Privacy policy

1. Data controller

• Controller: Borja Pulido Tudela
• Tax ID: 53875848G
• Address: San Gerardo 6, Torrent, Valencia
• Email: borjabussiness@gmail.com

2. Data we collect

When you visit the site, buy Pixelion, create a customer account, join the affiliate programme, or contact us, we may collect:

• Contact data: name, email address, country.
• Email entered at checkout, even if you don't complete the purchase.
• Transaction data: plan purchased, amount, date, discount or affiliate code used, and the .myshopify.com domain of the store where you activate the licence.
• Payment data: processed directly by Stripe. Borja Pulido Tudela does not store full card numbers or financial data on its own servers.
• Browsing data (cookieless analytics): to measure traffic in aggregate we store a random session identifier in your browser's temporary storage (sessionStorage, cleared when you close the tab) and record pages visited, clicks, country (derived from your IP, which is not stored), device type and campaign source. This data is not used to identify you.
• Linking your visit to your order (only if you accept analytics): if you accept analytics cookies and make a purchase, we link that session to your order (Stripe payment identifier) to know which content, for example blog articles, contributed to the sale.
• Advertising data: if you accept advertising cookies (in the United States, unless you opt out, see section 10), the Meta pixel and Meta Conversions API receive page-view, checkout-start and purchase events, together with your hashed email (SHA-256), IP address, browser and Meta identifiers, to measure and optimise our ads.
• Free download and emails about Pixelion: if you request the free PDF ("300+ ad hooks"), your email address, the site language, the date and version of the consent text you accepted, the page you signed up from and, if you arrived from a campaign, its UTM parameters.
• Shopify store auditor: the public address (URL) of the store you enter. We analyse the public content of that page on the spot to detect the installed apps and estimate their monthly cost; we do not store the page content. If you also give us your email, we store the URL, the detected apps and the estimate we showed you with it.
• Contact form: your name, email address, the topic and text of your message, your store address if you give it, the site language, the date and version of the privacy text you accepted, and our replies.
• Form abuse prevention: an irreversibly encrypted identifier of your IP address (keyed hash), never the IP itself, together with attempt counters. In addition, Vercel BotID analyses technical browser signals when forms are submitted to tell people from bots.
• Use of the Pixelion theme on Shopify stores: when the theme runs on a store, we record the store's domain (.myshopify.com), the theme version and ID, the approximate country and a non-reversible fingerprint of the licence key used. We do not store IP addresses or any data about the store's visitors.
• Technical error logging: if a page fails, we automatically record the error message, the page, your browser, OS and device type, and the site version, without your IP address or any identifying data.
• Affiliates: if you join the affiliate programme, your name, email, code, the payout details you provide, and your sales and commission history.

3. Purposes and legal bases

Purpose	Legal basis
Manage the purchase, issue the licence, apply plan upgrades and provide support	Performance of a contract (GDPR Art. 6.1.b)
Verify licence status, prevent fraud and detect unauthorised use of the theme	Legitimate interest (GDPR Art. 6.1.f)
Comply with tax and accounting obligations	Legal obligation (GDPR Art. 6.1.c)
Send you up to 3 reminders if you start an order and don't complete it (you can untick the box at checkout or unsubscribe from any email)	Legitimate interest (GDPR Art. 6.1.f)
As a customer, ask for your review and offer plan upgrades, products similar to what you bought	Legitimate interest and Art. 21.2 LSSI; you can unsubscribe in every email
Measure traffic in aggregate and anonymously	Legitimate interest (GDPR Art. 6.1.f), no cookies
Measure which pages and articles lead to a purchase by linking the session to the order	Consent (GDPR Art. 6.1.a and Art. 22.2 LSSI), withdrawable at any time
Measure and optimise our ads on Meta	Consent (GDPR Art. 6.1.a and Art. 22.2 LSSI), withdrawable at any time
Run the affiliate programme and pay commissions	Performance of a contract (GDPR Art. 6.1.b)
Send you the free PDF you request and a series of 5 emails about Pixelion, and measure in aggregate whether they work (deliveries, opens, clicks and whether you end up buying)	Consent (GDPR Art. 6.1.a and Art. 21 LSSI), given by ticking a box that is never pre-ticked and confirming your email (double opt-in); withdrawable at any time
Analyse the store you enter in the auditor and show you the result	At your request, to provide the service you ask for (GDPR Art. 6.1.b)
Answer the messages you send us through the contact form	Pre-contractual steps at your request, or performance of the contract if you are already a customer (GDPR Art. 6.1.b); for general enquiries, our legitimate interest in answering you (GDPR Art. 6.1.f)
Protect forms against automated submissions and abuse	Legitimate interest (GDPR Art. 6.1.f)
Detect and fix technical faults on the website	Legitimate interest in the security and operation of the service (GDPR Art. 6.1.f)

