Privacy Policy

1. Who we are

Mypixia, LLC ("Mypixia", "we", "us", "our") operates the marketplace at https://mypixia.com (the "Site") and the merchant back-office at merchant.mypixia.com. For the personal information described in this policy, Mypixia, LLC is the controller.

Products sold on the Site are made by independent sellers. For the order information a seller needs in order to produce and ship your item, that seller is an independent controller of the data they receive. This policy covers what Mypixia does; a seller's own use of your data is governed by their privacy notice.

Mypixia, LLC
5960 Fairview Road, Suite 300
Charlotte, NC 28210, United States
Privacy contact: [email protected]

2. What we collect

2.1 Information you give us

• Account details — name, email address, password (stored hashed), and, if you use social sign-in, the basic profile information that provider returns to us (name, email, and the provider's user identifier).
• Contact and delivery details — shipping address, billing address, phone number.
• Payment details — processed by Stripe. We receive and store a payment token, the card brand and last four digits, and the transaction result. We never receive or store your full card number, CVC or bank credentials.
• Designs and uploads — the artwork, text, photographs and other images you create in the design editor or upload to your uploads library.
• Messages — the content of chats and collaborative design sessions with sellers, and any support enquiry you send us.
• Reviews — the rating and review text you publish about a product.

2.2 Information created by using the service

• Order records — items, options, prices, production method, shipment and tracking information, returns and refunds.
• Technical and usage data — IP address, browser and device type, operating system, timestamps, pages viewed, referring page, and error diagnostics.
• Cookie and analytics data — only to the extent you have consented; see section 8.

2.3 In-store kiosks

Some sellers operate a Mypixia self-service kiosk in their physical shop. If you use one, we process the design you create, any photograph you send to the kiosk from your phone, and the order details needed to print your collection ticket. Kiosk upload sessions and their images are automatically deleted after a short period. Payment is taken by the shop at their own till, not on the kiosk.

2.4 What we do not collect

We do not collect identity documents, passports, driving licences, selfies, biometric data, government identification numbers, or precise geolocation from customers. Sellers who take payouts are verified by Stripe directly — those documents go to Stripe and never to Mypixia.

3. How and why we use it

If you are in the EEA, the UK or Switzerland, the "legal basis" column is the ground we rely on under Article 6 of the GDPR.

Automated decision-making. We do not make decisions producing legal or similarly significant effects about you by automated means alone. Design and review moderation may be assisted by automated screening, but a person decides any rejection and you can contest it using the contact details in section 14.

Do you have to give us this? The account, delivery and payment information marked as required is needed to form and perform our contract with you — without it we cannot take your order. Everything else is optional.

4. Design tools and AI generation

The design editor includes optional AI features that generate or modify images. When you use them, the prompt you type and the image you supply are sent to our AI processing provider, which acts as our processor, to produce the result. We use these inputs to fulfil your request and to investigate misuse; we do not use your designs to train our own models, and our agreement with that provider does not permit them to train their models on it.

Images produced by these features are generated by artificial intelligence. Where the law requires it, AI-generated output is labelled as such.

5. Who we share it with

We do not sell your personal information for money. We disclose it to the following categories of recipient:

• The seller who makes your order — your name, delivery address, order contents and the design files needed to produce it.
• Payments — Stripe, Inc. (payment processing, fraud checks, refunds).
• Hosting and storage — our cloud infrastructure provider, which runs the platform and stores design and product images.
• Sign-in — our authentication provider, and the social sign-in provider you choose if you use that option.
• AI image generation — our AI processing provider.
• Email delivery — our transactional and campaign email provider.
• Shipping — carriers and label providers used to deliver your order and to issue prepaid return labels.
• Analytics — Google Analytics, only where you have consented.
• Professional advisers, authorities and successors — where required by law or legal process, to establish or defend legal claims, or in connection with a merger, acquisition or sale of assets.

The categories of provider we use are set out at mypixia.com/subprocessors. The detailed list — each named provider, its role, its location and the transfer safeguard relied on — is available on request from [email protected] or via our privacy request form.

6. International transfers

Mypixia is based in the United States and our infrastructure and service providers are largely located there. If you are in the EEA, the UK or Switzerland, your personal information will be transferred outside your country.

Where we make such a transfer we rely on one of the following safeguards: the European Commission's Standard Contractual Clauses (Decision 2021/914), together with the UK International Data Transfer Addendum for UK transfers; an adequacy decision where one applies to the recipient; or, for certified recipients, the EU–US Data Privacy Framework and its UK Extension and Swiss–US equivalent. You can request a copy of the relevant safeguard using the contact details in section 14.

7. How long we keep it

8. Cookies and similar technologies

We use strictly necessary cookies to sign you in, keep your cart and protect the Site. These do not require your consent because the Site cannot work without them.

