Privacy policy
1. Who we are and what this policy covers
VisionPixel LLC ("we", "us") is a web development studio operating the website at visionpixel.pro. This policy explains how we collect, use, store and protect personal data when you browse the site, submit a request form, communicate with us, or become a client. We act as the data controller for enquiry, contact and billing data. Where we process personal data on a client's behalf in the course of a project (for example, importing customer records into a store we build), we act as a processor under the project agreement.
Our company is registered in Delaware, USA. Because we work with clients in different jurisdictions, we apply the general principles of major data-protection frameworks — including the EU and UK GDPR — as our baseline standard: lawfulness, purpose limitation, data minimisation, storage limitation and accountability. If a specific law of your country grants you additional rights, we honour them.
2. Data we collect
Enquiry data. When you submit the contact form we collect your name, email address, the type of service you are interested in and your project description. Please do not include unnecessary personal data in the free-text field — tell us about the project, not about your life.
Communication data. Emails, Telegram messages and call notes are kept so we can continue conversations coherently and maintain a history of decisions on your project.
Client and billing data. For clients we additionally process company details, signatory names, invoicing addresses and payment records, as required for contracts and accounting.
Technical data. The site records standard server logs (IP address, browser, pages requested, timestamps) for security and abuse prevention. With your consent via the cookie banner, we also collect anonymised analytics about page visits. Details are in the cookie policy.
3. What we use data for
Enquiry data is used to answer you, prepare a quote and, if you become a client, to deliver the project. Communication data keeps project history intact. Billing data fulfils contracts and legal accounting duties. Technical data protects the site and, in aggregated form, tells us which pages are useful. We do not use your data for advertising profiles, we do not sell it, and we do not share it with data brokers.
4. Legal bases
Responding to enquiries and delivering projects rests on performance of a contract or pre-contractual steps at your request. Accounting records are processed under legal obligations. Server logs and security monitoring rest on our legitimate interest in operating a safe service. Analytics cookies are set only with your consent, which you can withdraw at any time as described in the cookie policy.
5. Retention
Enquiry correspondence from contacts who do not become clients is deleted after 12 months. Client contracts, invoices and payment records are kept for the period required by accounting and tax law (typically seven years). Project correspondence is kept for the life of the client relationship plus three years, so warranty and maintenance questions have context. Server logs rotate after 90 days. Analytics data is retained in aggregate form only.
5a. Retention at a glance
| Data category | Retention | Reason |
|---|---|---|
| Enquiry correspondence (non-clients) | 12 months | Follow-up on your request |
| Contracts, invoices, payments | 7 years | Accounting and tax law |
| Project correspondence (clients) | Relationship + 3 years | Warranty and maintenance context |
| Server logs | 90 days | Security and abuse prevention |
| Analytics | Aggregate only, up to 13 months | Site improvement |
| Cookie consent choice | 12 months in your browser | Respecting your decision |
When a retention period ends, data is deleted or irreversibly anonymised. Backups age out on their normal cycle, which never exceeds 60 days beyond live deletion. If you need a certificate of deletion for your own compliance records, we issue one on request.
6. Sharing and processors
We use a small number of service providers who process data on our behalf under equivalent protection obligations: a hosting provider, a transactional email service, and an accounting package. We do not otherwise share personal data with third parties unless the law requires it or you ask us to (for example, when a project involves handing credentials to your marketing contractor). Data is primarily stored and processed in the United States; where a transfer concerns data from the EU or UK, it relies on appropriate safeguards.
6a. Changes to service providers
When we add or replace a provider that touches personal data, active clients are notified by email at least 14 days in advance, and this policy's effective date is updated. If a change is unacceptable to you for a documented data-protection reason, tell us within that window and we will propose an alternative arrangement or, failing that, a clean off-boarding of your data.
6b. Data we receive from others
Occasionally others give us your data: a colleague copies you on a brief, a contractor hands over credentials for accounts that contain customer records, a marketplace passes us your order details. In these cases the party sharing the data is responsible for having the right to share it; we process what we receive only for the project at hand and delete what turns out to be unnecessary.
7. Your rights
You may request a copy of your personal data, correction of inaccuracies, deletion where the law allows, restriction of or objection to processing, and portability of data you provided. Send requests via the qTox channel listed on our Contact page; we answer within one month. Identity is verified against the email address or contract on file before anything is released. If you are in the EU or UK, you may also complain to your local data-protection authority; if you are elsewhere, your local regulator's rights apply as provided by your law.
7a. How a request is handled
When a request arrives we log it, verify identity, and assign it to the person responsible for that data category. Simple requests (a copy of your contact record, correction of a name) are usually completed within a few days; the one-month outer limit exists for complex cases like full project-history exports. There is no fee for a normal request; manifestly unfounded or repetitive requests may attract a reasonable fee where the law permits. You will always be told what was done, when, and what was not possible and why.
7b. Automated decisions
We do not make decisions with legal or similarly significant effect about you based solely on automated processing. Analytics data is aggregated and never used to profile individual visitors. Pricing is the same for everyone who receives the same scope of work.
8. Security
We apply TLS encryption in transit, encrypted storage for sensitive project material, least-privilege internal access, individual accounts with multi-factor authentication for administrative systems, and timely patching of services we operate. Access to client data is limited to the people working on that client's project. Suspected personal-data breaches affecting you are notified without undue delay, with a description of what happened, likely consequences and the measures taken.
8a. Incident response in detail
Suspected security events follow a written playbook: contain, assess, notify, learn. Containment happens first and is never delayed for paperwork. Assessment establishes what data, if any, was affected and whose. Where personal data is confirmed breached, affected clients and enquirers are notified without undue delay — with what happened, what data is involved, likely consequences, and what we have already done. Every incident, including near-misses, ends with a written review whose action items are tracked to completion.
8b. Access inside the studio
Production data access is limited to the people working on the relevant project, granted per project and reviewed monthly. All administrative access uses individual accounts with multi-factor authentication; shared logins do not exist. Access ends on the day a person stops working with us. Contractors never receive access to client personal data unless the contract with you names them and the scope.
9. Children's data
Our services are directed at businesses. We do not knowingly collect personal data from children. If you believe a child has submitted data to us, contact us and we will delete it.
10. Changes
Material changes to this policy are announced on this page with a new version date; for active clients, material changes are additionally notified by email at least 14 days before they take effect.
10a. Governing framework for privacy matters
For privacy matters we follow the law of Delaware, USA, as our home jurisdiction, while voluntarily applying the principles of the EU and UK GDPR as our operating standard for all visitors and clients regardless of location. Where your local law grants you stronger rights than this policy describes, the stronger rights apply to you. Nothing in this policy limits any non-waivable right you hold.
11. Contact
Privacy questions and requests: via the qTox channel on the Contact page. VisionPixel LLC operates worldwide, remote-first, without a fixed postal office.