Privacy Policy

1. Who is responsible for your data

The controller of personal data processed through Millionpixel is the operator named in the Terms of Service: Axel Holter, an individual in Norway, with the postal address Olav M. Troviks vei 10, H0714, 0864 Oslo, Norway.

You can contact us about privacy at legal@millionpixelbillboard.com. You also have the right to complain to the Norwegian Data Protection Authority (Datatilsynet).

2. Information we collect

• Account details: your email address, display name, and a hashed password (we never store your password in readable form). If you sign in with Google or Facebook, we receive basic profile details, such as your name and email address, from that provider.
• Legal acceptance: confirmation that you are at least 18 years old and that you accepted the Terms, with the date, the version, and how you accepted.
• Your content and activity: designs you create, pixels you hold and their ownership history, placements, and notifications we send you. Pixel ownership, including your display name, may be shown to other visitors on the canvas.
• Purchases and payouts:order details, amounts, fees, and transaction records. Card details are entered in Stripe’s payment form and do not pass through our servers. If you receive payouts, we store your Stripe account identifier and whether payouts are enabled; Stripe collects your identity and bank details.
• Reports and complaints: reports you submit about designs and, for rights-holder complaints, your name, email address, organisation (if given), your description of the claim, and your electronic signature.
• Technical and security data: the IP address used when a sign-in session is created, server logs, and security and moderation records, including an audit trail of administrator actions.

3. Why we use it

We process personal data on these bases:

• To provide the service (contract): creating and securing your account, publishing designs, processing purchases and payouts, and sending service emails such as email verification and notifications.
• To meet legal obligations: keeping accounting and tax records, and responding to lawful requests from authorities.
• For our legitimate interests: preventing fraud and abuse, keeping the service secure, moderating content, handling reports and rights-holder complaints, and enforcing our Terms and Content Rules.
• With your consent: where we ask for it, for example when you choose to sign in with a third-party provider. You can withdraw consent at any time.

4. Who we share it with

We share personal data only as needed to run the service:

• Stripe processes payments and seller payouts and verifies sellers’ identity and bank details.
• Resend sends verification and notification emails on our behalf.
• Hosting providers run the service: Vercel for the website and Oracle Cloud for the application and database.
• Google and Facebook if you choose to sign in with them.
• Authorities and advisers where the law requires it or to establish or defend legal claims.

Some of these providers may process data outside the EU/EEA. Where they do, we rely on safeguards such as an adequacy decision or the EU Standard Contractual Clauses. [DETAILS OF EACH INTERNATIONAL TRANSFER AND ITS SAFEGUARD — to be confirmed.]

We do not sell your personal data.

5. How long we keep it

We keep your account data while your account is active. If you ask us to delete your account, we delete your account details, except for records we are legally required or entitled to keep.

• Transaction and accounting records are kept for as long as the law requires, which in Norway is commonly five years. [RETENTION PERIOD — to be confirmed with an accountant.]
• Moderation and complaint records are kept for as long as needed to handle disputes and legal claims. [PERIOD — to be completed.]
• Server logs are kept for a limited time for security purposes. [LOG RETENTION PERIOD — to be completed.]
• Pixels you own: [WHAT HAPPENS TO PIXELS, DESIGNS, AND PUBLIC OWNERSHIP RECORDS WHEN AN ACCOUNT IS DELETED — to be decided.]

6. Your rights

Under data protection law you may ask us for access to your personal data, correction of inaccurate data, deletion, restriction of processing, a portable copy of data you provided, and you may object to processing based on our legitimate interests. Where processing is based on consent, you may withdraw it at any time.

To exercise these rights, email legal@millionpixelbillboard.com. We may ask you to verify your identity, and we aim to respond within one month. If you are unhappy with our answer, you can complain to Datatilsynet, the Norwegian Data Protection Authority.

7. Age limit, cookies, and changes

The service is for people aged 18 and over, and we do not knowingly collect personal data from anyone younger. If you believe a child has an account, contact us and we will review it.

Information about cookies and similar storage is in our Cookie Policy. If we change this policy in a material way, we will update this page and, where appropriate, notify you.