Analytics, preference and marketing cookies are only set after you agree. When you first visit we show a banner where you can accept all, reject all in one click, or choose individual categories. Rejecting is as easy as accepting, and nothing non-essential loads until you choose. You can change or withdraw your choice at any time on the Cookie Policy page, which also sets out each group of cookies we use, who sets them, what they do and how long they last, and how to ask us for the cookie-by-cookie detail.

We honour the Global Privacy Control (GPC) browser signal. If your browser sends it, we treat it as an opt-out of analytics and marketing cookies and, for US state-law purposes, as a valid request to opt out of "sale" and "sharing".

9. Security

We use technical and organisational measures appropriate to the risk, including encryption in transit, hashed passwords, access controls, optional multi-factor authentication on accounts, and separation of payment data into Stripe's environment. No system is perfectly secure, so we cannot guarantee absolute security.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of it, and will notify you without undue delay where the breach is likely to result in a high risk to you.

10. Your rights (EEA, UK and Switzerland)

You have the right to:

• Access a copy of the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase your data ("right to be forgotten"), subject to records we must keep by law;
• Restrict our processing in certain circumstances;
• Object to processing based on our legitimate interests, and to object to direct marketing at any time and absolutely;
• Data portability — receive the data you gave us in a structured, commonly used, machine-readable format, and have it sent to another controller where technically feasible;
• Withdraw consent at any time, without affecting processing already carried out on that basis;
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

To exercise any of these, email [email protected] or use our privacy request form. We may ask for information to verify your identity. We respond within one month, extendable by two further months for complex requests, and we will tell you if we need the extension. Exercising your rights is free unless a request is manifestly unfounded or excessive.

11. Your rights (United States)

11.1 Notice at collection

This section, together with section 2, is our notice at collection for the purposes of the California Consumer Privacy Act as amended by the CPRA. The categories below use the statutory California categories.

Sensitive personal information. We do not collect sensitive personal information from customers, and we do not use or disclose any for purposes that would require us to offer a "Limit the Use of My Sensitive Personal Information" choice.

11.2 Sale and sharing

We do not and will not sell personal information for money, and we have not done so in the preceding 12 months. We also do not knowingly sell or share the personal information of consumers under 16.

Analytics and advertising cookies may constitute "sharing" for cross-context behavioural advertising, or a "sale" or "targeted advertising" under some state laws. We therefore only run them where you have opted in, and you can opt out at any time via Do Not Sell or Share My Personal Information or by sending a Global Privacy Control signal, which we honour automatically.

11.3 Your rights and how to use them

Depending on where you live, you may have the right to know or access, delete, correct, obtain a portable copy, opt out of sale/sharing/targeted advertising and profiling, limit the use of sensitive information, and not be discriminated against for exercising any of them. We will never deny you goods or services, charge you a different price or give you a lower quality of service because you exercised a privacy right.

• Submit a request by emailing [email protected] or using our privacy request form.
• Authorised agents may submit a request on your behalf with written permission signed by you; we may still ask you to verify your own identity.
• Verification — we match the details you give us against our records, and may ask you to confirm from the email address on the account.
• Timing — we acknowledge within 10 business days and respond within 45 calendar days, extendable once by a further 45 days where reasonably necessary.
• Appeals — if we refuse your request, you may appeal by replying to our decision or writing to [email protected] with "Appeal" in the subject line. We will respond within 45 days with our decision and reasons. If we deny the appeal, you may complain to your state Attorney General.

11.4 California Shine the Light

California residents may request information about disclosures of personal information to third parties for their own direct marketing purposes under Cal. Civ. Code §1798.83. We do not make such disclosures.

11.5 Do Not Track

There is no common industry standard for Do Not Track. We do not respond to DNT signals, but we do honour the Global Privacy Control signal as described in section 8.

12. Children

The Site is not directed at children and we do not knowingly collect their personal information.

• United States: the Site is not intended for children under 13, and we do not knowingly collect personal information from them (COPPA).
• EEA and UK: you must be at least 16 to create an account, or the lower age set by your country's law (no lower than 13) with the consent of a person holding parental responsibility.

If you believe a child has given us personal information, contact [email protected] and we will delete it.

13. Changes to this policy

We may update this policy to reflect changes in our service, technology or the law. We will update the "last updated" date above, and where the change is material we will notify you by email or by a prominent notice on the Site before it takes effect. Previous versions are available on request.

14. How to contact us

Privacy questions and data rights requests: [email protected]
General support: [email protected]
Legal: [email protected]

Mypixia, LLC
5960 Fairview Road, Suite 300
Charlotte, NC 28210, United States
(800) 884-3514

See also our Terms and Conditions, Cookie Policy, Sub-processors and Returns & FAQs.