Privacy Policy
Effective date: 2026-04-16
1. Data controller
The data controller for your personal data is Dropdata SpA, with registered office at Av. Providencia 1208, Oficina 1503, Santiago, Región Metropolitana 7500000, Chile. To exercise your rights or raise questions, write to admin@skalepix.com.
2. Data we collect
- Account data: name, email, hashed password, Supabase identifier, preferred language.
- Billing data: handled by Paddle. We only store the Paddle customer ID, subscription ID, active plan, status, and billing period. We do not store card numbers.
- Product data: store URLs, imported products, Brand DNA (colours, typography, tone), uploaded images, and prompts.
- Generated outputs: images, copy, landing pages, and descriptions produced by AI, stored in Supabase Storage.
- Technical data: IP address, user agent, API request logs, errors — retained for security and diagnostics.
- Cookies: session, language preference, aggregated analytics. Details in our Cookie Policy.
3. Legal bases (GDPR / equivalents)
- Contract performance (Art. 6(1)(b) GDPR): providing the Service, account management, generation and delivery of outputs, billing.
- Legitimate interest (Art. 6(1)(f) GDPR): security, fraud prevention, product improvement, aggregated analytics.
- Consent (Art. 6(1)(a) GDPR): non-essential cookies, marketing communications.
- Legal obligation (Art. 6(1)(c) GDPR): retention of accounting and tax records.
4. How we use your data
- Administer your account and authenticate you.
- Process prompts and reference images through AI providers to produce requested outputs.
- Manage subscriptions, credits, and billing through Paddle.
- Send transactional notifications (sign-up, plan changes, payment failures, security alerts).
- Detect abuse, fraud, and AUP breaches.
- Produce anonymised aggregated statistics to improve the Service.
5. Subprocessors
We share strictly necessary data with the following providers:
| Provider | Purpose | Location |
|---|---|---|
| Supabase, Inc. | Database, authentication and file storage | USA / EU |
| Google LLC (Gemini API) | Image generation via Gemini models | USA |
| Anthropic, PBC (Claude API) | Copy generation, brand analysis and descriptions | USA |
| Fal AI, Inc. | Background removal and image processing | USA |
| Paddle.com Market Limited | Payment processing and Merchant of Record (MoR) | UK / Global |
| Vercel, Inc. | Hosting, CDN and operational logs | USA / Global |
6. International transfers
Some subprocessors are located outside the European Economic Area and Chile. Such transfers are carried out under the European Commission's Standard Contractual Clauses (SCCs) or equivalent safeguards. You may request a copy of these mechanisms by writing to admin@skalepix.com.
7. Retention periods
- Account data and generations: while the account is active and up to 30 days after closure.
- Billing records: 6 years, as required by tax obligations.
- Technical and security logs: up to 90 days.
- Encrypted backups: up to 35 days after deletion.
8. Your rights
You are entitled to:
- Access the personal data we hold about you.
- Rectify inaccurate data.
- Request erasure ("right to be forgotten").
- Object to or restrict processing.
- Receive your data in a structured, machine-readable format (portability).
- Withdraw consent where it is the legal basis.
- Lodge a complaint with a competent authority (in the EU, your national DPA).
Exercise your rights by writing to admin@skalepix.com. We will respond within 30 days.
9. California residents (CCPA/CPRA)
If you are a California resident, you have the right to know what categories of personal data we collect, to request deletion, and to opt out of the sale or sharing of your data. SkalePix does not sell personal data. To exercise your rights, write to admin@skalepix.com.
10. Security
We apply reasonable technical and organisational measures: TLS 1.2+ in transit, encryption at rest for database and storage, Row Level Security in PostgreSQL, role-based access control, key rotation, and audit logs. No system is 100% secure: we will notify you of any personal data breach affecting you within 72 hours of detection.
11. Children
The Service is not directed at individuals under 16. We do not knowingly collect data from minors. If we discover that a minor has created an account, we will delete it.
12. Changes to this Policy
We may update this Policy from time to time. Material changes will be notified at least 15 days in advance by email or in-app.
13. Contact
Contact: admin@skalepix.com
Postal address: Av. Providencia 1208, Oficina 1503, Santiago, Región Metropolitana 7500000, Chile.