Privacy Policy

1. Who is responsible for your information?

Pixelfish Marketing Solutions (Pty) Ltd (“Pixelfish”, “we”, “us” or “our”) operates Pixelfish Publisher and is the responsible party for personal information processed through the service.

Our address is 21 Coronation Road, Pioneer Park, Newcastle, KwaZulu-Natal, 2940, South Africa. Privacy enquiries may be sent to info@pixelfishmarketing.com.

2. Information we collect

The information collected depends on how Publisher is used and may include:

• Account information: business or organisation name, contact name, username, email address, password hash, plan, team role and account preferences.
• Google sign-in information: verified email address and Google’s stable account identifier, as explained below.
• Customer content: PDFs, publication pages, thumbnails, text, hyperlinks, branding, images, video, audio, maps, forms and other material uploaded or configured by a customer.
• Payment information: plan, amount, payment status, Payfast reference, billing choice and renewal date. Complete card details are processed by Payfast and are not stored by Pixelfish Publisher.
• Support and communications: enquiries, support messages and information needed to resolve a request.
• Security and technical information: login events, session information, browser or device category, diagnostic events and security records. Trial-abuse controls use a one-way protected value derived from the network address rather than storing the raw address in the trial-rate record.
• Reader and lead information: anonymous or aggregated publication engagement, page activity, interactions and information a reader knowingly submits through an enquiry form.

3. Google sign-in: data received and how it is used

Pixelfish Publisher offers optional Google sign-in for administrators and existing customer users. The external login application requests only these basic identity permissions:

• openid — confirms that Google authenticated the user;
• userinfo.email — supplies the user’s verified Google email address; and
• userinfo.profile — may supply basic profile information such as a display name.

We use the verified Google email to find an existing Publisher user and prevent Google sign-in from creating an unauthorised account. We store Google’s stable account identifier with that existing user so subsequent sign-ins cannot be silently linked to a different Google account. A display name may be used to complete an administrator profile when no name already exists.

Publisher does not use customer Google sign-in to access Gmail, Google Drive, contacts, calendars, advertising data or files. It does not store the Google password, ID token or login access token after authentication. The separate internal Pixelfish mail system may use Google Workspace’s send-only Gmail permission for the Pixelfish sender mailbox; it does not access customer mailboxes and is not part of customer Google sign-in.

Google user data is used only to authenticate and secure the requested Publisher account. It is not sold, used for advertising, used to build marketing profiles or used to train general-purpose artificial-intelligence models. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

4. Why and how we use information

We process information where it is necessary to provide the service, perform the customer agreement, meet legal obligations, protect legitimate operational and security interests, or act on valid consent. Uses include:

• creating and administering Publisher accounts and team access;
• authenticating users and preventing account takeover or abuse;
• converting, hosting, displaying and supporting publications;
• processing payment status, licensing, renewal and storage entitlements;
• sending trial, account, payment and service communications;
• providing analytics, enquiry forms and customer support;
• maintaining, diagnosing and improving reliability and security; and
• complying with lawful obligations and resolving disputes.

5. When information is shared

We do not sell personal information. Information may be disclosed only where reasonably necessary to:

• use hosting, infrastructure, email, Google authentication and payment providers that support Publisher;
• deliver a customer’s public publication or process a reader’s requested enquiry;
• work with professional advisers bound by confidentiality;
• comply with a lawful request, court order or regulatory duty; or
• protect customers, Pixelfish or the public from fraud, abuse, security threats or unlawful activity.

Service providers receive only the information reasonably required for their role and are expected to apply appropriate confidentiality and security controls. Where information is processed outside South Africa, we take reasonable steps to ensure an appropriate level of protection as required by applicable law.

6. How information is protected

We use reasonable technical and organisational safeguards appropriate to the nature of the service. These include encrypted HTTPS connections, password hashing, restricted administrative access, role-based customer access, server-side authorisation, protected sessions, request verification, OAuth state and nonce validation, PKCE for Google authentication, encrypted storage of supported service credentials and security logging.

No online system can guarantee absolute security. Customers must protect their own login details, control team access and tell us promptly about suspected unauthorised activity.

7. Retention, unlinking Google and deletion

Account and publication information is retained while needed to provide Publisher, maintain security, administer the licence and meet legitimate legal, accounting or dispute-resolution requirements. Different information may have different retention periods.

The linked Google account identifier is retained only while Google sign-in remains linked to the Publisher user. Changing the Publisher account email automatically removes that link. A user may also revoke Pixelfish Publisher through their Google Account connections and contact us to unlink it from Publisher.

To request account closure, Google unlinking or deletion of eligible personal information, email info@pixelfishmarketing.com from the registered account address. We will verify the request and delete or de-identify information that is no longer required, subject to legal retention duties, payment records, fraud prevention and the rights of other people.

Customers should keep independent copies of original PDFs and media. Account closure or licence expiry may eventually result in deletion of hosted publication content.

8. Your privacy rights

Subject to the Protection of Personal Information Act, 2013 and other applicable law, you may request confirmation of whether we hold your personal information and ask for access, correction, deletion, restriction or objection where the relevant right applies.

You may also complain to the South African Information Regulator. We encourage you to contact us first so we can investigate and resolve the concern promptly. We will not discriminate against a person for exercising a lawful privacy right.

9. Sessions, cookies and publication analytics

Publisher uses essential session technology to keep users signed in, protect requests and maintain account security. Optional analytics may measure publication opens, pages, reading time, devices, interactions and referral sources. Reader analytics are designed not to store raw reader IP addresses.

A customer may connect its own Google Analytics 4 property. When it does, that customer is responsible for its notices, lawful basis and configuration relating to its readers.

10. Children’s information

Publisher accounts are intended for adults and authorised organisations, not for children to purchase independently. Schools and other customers must ensure they have an appropriate legal basis and permissions before publishing children’s personal information, photographs or submissions.

11. Changes to this policy

We may update this policy when the product, legal requirements or data practices change. The current version and effective date will remain published on this page. Material changes will be communicated reasonably where appropriate.

12. Contact and privacy requests