Privacy Policy

Data controller: HEYPRO YAPIM LİMİTED ŞİRKETİ (operating as Pixel Office; Beykoz Vergi Dairesi, VKN 4621020776; Riva Mah. Maraşal Mustafa Kemal Cad. Bl 05/50 No: 741 İç Kapı No: 2 Beykoz/İstanbul, Türkiye). Categories collected:

• Account information (name, email) — via Clerk • Service usage (office name, vertical, which Pixmates you use, brief content, output) • Technical data (IP, browser, OS, anonymous session metrics) • Guest mode (mobile): IP address and device identifiers (device ID, App Attest key ID) are processed to prevent abuse • Cookies and similar (session management, preferences)

Strictly necessary: sign-in + locale (always used) Analytics: PostHog, hosted in the EU (anonymous product usage, including click/scroll heatmaps — typed text and content are masked before collection) Session recordings (optional, via a SEPARATE checkbox): your screen interactions (clicks, scrolls, navigation) may be recorded to improve the product; everything you type and all content is masked in the recording, and admin/billing/auth/legal pages are never recorded. No recording happens without this consent. Third-party: Clerk (auth) + Whop (payments)

You can disable cookies in your browser, but parts of the service may stop working.

We use these providers to deliver the service:

• Clerk (auth) — see clerk.com privacy policy • Anthropic (AI) — see anthropic.com privacy policy • Google (AI) — see policies.google.com privacy policy • OpenAI (AI) — see openai.com privacy policy • Fireworks AI (AI) — see fireworks.ai privacy policy • Perplexity AI (AI, web research) — see perplexity.ai privacy policy • xAI (AI, X discussion summaries) — see x.ai privacy policy • TypeSafe AI (AI classification) — see typesafe.ai privacy policy • Higgsfield (AI image/video) — see higgsfield.ai privacy policy • Expo (mobile push notifications) — see expo.dev privacy policy • Whop (payments, Merchant of Record) — see whop.com privacy policy • Voyage AI (embeddings) — see voyageai.com privacy policy • Resend (transactional email) — see resend.com privacy policy • Apple (Sign in with Apple, only if you choose it; App Attest, to verify the device when a mobile trial office is opened) — see apple.com privacy policy • Vercel + Railway + Neon + Upstash + Cloudflare R2 (infrastructure, cache, and file storage) • Sentry + PostHog + Langfuse Cloud (observability)

Used only when you use the related feature: ElevenLabs (voice-over and music generation), Replicate (image/video/music generation), Stability AI (music generation), Brave Search (web search), Browser Use (cloud browser), Hunter (email address lookup), E2B (isolated code execution), SendGrid (emails a Pixmate sends with your approval), Twilio and Meta Platforms (WhatsApp channel). Purpose and region details are in the Security page.

None of these providers use your data for their own marketing. We work with each provider under its commercial terms and the data processing terms it offers. We sign a Data Processing Agreement (DPA) with our own customers on request (see the Security page).

Your briefs, files, or output are NOT used to train our AI providers' models. This commitment rests on the providers' commercial API terms: inputs and outputs sent through the API are not used to train the provider's models under those terms.

Pixel Office itself doesn't train models on user data either. Aggregated, anonymised usage metrics (e.g. "which Pixmate is hired most often") are used for platform improvements only.

Through the Google account you connect, we access only the data covered by the scopes you EXPLICITLY approve on Google's consent screen. No data is used for marketing, profiling, or third-party advertising.

The connection has two layers. The BASE connection asks for Calendar, Sheets, Analytics, Search Console and Google Ads. Gmail, Drive and Business Profile are NOT requested; you enable each one separately on the Google card in /profile, with its own short consent screen. To revoke permissions, disconnect: we then also revoke the access token at Google and stop the inbox watch.

Base connection:

• Calendar (calendar.events + calendar.readonly): read events, create events, find free slots. Calendar data isn't copied into Pixel Office's database; every call hits Google's API at request time.

• Sheets (spreadsheets): read ranges, append rows, update cells. For CRM/tracker Pixmate flows. Sheet content isn't persisted.

• Analytics (analytics.readonly): GA4 traffic / source / conversion reports. Read-only; we don't write to GA4.

• Search Console (webmasters.readonly): no site management rights — only query/click/impression/position data.

• Google Ads (adwords): account, campaign and keyword performance reports. Google grants this as a single read+write scope; Pixel Office only runs reporting queries and never creates or changes campaigns.

Permissions you enable separately:

• Gmail (gmail.modify): read mail/threads, prepare drafts, change labels, and send with your approval. Email content processed for a Pixmate's task may be kept in that task's record (the Pixmate conversation / work history) for as long as your other office content. If you turn on "Incoming email wakes a Pixmate", the sender, subject and a text excerpt of new emails are written to the Pixmate as work, and email ATTACHMENTS are saved to your office's document library; you can delete these records at any time.

• Drive (drive.readonly): list, search and read files (Docs / Sheets / Slides export + text files). Read-only; file content isn't persisted.

• Business Profile (business.manage): reads your Google Maps business locations and reviews; review replies and local posts are published ONLY with your approval.

Retention: OAuth tokens (access_token + refresh_token) are stored Fernet-encrypted in the tenant_integrations table — decrypted only inside tool invocations, never logged in plaintext.

