Data Processing Agreement

• You (the customer) are the controller of the personal data of people who visit your websites.
• Pixel Sentinel LLC (“we”) is your processor. We process that data only to run the service for you.
• This agreement applies wherever the EU General Data Protection Regulation (GDPR), the UK GDPR or similar laws apply to that processing. Pixel Sentinel isn’t offered to customers in the European Economic Area, the UK, Gibraltar or Switzerland, but visitors to your websites can be anywhere. If it conflicts with the Terms of Service on data protection, this agreement wins.

Data about you as a customer (your account, billing and so on) isn’t covered here. We’re its controller, and our Privacy Policy covers it.

Purpose	Showing your real images on the websites you approve, serving scrambled copies elsewhere, stopping bots and abuse, not billing you twice when a visitor reloads a page or for more than a set number of views from one visitor an hour, watermarking large views and downloads, and giving you traffic reports (with a map of where views come from) and leak tracing. Never advertising or marketing.
People	Visitors to web pages that show your protected images, and people who use a download link you send.
Data	The address of the page the image was shown on, or the download link used; a shortened IP address (/24 for IPv4, /48 for IPv6) and the country it’s in, looked up on our own servers; browser, operating system and device type from the user agent; whether the visitor got the real image or a scrambled copy and why; for large views and downloads, a watermark record linking those details to the view. While a request is served, the full IP address and user agent are also used to block bots, apply rate limits and count views.
Special categories	None. The service isn’t designed to process them.
How long	Traffic records: 180 days. Watermark records, which let you trace a leaked copy to a view: two years after that viewer last saw the image. Both are then deleted automatically, or sooner when you delete the image or close your account. The full IP address and user agent: only while the request is served, and in memory for at most an hour for rate limits and view counting; never written to our database, files or logs.
Where	Amazon Web Services in the United States (Ohio), delivered through Amazon CloudFront.

We will:

1. Follow your instructions. Your instructions are the Terms of Service, this agreement and the way you configure the service (for example your approved sites). We’ll tell you if we think an instruction breaks data protection law. If the law makes us process data any other way, we’ll tell you first unless the law forbids it.
2. Keep it confidential. Only people who need access to run the service get it, and they’re bound to confidentiality.
3. Keep it secure. See Security measures below.
4. Use sub-processors only as described here. See Sub-processors.
5. Help you with people’s requests. If a visitor asks us to access, correct or delete their data, we’ll pass the request to you and help you answer it. Visitor records are keyed by a shortened IP address, so they usually can’t be tied to a named person.
6. Tell you about breaches. If a personal data breach affects your visitors’ data, we’ll tell you without undue delay, and within 48 hours of becoming aware of it, with what we know so you can meet your own deadlines.
7. Help with assessments. We’ll give you the information you reasonably need for a data protection impact assessment or a consultation with a regulator.
8. Delete it at the end. When you close your account or delete an image, we delete the related visitor data from live systems straight away and from backups within 30 days.
9. Show we comply. We’ll answer reasonable written questions about our compliance. If a regulator requires it, or our answers aren’t enough, we’ll allow an audit on reasonable notice, no more than once a year, at your cost, and without access to other customers’ data.

You’re responsible for having a lawful basis for the processing, for describing it in your own privacy notice (for example: “images on this site are protected by Pixel Sentinel, which records shortened IP addresses, their country and browser details to prevent and trace copying, and doesn’t use them for advertising”), and for only approving websites you control.

• HTTPS for all traffic. The origin server only accepts requests through our CDN.
• IP addresses are shortened before they’re stored. Visitors’ full IP addresses are never stored.
• Images and thumbnails are encrypted at rest, in private storage only our server can reach.
• Databases and backups are encrypted at rest in AWS. Database backups are kept for 7 days, and earlier versions of stored files for 30 days.
• No access logs of image requests are kept at the CDN or the server, and security logs of blocked image requests hold no IP address.
• Access to production is limited to Pixel Sentinel staff, through AWS identity controls with no SSH access.
• Rate limits and bot detection protect the service.

You authorise these sub-processors. Only the first two see visitor data. The others see your images, or data about you as a customer, and never data about your visitors:

Sub-processor	What it does	Sees visitor data?	Where
Amazon Web Services, Inc.	Hosting, storage, backups and content delivery (CloudFront)	Yes	United States (Ohio); CDN edge locations worldwide
Cloudflare, Inc.	Turnstile bot check on sign-up and forms (IP address, browser details)	Yes, only people filling in those forms on pixelsentinel.net	United States; edge locations worldwide
Google LLC (Cloud Vision)	Searches for copies of images, only for patrols you start; receives the image, not visitor data	No	United States
TinEye (Idée Inc.)	Searches for copies of images, only for patrols you start; receives the image, not visitor data	No	Canada
Zoho Corporation	Help desk and email	No	United States
Functional Software, Inc. (Sentry)	Error reports from our server and our website, with email addresses, cookies, form contents and query strings removed	No	United States
DigiCert, Inc.	Trusted timestamp of a fingerprint of each upload (receives only a hash)	No	United States
Stripe, Inc. and Sold through Link, LLC	Payments for your plan, as merchant of record; receives your billing details, not visitor data	No	United States

We’ll give at least 30 days’ notice of a new sub-processor by updating this page and emailing customers. If you object on reasonable data protection grounds and we can’t resolve it, you can close your account and get a refund of any prepaid amount for the unused period. We’re responsible for our sub-processors and bind them to data protection terms at least as protective as these.

Visitor data is processed in the United States. Where a customer is nonetheless subject to the GDPR, the European Commission’s Standard Contractual Clauses (Decision 2021/914) apply to transfers from the European Economic Area and are incorporated by reference: Module 2 (controller to processor) where you’re a controller, and Module 3 (processor to processor) where you’re a processor yourself. The details they need are in this agreement. Clause 7 (docking) doesn’t apply, Clause 9 uses option 2 with the notice period above, Clause 11’s optional wording doesn’t apply, and Clauses 17 and 18 choose the law and courts of Ireland. Where a customer is subject to the UK GDPR, the UK International Data Transfer Addendum applies to those clauses. Where Swiss law applies, references to the GDPR include the Swiss Federal Act on Data Protection.

Liability under this agreement follows the limits in the Terms of Service, except where the law doesn’t allow them to be limited. This agreement lasts as long as we process visitor data for you.

Pixel Sentinel LLC · 16970 Meadow Ln, Nampa, ID 83687, USA · support@pixelsentinel.net