Privacy policy
Last updated: [date]
This policy explains how [PXL legal entity name] ("PXL", "we") processes personal data as controller when you visit this website or use a PXL Consent account. When PXL Consent records consent from visitors to our customers' websites, we are the customer's processor: see the data processing agreement and the privacy policy of the website you visited.
Contact
[contact address and, if appointed, data protection officer]
What we process and why
| Data | Purpose | Legal basis | Kept |
|---|---|---|---|
| Name, email address, organisation, role | Providing your account and the service | Contract (Art. 6(1)(b)) | While the account exists, then [period] |
| Password hash, passkey public keys, two-factor secrets, recovery codes | Secure sign-in | Contract; legitimate interest in security (Art. 6(1)(f)) | Until you remove them or the account is deleted |
| Session cookie, sign-in times, IP address of security events | Keeping you signed in, detecting misuse, security alerts | Legitimate interest in security | [period] |
| Audit log of administrative actions (who changed what, when) | Accountability towards customers, security | Legitimate interest | [period] |
| Billing contact, subscription and payment status | Billing | Contract; legal obligation for accounting records (Art. 6(1)(c)) | As required by the Norwegian Bookkeeping Act |
| Emails you send us | Support | Legitimate interest | [period] |
Cookies on this website
This website and the dashboard use only cookies that are strictly necessary: a session cookie that keeps you signed in. We use no analytics or advertising cookies here, so there is no cookie banner.
The signup form uses Cloudflare Turnstile to keep bots out. It runs a check in your browser and is used only to protect the form.
Recipients
| Recipient | Why |
|---|---|
| Hetzner Online GmbH (Germany) | Hosting |
| Cloudflare, Inc. | Network protection, CDN, bot protection on signup |
| Stripe Payments Europe, Ltd. | Payments and invoices, as an independent controller for payment data |
| [email provider] | Sending account and security emails |
Where a recipient processes data outside the EEA, the transfer is covered by the EU Standard Contractual Clauses or an adequacy decision.
Your rights
You can ask for access to, correction or deletion of your personal data, restriction of or objection to processing, and a copy of data you gave us in a portable format. Much of it you can see and change yourself under Account. Contact us to use your rights. You can complain to Datatilsynet (datatilsynet.no).
Changes
We will post changes to this policy here, and email account holders about significant changes.