep accounts secure, prevent fraud and fix problems;
• to send essential service emails (for example billing, security and gallery-expiry warnings);
• to show advertisements inside the workspace of studios on the Free plan (see section 5); and
• to meet legal obligations, such as tax record keeping.

Under the GDPR our legal bases are: performing our contract with you, our legitimate interests in running a secure and reliable service, your consent where we ask for it (for example for non-essential cookies), and legal obligations. Under the DPDP Act we rely on your consent given at sign-up and on legitimate uses it permits. We do not sell personal data.

If you are a studio, you are responsible for having a lawful basis, and where required, the consent of your clients before you add their details or photos to Pixnesto, and for answering their requests about that data. We will help you do so: we process your clients’ data only on your instructions, keep it confidential, and never use it for advertising or share it with advertisers.

On the Free plan, ads appear only inside the studio workspace, provided by [Ad partner name]. Ads are never shown in galleries, quotes, invoices, payment pages or emails your clients receive. Ad partners may use limited technical data (such as device type and approximate location) from the studio user’s browser to show and measure ads; they never receive your clients’ data or your studio content. Pro studios see no ads.

We share personal data only with service providers who help us run Pixnesto, under contracts that require them to protect it:

• cloud hosting and storage ([Hosting provider and region(s)]);
• payments (Razorpay for domestic INR Pixnesto subscriptions. Client online payments are unavailable at launch.);
• email and messaging delivery ([email provider]);
• error monitoring and analytics ([providers]); and
• advertising, limited as described in section 5.

We may also disclose data when the law requires it, for example to comply with a valid order from a competent authority.

Data is stored with [Hosting provider and region(s)]. When data is transferred to another country, we protect it as the law requires, for example with the European Commission’s Standard Contractual Clauses (and the UK addendum) for transfers out of the EU and UK, and only as permitted under the DPDP Act for data from India.

We keep data while your account is active. After you close your account we delete or anonymise it within [number] days, except where we must keep it longer by law (for example, tax invoices for the period required by tax law).

We use encryption in transit (HTTPS), hashed passwords, access controls by role, secure session cookies and regular backups. If a personal data breach occurs, we will inform affected users and the regulators the law requires (for example an EU/UK supervisory authority within 72 hours, or the Data Protection Board of India).

Depending on where you live (for example under the GDPR or the DPDP Act), you have the right to:

• access a summary of your personal data and how it is processed;
• correct, complete, update or erase your personal data;
• withdraw consent at any time (this will not affect processing already done);
• object to or restrict certain processing, and receive your data in a portable format;
• in India, nominate another person to exercise your rights in case of death or incapacity; and
• have your grievance addressed by our Grievance Officer.

Studios can export or delete most data directly in the app. Studios’ clients should contact the studio first; we will help the studio respond. To make a request, email [privacy@pixnesto.com].

Pixnesto accounts are for adults. Studios may hold photos of children taken at events they cover; the studio is responsible for obtaining consent from a parent or lawful guardian where the law requires it (for example under the GDPR or the DPDP Act).

We use essential cookies to keep you signed in securely and to remember preferences such as your theme and the pricing region you chose. Where the law requires it, we ask before setting non-essential cookies. Free workspace pages may also use cookies set by our ad partner. We do not use cookies on client galleries for advertising.

Grievance Officer: [Grievance Officer / Data Protection Officer name]
Email: [privacy@pixnesto.com]
Address: [Registered office address]

We will acknowledge your grievance within 48 hours and aim to resolve it within [30] days. If you are not satisfied, you may complain to your data protection authority, for example a supervisory authority in the EU, the UK Information Commissioner’s Office, or the Data Protection Board of India. EU/UK representative: [EU/UK GDPR representative, if required].

We may update this policy and will email you about material changes. See also our Terms of Service.