Privacy policy

This privacy policy explains how PixelSpyer ("PixelSpyer", "we", "us") collects, uses and protects personal data when you visit pixelspyer.com, create an account, use the PixelSpyer app, API or emails, or otherwise interact with us. We have written it to be read, not skimmed past. If anything is unclear, email [email protected].

Who we are

PixelSpyer is the data controller for the personal data described in this policy, except where we say otherwise. You can contact us about privacy at [email protected] or through the contact form at /contact.

What this policy covers

This policy covers personal data about:

• Visitors to our website, blog, help center and free tools.
• Customers and users who create a PixelSpyer account, on any plan.
• People who contact us, subscribe to our newsletter or join the affiliate program.

It also explains how we treat the advertising data in our ad library, which comes from the public Meta Ad Library (see "Ad data from the Meta Ad Library" below).

Personal data we collect

Data you give us

• Account data: your name, email address, password (stored only as a secure hash), and optional profile details such as company, role, country and goals. If you sign in with Google, we receive your name, email address and profile picture from Google.
• Billing data: your plan, billing interval, billing country and transaction history. Card and payment account details are collected and processed directly by our payment providers (Stripe, PayPal and Razorpay). We never see or store your full card number.
• Content you create: saved ads, boards and board descriptions, tracked brands and stores, saved searches and alert settings, and the inputs you give to AI tools.
• Communications: messages you send through the contact form or by email, and our replies.
• Affiliate data: if you join the affiliate program, your referral activity and the PayPal email address we use to pay commissions.

Data we collect automatically

• Usage data: pages and features you use, searches and filters you run, counts used against your plan limits, and actions such as saving or exporting.
• Device and log data: IP address, browser type, operating system, referring page, approximate location derived from your IP address, and timestamps. We use this to keep the service secure and working.
• Cookies and similar technologies: see our cookie policy.

How we use personal data and our legal bases

Where the EU or UK GDPR applies, we rely on the following legal bases:

Purpose	Examples	Legal basis
Providing the service	Creating your account, running searches, saving ads, sending alerts you asked for	Performance of a contract
Billing and accounting	Taking payments, issuing receipts, handling refunds, keeping tax records	Contract and legal obligation
Security and abuse prevention	Rate limiting, detecting fraud, protecting accounts, enforcing our terms	Legitimate interests
Support	Answering questions and fixing problems	Contract and legitimate interests
Improving the product	Understanding which features are used, diagnosing errors	Legitimate interests
Product and service emails	Account notices, security alerts, billing reminders	Contract and legitimate interests
Marketing emails	Newsletter, product updates, offers	Consent, or legitimate interests where the law allows for existing customers; you can unsubscribe at any time
Legal compliance	Responding to lawful requests, keeping required records	Legal obligation

When we rely on legitimate interests, we have weighed our interests against your rights and expectations. You can object at any time (see "Your rights").

Ad data from the Meta Ad Library

The ads in PixelSpyer's library come from the Meta Ad Library, a public archive that Meta publishes for transparency, including the ad repository it maintains under the EU Digital Services Act. For each ad we may store the creative and text, the advertiser's page name and public page details, dates, platforms, countries, call to action, landing page and the aggregate reach and targeting summaries Meta publishes.

• This is advertising content that advertisers have chosen to publish. Most of it relates to businesses, not individuals.
• Some ads may show people, or be run by individuals, sole traders or public figures. We process that information on the basis of our legitimate interests in providing ad research and supporting advertising transparency, and only to the extent it appears in the public archive.
• We do not collect or receive any data about the people who saw an ad.
• PixelSpyer is not affiliated with Meta.

If you appear in an ad, or you are an advertiser or rights holder and want an ad reviewed or removed from PixelSpyer, contact us with the topic "Data removal request" and a link to the ad. We review every request.

AI features

When you use AI studio or other AI features, the text you enter and the ad content you select are sent to our AI service providers to generate a response. They process this data on our behalf under contract and not to train their own models where we can configure that. Please do not enter sensitive personal data, or confidential information belonging to others, into AI tools.

How we share personal data

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We share it only with:

• Service providers (processors) who help us run PixelSpyer: hosting and database infrastructure, email delivery, payment processing (Stripe, PayPal, Razorpay), AI model providers, and error monitoring and analytics tools. They may only use the data to provide services to us.
• Payment providers as independent controllers where they process your payment data under their own privacy policies, for example for fraud prevention and regulatory compliance.
• Professional advisers such as lawyers and accountants, under confidentiality.
• Authorities, when we are legally required to, or to protect the rights, safety and property of our users, the public or PixelSpyer.
• A buyer or successor if PixelSpyer is involved in a merger, acquisition or sale of assets, subject to this policy.

If you make a board public, anyone with the link can see the board's name, description and the ads saved to it.

International transfers

Our providers may process data outside your country, including outside the European Economic Area and the UK. When we transfer personal data from the EEA or UK to a country without an adequacy decision, we use appropriate safeguards such as the European Commission's standard contractual clauses and the UK addendum, together with additional measures where needed.

How long we keep data

• Account data and content are kept while your account is open. When you delete your account, we delete or anonymise it within 30 days, except where we need to keep some of it for the reasons below. Backups are overwritten on a rolling basis.
• Billing records are kept for as long as tax and accounting law requires, which is often between six and ten years depending on the country.
• Security and server logs are kept for a limited period, normally no longer than 12 months.
• Contact messages are kept for as long as needed to handle your request and for a reasonable period afterwards, normally up to 24 months.
• Marketing preferences are kept until you unsubscribe, after which we keep a suppression record so we do not email you again.

How we protect data

We use encryption in transit (HTTPS), hashed passwords, access controls, rate limiting and audit logs for staff actions. Access to personal data is limited to people who need it to run the service. No system is perfectly secure, so please use a strong, unique password and tell us straight away if you suspect your account has been compromised.

Your rights

If the EU or UK GDPR applies to you, you have the right to:

• Access the personal data we hold about you and receive a copy.
• Rectify inaccurate or incomplete data.
• Erase your data, for example by deleting your account in settings.
• Restrict our processing in certain circumstances.
• Data portability, to receive data you gave us in a structured, machine-readable format.
• Object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent where we rely on consent, without affecting earlier processing.
• Complain to your local data protection authority. We would appreciate the chance to address your concern first.

To exercise any right, email [email protected] from the address on your account, or use the contact form. We may need to verify your identity, and we will respond within one month, or tell you if we need longer as the law allows.

Depending on where you live, for example in some US states, you may have similar rights to know, correct and delete your data, and to opt out of the sale or sharing of personal data. We do not sell or share personal data in that sense. You can exercise your rights through the same contact details, and we will not discriminate against you for doing so.

Children

PixelSpyer is a business tool and is not intended for anyone under 16. You must be at least 18, or the age of majority where you live, to buy a paid plan. We do not knowingly collect data from children; if you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

We may update this policy as the product and the law change. We will post the new version on this page with a new "Last updated" date, and if the changes are significant we will tell you by email or in the app before they take effect.

Contact

Questions, requests or complaints about privacy: [email protected] or /contact.