Privacy Policy

Welcome to Pixelmojo ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website pixelmojo.io (the "Site") and use our services.

By using our Site, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our policies and practices, please do not use our Site.

→ Personal Information You Provide

We collect personal information that you voluntarily provide to us when you:

• Fill out our contact form
• Use our AI chatbot assistant
• Subscribe to our newsletter
• Request a quote or book a consultation
• Communicate with us via email

This information may include:

→ Automatically Collected Information

When you visit our Site, we automatically collect certain information about your device and browsing behavior.

→ Chat Conversation Data

When you interact with our AI chatbot, we collect and store:

→ Service Diagnostics

To operate our services reliably, we keep internal diagnostic records, including email delivery and failure logs, payment webhook events received from Paddle (billing metadata only — never card details), tool-run activity records, and provider error telemetry. Error telemetry is scrubbed of personal information before it is stored. Diagnostic records are accessible only to authorized administrators and are used only to operate, secure, and support the service.

→ Cookies and Tracking Technologies

We use cookies and similar tracking technologies to maintain sessions, analyze usage, and remember preferences.

→ Analytics and Regional Consent

Analytics information covers how our website and the Radar product are used: pages viewed, general device and browser characteristics, approximate location, and product events such as starting an audit or exporting a report. We use it to understand website and product usage, diagnose technical and product issues, measure performance, evaluate user journeys and conversion behavior, and improve the website and the Radar product. The analytics providers that may process this information are Google Analytics 4, Microsoft Clarity, PostHog, and Vercel Analytics (which is cookieless and cannot identify you).

Depending on your location, we apply different requirements to analytics technologies. Where applicable law requires prior consent, including the EEA, the United Kingdom, and Switzerland, non-essential analytics technologies remain disabled until you provide permission. In other regions, analytics may be active when you access the website, and you may opt out at any time through the Cookie Settings link in the footer of every page. A previously recorded rejection or opt-out will always be respected, regardless of the regional default. If we cannot determine your location, we apply the prior-consent rule.

Where prior consent is required, your consent is our legal basis for analytics processing, and you can withdraw it at any time through Cookie Settings. In other regions we process analytics information on the basis of our legitimate interest in understanding and improving our website and products, where permitted by applicable law, always combined with clear notice and the ability to opt out. Full details of each analytics service, what it stores, and for how long are in our Cookie Policy.

When analytics is permitted for you, we also keep a customer-journey record of our own. A random identifier stored in your browser's local storage (pm_visitor_id) is linked in our database to a hashed copy of the email address you verify for a free tool, pay with, or use for a signed-in paid audit, and to the first time each of those steps happened. If you arrived from an AI assistant such as ChatGPT, the same identifier is also linked to which assistant sent you, the referring address, the page you landed on and any campaign tags. The hash is not salted, so it is pseudonymised personal data, not anonymous data. We use this record only to measure how visitors become customers. It never decides access, credits, pricing or which emails you receive. We do not send the identifier to PostHog, Google, Microsoft or any advertising platform. We do send it to Paddle, our payment provider, with your checkout, so a payment can be matched to its journey. When you withdraw analytics consent, your browser deletes the identifier and asks our server to delete the linked record, retrying on later visits until we confirm. We then delete the email hashes, the step times and the AI-assistant record, and keep only the random identifier and the time you withdrew, so nothing new is linked to it. We delete journey records, including that marker, 13 months after we first saw the identifier. Payment records are kept separately, as our accounting obligations require, and withdrawing consent does not remove the identifier from Paddle's record of your payment or from our stored copy of Paddle's payment notification.

Separately from these analytics services, we keep a small first-party record of consent banner activity so we can verify the consent controls work, measure whether visitors can successfully make privacy choices, diagnose failures in the consent interface, and distinguish banner exposure from acceptance, rejection, and opt-out. Each record contains exactly three fields: the event type (banner_shown, accepted, rejected, opted_out, preference_changed, or policy_applied), the regional policy that applied (prior-consent or notice-opt-out), and a server-generated timestamp. No email address, user or account identifier, session identifier, IP address, user agent, page URL, or free text is recorded, so these records cannot be linked to you and are not user-level tracking.

We use the information we collect to:

→ Data We Collect Through Radar

When you use Radar by Pixelmojo, we collect: the domain name you submit for auditing, your email address (if you request an access token or email report), your brand name (if provided), and your audit results including tool scores, action items, and insights.

We do not collect or store payment card information. All payments are processed by Paddle.com, our Merchant of Record.

→ Third-Party AI Services

Radar queries the following third-party AI services on your behalf to perform citation and visibility analysis:

Your submitted domain name is sent to these services as part of the audit process. We also scan publicly available Reddit and YouTube content to surface brand mentions. We do not sell or share your data with these services beyond what is required to perform the audit.

→ Radar Data Retention

Audit results are retained while the associated report or account remains active; some free-report links expire and become inaccessible after approximately 30 days. You may request deletion of your audit data at any time by emailing founders@pixelmojo.io.

→ Payments

Payments for Radar credits are processed by Paddle.com, who acts as the Merchant of Record. Pixelmojo does not store or process your payment card information. For billing inquiries, contact Paddle support directly. For all other payment questions, email founders@pixelmojo.io.

Our public Ask API and MCP integration answer questions using published Pixelmojo information. They do not require an account or retrieve private customer or account records. OpenAI processes your sanitized question to find relevant content and, when context is available, processes the question and that public content to generate an answer. Sanitization removes markup; it does not anonymize any personal information you include in your question.

In our Ask database logs, MCP question text is replaced by a fixed placeholder. Questions sent through the REST Ask API are stored sanitized and truncated to 500 characters. These records store the answer length, not the generated answer text. Supabase stores these records with operational metadata, including outcome, latency, matched-source counts, confidence, model, request method and channel, user agent, and a keyed IP pseudonym. Raw IP addresses are not stored in these Ask log records.

Separately, Upstash processes the trusted client IP address in rate-limit counter keys. These counters currently limit Ask executions to 10 per minute and 50 per day across REST and MCP, and expire after their 60-second or 24-hour window. Clients that share an IP address share these limits.

We do not currently run an automatic purge of Ask database logs. The retention criteria and deletion rights elsewhere in this policy apply to these records. This describes our application logs; your chosen AI client and our service providers have their own data handling policies. Contact privacy@pixelmojo.io for data requests.

We use trusted third-party services to operate our Site and provide our services. These services may have access to your personal information only to perform specific tasks on our behalf.

Service Providers We Use

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required by law.

Rather than fixed periods, we apply retention criteria:

You may request deletion of your personal information at any time by emailing privacy@pixelmojo.io. We action verified requests within 30 days.

Depending on your location, you may have the following rights regarding your personal information:

We do not sell or share your personal information, including as "sale" and "sharing" are defined under the California Consumer Privacy Act.

This Privacy Policy is governed by the laws of the Republic of the Philippines, including the Data Privacy Act of 2012 (Republic Act No. 10173).

If you have questions or complaints regarding your data privacy rights under Philippine law, you may contact the National Privacy Commission (NPC) at privacy.gov.ph.