Privacy Policy

Version 2026-10-19

1. Introduction

Pixsa (“we”, “our”, “us”) is committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, and share information when you use our website and services at pixsa.co.za (the “Platform”).

We comply with the Protection of Personal Information Act, 2013 (POPIA), the Electronic Communications and Transactions Act, 2002 (ECTA), and other applicable South African legislation.

2. Responsible Party & Information Officer

Luke van Tonder, a sole proprietor trading as Pixsa (“Pixsa”), is the “Responsible Party” for the personal information collected through the Platform, as defined under POPIA.

Our Information Officer, designated in terms of section 55 of POPIA, can be reached at privacy@pixsa.co.za. Registration of the Information Officer with the South African Information Regulator is in progress; this page will be updated with the registration reference once it is issued.

3. Information We Collect

We collect the following types of information:

  • Account information: When a photographer registers, we collect their first and last name, business name, email address, and password (stored as a one-way hash).
  • Client information: When a client accesses a gallery, we collect their first name, surname, cell number, and email address through the gallery hardwall gate.
  • Payment information: Payment details are processed by PayFast. We do not store credit card or bank account numbers.
  • Usage data: We log gallery views, IP addresses, user-agent strings, and download events for security, fraud prevention, and the photographer’s analytics dashboard.
  • Photos and content: Photographers upload photos to the Platform. Originals are stored privately; watermarked previews and thumbnails are stored in public CDN buckets for delivery to clients.
  • Diagnostic data: When the Platform encounters an error, we may collect a stack trace, the URL, and a session identifier to investigate. Personally identifiable fields are masked before transmission.

4. Lawful Basis for Processing

We process personal information on the following bases under POPIA section 11:

  • Consent — for client information collected via gallery hardwall gates and for marketing emails.
  • Contract — to provide the services you signed up for.
  • Legitimate interest — for security, fraud prevention, audit logging, and improving the Platform.
  • Legal obligation — where retention or disclosure is required by South African law.

5. How We Use Your Information

We use your information to:

  • Provide, maintain, and improve the Platform
  • Process transactions and send related notifications
  • Enable photographers to manage their galleries and client relationships
  • Share client contact details with the relevant photographer (as consented to via the hardwall gate)
  • Send service-related communications (e.g. order confirmations, payment receipts, security alerts)
  • Send marketing communications, only with your explicit opt-in, with a one-click unsubscribe in every message
  • Respond to support requests
  • Comply with legal obligations

We never use your photos for advertising, to train AI or machine-learning models, or for any purpose other than delivering them to you and your clients. We do not sell personal information.

6. Sub-processors

We engage the following third-party operators to deliver the Platform. Each is bound by data-processing terms and processes personal information only on our instructions:

  • Supabase, Inc. — Authentication, Postgres database, file storage. Hosting region: EU.
  • Cloudflare R2 — Photo and asset storage. Hosting region: global (object storage).
  • Vercel Inc. — Application hosting and edge functions. Hosting region: global.
  • PayFast (Pty) Ltd — Payment processing for both gallery sales and Pixsa subscription billing. South Africa.
  • Resend, Inc. — Transactional email delivery (account confirmations, receipts, gallery invites).
  • Upstash, Inc. — Rate limiting. Stores request IP addresses briefly as throttle keys for login, sign-up and gallery access. Hosting region: USA.
  • Sentry (Functional Software, Inc.) — Error and performance monitoring. Personally identifiable fields are masked client-side before transmission.

The current canonical list is maintained at privacy@pixsa.co.za; request a copy at any time. We will notify you of any new sub-processor at least 14 days before they begin processing personal information.

7. Data Sharing

We do not sell your personal information. We share data only with:

  • Photographers: Client information collected through gallery hardwall gates is shared with the photographer who owns that gallery, who acts as a separate Responsible Party for that information. If you are a client and want your details corrected or removed from a gallery, ask your photographer first; they can do it from their dashboard. You can also contact us and we will pass the request on.
  • Sub-processors as listed in section 6.
  • Law enforcement: When required by law, court order, or valid legal process.

8. Cross-Border Transfers

Some of our sub-processors store data outside South Africa (notably Supabase in the EU and Vercel/Cloudflare globally). Where personal information is transferred outside the Republic, we rely on the recipient being subject to laws or binding contractual terms providing protection substantially similar to POPIA, in accordance with section 72.

9. Data Storage and Security

Your data is stored on secure servers provided by our sub-processors. We use TLS encryption in transit and encryption at rest. Access to personal information is restricted to authorised personnel, and administrative actions are audit-logged.

High-resolution photo originals are stored in private buckets and only delivered via short-lived signed URLs after payment is confirmed. Watermarked previews and thumbnails are served from public CDN endpoints.

10. Data Retention

We retain your personal information for as long as your account is active or as needed to provide our services. Specific retention periods:

  • Account data: retained for the life of the account; deleted within 30 days of account closure.
  • Gallery photos: retained until the photographer deletes the gallery or closes the account.
  • Order and payment records: retained for 5 years after the transaction, in compliance with the Tax Administration Act.
  • Audit logs of administrative actions: retained for 12 months; destructive actions (deletions, suspensions) retained indefinitely for compliance.
  • Diagnostic / error data: retained for 90 days.

11. Your Rights Under POPIA

You have the right to:

  • Access the personal information we hold about you
  • Receive a copy of your data in a portable, machine-readable format (data portability)
  • Request correction of inaccurate or incomplete information
  • Request deletion of your personal information (subject to legal retention requirements)
  • Object to the processing of your personal information for direct marketing
  • Withdraw any consent you have previously given
  • Lodge a complaint with the Information Regulator (South Africa)

To exercise any of these rights, email privacy@pixsa.co.za. We may ask you to confirm your identity first. We will respond within 30 days.

If you are not satisfied with our response, you may complain to the Information Regulator: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 · enquiries@inforegulator.org.za (general) · POPIAComplaints@inforegulator.org.za (complaints) · inforegulator.org.za.

12. Cookies

We use only essential cookies required for the Platform to function:

  • Session cookies — to keep you logged in (photographers) or to remember that a client has passed the gallery hardwall.
  • CSRF / security cookies — to protect against cross-site request forgery and admin session hijacking.

We do not use third-party tracking, advertising, or analytics cookies. If we add any non-essential cookies in the future, we will display a consent banner allowing you to accept or reject them on a per-category basis.

13. Breach Notification

In the event of a security compromise that affects your personal information, we will notify the Information Regulator and affected data subjects as soon as reasonably possible after becoming aware of the incident, in accordance with section 22 of POPIA.

14. Children

The Platform is not directed at children under 18. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information without verifiable parental consent, contact us and we will delete it.

15. PAIA Manual

In terms of the Promotion of Access to Information Act, 2000 (PAIA), our PAIA manual is available on request from privacy@pixsa.co.za.

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email at least 14 days before they take effect. The version date at the top of this page reflects the most recent revision.

17. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, contact us at:

Pixsa — Information Officer
Email: privacy@pixsa.co.za