4. Processors and recipients

To provide the service, we share certain data with the following providers, which act as data processors under contract:

• Stripe (payment processing and fraud prevention).
• Resend (emails: order confirmation, licence key, access links, the reminders and offers described above, the free PDF and email series about Pixelion if you sign up, and the confirmation of and replies to contact messages).
• Vercel (application hosting and bot protection for forms with BotID, infrastructure in the EU and US).
• Supabase (database, hosted in the EU region — Ireland).
• Meta Platforms Ireland Ltd. (ad measurement), only if you accept advertising cookies (in the United States, unless you opt out).

We do not sell your data to third parties.

5. International transfers

Some providers (Stripe, Resend, Vercel and Meta) may process data outside the European Economic Area, in particular in the United States. Such transfers rely on the European Commission's Standard Contractual Clauses and/or the EU-US Data Privacy Framework, as applicable.

6. Retention period

We keep contractual data for as long as the licence is active and, afterwards, for the periods legally required to meet tax and liability obligations (generally up to 6 years from the last transaction). Analytics data is kept for a maximum of 25 months. Records of the theme's use on stores without a valid licence are kept for at most 2 years from the last time we detect them. Technical error logs are kept for at most 180 days.

Data from the free download and email series (including auditor results linked to your email) is kept until you unsubscribe or ask us to erase it. If you unsubscribe, we keep only your email on a suppression list so we never email you again. Auditor scans without an email are not stored in our database: only a temporary technical entry remains in the server logs (domain scanned and number of apps detected). Abuse-prevention counters are deleted after 2 days.

Contact form messages and our replies are kept for as long as needed to handle your enquiry and, if you are a customer, during the contractual relationship. You can ask us to erase them at any time by writing to borjabussiness@gmail.com.

7. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, as provided by GDPR, by writing to borjabussiness@gmail.com. You can withdraw your analytics or advertising consent at any time via the "Cookie preferences" link in the footer ("Your Privacy Choices" in the United States), and your consent to the emails about Pixelion with the unsubscribe link in every email. Withdrawing consent does not affect the lawfulness of prior processing. You may also lodge a complaint with your local data protection authority if you believe processing does not comply with the law.

8. Security

We apply reasonable technical and organisational measures (encryption in transit, access control, certified providers) to protect your data against unauthorised access, loss or alteration.

9. Cookies

This site uses strictly necessary technical cookies and, only if you accept them, cookies and browser storage for analytics and advertising. See our Cookie policy for full detail.

10. Your US state privacy rights

If you are a resident of California or another US state with a consumer privacy law, you may have the right to know what personal information we collect, to access, correct or delete it, and to opt out of the "sale" or "sharing" of your personal information. We do not sell your personal information for money. However, for visitors in the United States we use the Meta Pixel and the Meta Conversions API by default to measure and optimise our ads. Sending identifiers (such as cookie IDs, IP address and hashed email) and events (page views, checkout and purchase activity) to Meta may be considered "sharing" for cross-context behavioural advertising, or a "sale", under these laws.

• How to opt out: click "Your Privacy Choices" in the footer of any page and turn on "Do Not Sell or Share My Personal Information". We also honour the Global Privacy Control (GPC) signal sent by your browser as a valid opt-out request.
• Categories shared: identifiers, internet activity and commercial information (for example, pages viewed and purchase events).
• Recipient: Meta Platforms, Inc. (advertising).
• We do not knowingly sell or share the personal information of consumers under 16.
• Other rights: to exercise your rights to know, access, correct or delete, write to borjabussiness@gmail.com. We will verify your request and respond within 45 days. We will not discriminate against you for exercising your rights.

11. Changes to this policy

We may update this policy to reflect legal changes or changes to our providers. The last-updated date appears at the bottom of this page.

Last updated: October 26, 2026