Pixel Office's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice this means: • We use Google data only to complete the work the user's Pixmate is performing. • We do NOT use Google data for advertising, profiling, or transfer to third-party marketers. • We do NOT use Google data for AI model training — neither Anthropic / OpenAI's training, nor any Pixel Office model. • We do NOT read Google data with human eyes (outside the user's explicit consent for debug/support). • We do NOT share Google-sourced data with any other SaaS, partner, or affiliate.

You can disconnect your linked Google account at any time via the 'Disconnect' button on /profile. On disconnect: • Your OAuth tokens are deleted from the tenant_integrations table immediately. • Subsequent Pixmate calls can no longer access Google data. • We also revoke the token on Google's side and stop the Gmail inbox watch. You can double-check at https://myaccount.google.com/permissions.

To delete your entire account, do it yourself from your Profile page under "Danger Zone → Delete account": re-type your email to confirm, then delete. Deletion happens IMMEDIATELY: • Every OAuth / integration token is best-effort revoked at the provider and deleted from our database. • The offices you SOLELY own and everything in them (brief content, Pixmate output, uploaded documents, credit history, subscription + order records) are deleted. The invoice and payment transaction record are kept by Whop, the Merchant of Record, under its own terms; records we are legally required to keep for accounting may be retained in anonymised form. • For offices with other owners, only your membership is removed; rows in those offices that referenced you (e.g. payment orders you created) are anonymised (your user link is nulled). • In offices that have other members, your email address may remain in the office's audit trail (e.g. who created a record, who performed an action, to whom a message was sent), based on the legitimate interest of the office's other members in keeping those records accurate and accountable (KVKK Art. 5/2-f). These records are deleted together with the office. • Authorised Pixel Office staff may view an office's conversation content, to the extent needed, for support, billing review, security incident review and product research. Every view is logged with who viewed it, when, in which office and for what purpose; the log does not contain the conversation text. These audit records are kept so that access stays accountable; the viewing staff member's email address remains in the record even if their staff account is deleted. • Your user row (name, email, identity) is deleted entirely. Only a salted, irreversible hash derived from your email address is kept for 12 months; if you sign up again with the same address your account is created, but the welcome trial credit is not granted a second time. • Product analytics (PostHog, EU servers): usage events are kept for up to 90 days and then deleted. Deleting your account does not delete these events separately; they are removed automatically when the retention period ends. • Full deletion from backups can take an additional 90 days (rolling backup retention).

A trial office used in the mobile app without signing up is deleted 90 days after its last use; when a trial office is opened, the device is verified with Apple (App Attest).

If your JWT carries no usable email (legacy accounts), the self-serve delete may not work; in that case email an 'account deletion' request to contact@pixel-office.com.

Your briefs, Pixmate chat history, and generated output (documents, images, analyses) stay in your account until you delete them or delete your account; there is no plan-based time limit.

Output may reflect your inputs: information you write into a brief can appear inside the generated document. Keep this in mind when sharing highly confidential information.

We do not request special-category personal data (health, religion, biometric data, etc.); we recommend you keep such data out of your briefs and chats.

• HTTPS everywhere (HSTS active) • Sensitive DB fields (API keys) encrypted with Fernet • Optional 2FA via Clerk • Anomalous-session detection (Sentry + Clerk Client Trust) • The mobile app’s on-device offline cache is encrypted with SQLCipher

What is stored locally on your device: so the screen is not blank when you have no connection, the mobile app keeps the most recently viewed responses (your office, your Pixmates, your chat list) on your device for at most 7 days. Those records are encrypted with SQLCipher; the encryption key is held in the device’s hardware-backed keystore (iOS Keychain / Android Keystore). Chat drafts you have not sent yet are also kept on the device, inside the app’s protected storage. Signing out deletes all of it — including the encryption key. These local copies are not sent to us separately; they are on-device copies of responses that already belong to your account.

No system is 100% secure — please report suspected breaches to our privacy team.

Pixel Office doesn't serve users under 18. If we learn an account belongs to a minor, it will be deleted.

Data may be processed on servers outside Turkey (notably the EU and US). Such transfers happen under Standard Contractual Clauses (SCCs) and Article 9 of the Turkish KVKK.

Service notices (billing, security, critical changes) are part of the service and require no separate consent. Promotional emails, on the other hand, are sent only if you have opted in, per Turkish Law No. 6563; you can opt out at any time via the link in each email or by writing to contact@pixel-office.com. Opting out does not affect service notices.

We may use data that has been aggregated or anonymised so it no longer qualifies as personal data (e.g. "the most-hired Pixmate this month") for product development, statistics, and reporting. This data cannot be re-linked to you.

If Pixel Office becomes party to a merger, acquisition, reorganization, or asset sale, personal data may be transferred to the other party to the transaction, provided they remain bound by the protections in this policy. If such a transaction would materially change how your data is processed, you will be informed in advance.

We may update this policy from time to time; the current version is always published on this page with its "last updated" date. Material changes are announced by email or in-app notification; continuing to use the service after a change constitutes acceptance of the updated policy.

Privacy questions: contact@pixel-office.com

We respond within 30 days.