Privacy Policy

1. Who we are

PixyScan is a website monitoring service. It crawls websites you connect to it, evaluates their markup against a catalogue of checks, and reports what it finds and what has changed since the previous crawl.

The controller for the personal data described here is Kiara TechX LLP, registered at 1101, Time Square 1, Opp. Baghban Party Plot, Thaltej, Ahmedabad, Gujarat 380059, India.

2. What we collect

Account data

Your name, email address, and a hashed password. If you sign in through a third-party identity provider we store the identifier that provider gives us rather than a password. We store the timestamp of your account’s creation and last update, and — where you hold one — your platform role.

Workspace and membership data

The workspaces you own or belong to, your role in each, the sites in them, and pending invitations you have sent or received. Invitations are sent by email and record the address invited and who invited it.

Configuration you enter

Site names and URLs, crawl rules and exclusion patterns, which check disciplines are enabled, schedules, score thresholds, and branch-to-environment mappings. CI client secrets are stored only as a one-way hash — we cannot read one back, which is why regenerating is the only recovery path.

Usage and billing data

One record per scan holding the number of URLs crawled, head requests made, the billing period it belongs to, and the workspace and site it relates to. Alongside it: your subscription, plan changes, credit grants and their consumption. These records deliberately have no foreign keys and outlive the deletion of a site, a scan or a workspace, because the record of what an account consumed has to survive the deletion of what consumed it.

Operational data

Server logs, error reports and request metadata, generated in the course of running the service.

3. Data from the sites you scan

This is the category most worth understanding, because it is the one unique to this product.

When you run a scan, our crawler fetches pages from the site you named and stores what it needs to evaluate them: URLs and their status codes, titles, meta descriptions, heading structure, link targets and anchor text, image references and attributes, structured data blocks, HTTP response headers, robots.txt and sitemap contents, and computed measures such as word count and readability grade.

We do not store the full page body. What is retained is the markup and metadata each check evaluates, plus the findings themselves.

If the pages you scan contain personal data — author names in bylines, contact details in page copy, personal information in URLs — that data may be captured incidentally as part of the fields above. You are the controller of the content on the sites you connect; we process it on your instruction. Do not point the crawler at a site whose content you are not entitled to have processed this way.

The crawler identifies itself in its user agent, respects robots.txt by default (you may switch that off for a site you control), and refuses to resolve loopback, private-range and link-local addresses.

4. Why we process it

We do not sell personal data, and we do not use the content of the sites you scan to train models or to build any product other than your own reports.

5. What our staff can see

PixyScan has an internal administration console, available only to staff holding a platform role. It exists to run the service — diagnosing failures, answering support requests, applying plan overrides — and its boundary is deliberate and enforced in the API rather than by convention.

Through it, staff with the appropriate role can see:

• Account metadata: names, email addresses, roles, sign-up dates.
• Workspaces, their subscriptions, plan overrides and credit grants.
• Site names and URLs, and scan records: when a scan ran, how long it took, how many URLs it touched, whether it succeeded and what score it produced.
• Aggregate platform metrics and system health.

They cannot see crawled page content through it. The console shows counts, statuses and account metadata; the fields captured from your pages are not exposed there. Widening that would mean changing the API’s data transfer objects, and this paragraph with them.

Administrative actions are recorded in an audit log — who did what, to which account, when.

6. Who else sees it

• Other members of your workspace, according to the roles you have given them.
• Infrastructure providers hosting the service in the European Union (Frankfurt, Germany), processing data on our instructions.
• An email delivery provider, for the service emails listed above.
• Our payment provider, which processes payments for paid plans and receives the billing details you enter at checkout. Card numbers are handled entirely by the provider and never reach our servers or our staff — we store only the last four digits, the card brand and the expiry, so that you can tell your own cards apart on the billing screen.
• Authorities, where we are legally required to disclose.

7. How long we keep it

Scan history and the data behind it are retained for the window your plan provides:

Account data is kept while your account exists. Deleting a site deletes its scans and the crawled data behind them. Billing records — what an account consumed and what it was charged — are retained beyond account deletion for as long as tax and accounting law requires, and are not deleted on request where that obligation applies.

8. Your rights

Subject to the law that applies to you, you may request access to your personal data, correction of it, deletion of it, restriction of or objection to its processing, and a portable copy of it. You may withdraw consent where we rely on consent, and complain to your local supervisory authority.

Much of this you can do yourself: the account screen edits your details, site settings manage members, and deleting a site or a workspace removes its data. For anything else, write to privacy@pixyscan.com. We will respond within the period the applicable law sets, and within 30 days at the latest.

9. Security

• Passwords are hashed; they are never stored or transmitted in the clear.
• Sessions use httpOnly cookies set by the API on its own domain and refreshed transparently. The front end never holds a token.
• CI client secrets are stored only as a one-way hash and are displayed exactly once, at creation.
• Traffic is encrypted in transit.
• Access to production is limited to staff who need it, and administrative actions are logged.
• The crawler refuses non-public addresses, which prevents it being used to reach internal services.

We hold no SOC 2 or ISO 27001 certification, and we would rather say so than imply otherwise.

10. International transfers

The service is hosted in the European Union (Frankfurt, Germany), and that is where your data is stored.

Kiara TechX LLP is established in India, and our staff access the service from India in order to operate and support it. Personal data of customers in the European Economic Area and the United Kingdom is therefore accessed from outside those areas. India is not the subject of an adequacy decision, so we rely on the European Commission’s Standard Contractual Clauses, and the UK International Data Transfer Addendum, as the safeguard for those transfers. A copy of the clauses we use forms part of our data processing agreement, available from privacy@pixyscan.com on request.

We do not sell personal data, and we do not transfer it to any other country except through the providers named in section 6.

11. Children

The service is for organisations and professionals. It is not directed at children and we do not knowingly collect their data. If you believe a child has given us personal data, write to privacy@pixyscan.com and we will delete it.

12. Changes to this policy

We update this page when what the product does changes. The effective date at the top is when the current version took effect. Where a change materially affects how we handle your data, we will tell account owners by email before it takes effect.

13. Contact

Privacy questions and rights requests: privacy@pixyscan.com. Anything else: support@pixyscan.com. By post: Kiara TechX LLP, 1101, Time Square 1, Opp. Baghban Party Plot, Thaltej, Ahmedabad, Gujarat 380059, India.