Privacy Policy

Last updated: November 9, 2026

1. Introduction

William Addis, PO Box 308, Annawan, IL 61234, operates Squaredpix. "We" and "us" mean William Addis. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use the Squaredpix platform (the "Service"). We are the data controller for the purposes of the General Data Protection Regulation (GDPR) and other applicable data protection laws.

By using the Service, you consent to the data practices described in this Privacy Policy. If you do not agree with our policies and practices, please do not use our Service. This Privacy Policy should be read in conjunction with our Terms of Service.

2. Information We Collect

We collect the following categories of personal information:

Identifiers

Name, email address, phone number, IP address, device identifiers, and unique user IDs.

Commercial Information

Subscription history, payment methods, billing information, and transaction records.

Internet or Network Activity

Browsing history on our Service, usage data, analytics, session logs, and interactions with our platform.

Geolocation Data

Location from a photo file when that file includes it, browser location on Quick Upload when you allow it, and project addresses you type in.

Professional Information

Company name, job title, business address, organization details, and industry information.

Sensory Data

Photos, images, videos, and audio recordings you upload to the Service.

Inferences

User preferences, behavioral patterns, and usage trends derived from your activity on the Service.

Collection Methods:

• Direct collection through forms, uploads, and account registration
• Automatic collection via cookies, analytics, logs, and tracking technologies
• Third-party sources such as payment processors and authentication providers

3. Legal Basis for Processing (GDPR)

We process your personal data under the following legal bases:

• Contract Performance: To provide the Service, manage your account, and fulfill our contractual obligations.
• Legitimate Interests: For analytics, fraud prevention, security, service improvement, and business operations.
• Consent: For marketing communications, optional features, and non-essential data processing where explicitly requested.
• Legal Obligations: To comply with tax laws, financial record-keeping requirements, and legal processes.

4. How We Use Your Information

We use your personal information for the following purposes:

• Provide, maintain, operate, and improve the Service
• Process payments, manage subscriptions, and handle billing
• Provide customer support and respond to inquiries
• Send transactional emails, service updates, and technical notices
• Analyze usage patterns and conduct analytics to improve user experience
• Detect, prevent, and address fraud, security threats, and technical issues
• Comply with legal obligations and enforce our Terms of Service
• Send marketing communications (only with your consent)
• Facilitate collaboration within your organization based on configured access controls

5. Data Sharing and Disclosure

We share your personal information with the following categories of recipients:

• Service Providers: Supabase (database and authentication), Stripe (payment processing), cloud hosting providers, and email delivery services.
• Organization Members: Other users within your organization based on role-based access controls you configure.
• Legal Authorities: When required by law, court order, subpoena, or to protect our legal rights.
• Business Transfers: In connection with a merger, acquisition, sale of assets, or bankruptcy proceeding.

We do NOT:

• Sell your personal information to third parties
• Share your data with advertisers or data brokers
• Rent or lease your personal information

We do not use your photos for machine learning or AI training unless you opt in.

6. Cookie Policy

We use cookies and similar tracking technologies to improve your experience on our Service. Cookies are small text files stored on your device that help us recognize you and remember your preferences.

Types of Cookies We Use:

• Strictly Necessary Cookies: Essential for authentication, session management, and security. These cannot be disabled.
• Functional Cookies: Remember your preferences, settings, and customizations.
• Analytics Cookies: Help us understand usage patterns, performance metrics, and service optimization opportunities.

You can control cookies through your browser settings. However, disabling essential cookies may prevent you from using certain features of the Service. We do not respond to Do Not Track (DNT) signals at this time.

7. Data Retention

We retain your personal information for the following periods:

• Active Accounts: Data is retained while your account remains active and as needed to provide the Service.
• Terminated Accounts: Deleting your account sends DELETE /api/me and takes effect when that request succeeds. There is no 14-day export hold. A workspace where you are the only member is deleted with your login. A workspace that still has other members keeps that team's files, and your membership is removed.
• Legal and Financial Records: Retained for 7 years as required by tax laws and financial regulations.
• Analytics Data: Aggregated and anonymized data may be retained indefinitely for business analytics and service improvement.
• Backup Systems: Data may persist in backup systems for up to 90 days after deletion.

8. International Data Transfers

Your personal information may be transferred to and processed in the United States and other countries where our service providers operate. These countries may have data protection laws that differ from those in your jurisdiction.

For European Union users, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission to ensure adequate protection of your personal data when transferred outside the EU/EEA.

By using our Service, you explicitly consent to the transfer and processing of your personal information in accordance with this Privacy Policy.

9. Data Security

We implement industry-standard security measures to protect your personal information, including:

• Encryption in transit using TLS/SSL protocols
• Encryption at rest for stored data
• Role-based access controls and authentication mechanisms
• Regular security audits and vulnerability assessments
• Incident response and data breach notification procedures
• Secure password policies and multi-factor authentication options

Disclaimer: While we take reasonable measures to protect your data, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security and you use the Service at your own risk.

10. Your Rights Under GDPR (European Users)

If you are located in the European Union, European Economic Area, or United Kingdom, you have the following rights regarding your personal data:

• Right to Access: Request copies of your personal data we hold.
• Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data in certain circumstances.
• Right to Restrict Processing: Request that we limit how we use your personal data.
• Right to Data Portability: Request a copy of your data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests, including for direct marketing purposes.
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
• Right to Lodge a Complaint: File a complaint with your local Data Protection Authority.

How to Exercise Your Rights:

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days. We may require verification of your identity before processing your request.

Exercise Your Right to Erasure

Signed-in deletion is described on the account deletion page. It does not delete every file in a workspace that other people still belong to.

If you delete your account while you are the only member of a workspace, we remove that workspace's data when deletion finishes. If you are on a shared workspace, or another member joins before we finish removing a workspace you solely owned, that workspace's projects and files may remain for the remaining members. We delete your login and remove your name and email from comments; records kept for the team may still hold an opaque account id. Some stored files may take additional time to clear from backups (up to 90 days).

11. Your Rights Under CCPA (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months.
• Right to Delete: Request deletion of your personal information, subject to certain exceptions.
• Right to Correct: You may request that we correct inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale: We do NOT sell your personal information, so no opt-out is necessary.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

Personal Information Collected (Past 12 Months):

• Identifiers (YES)
• Commercial information (YES)
• Internet or network activity (YES)
• Geolocation data (YES - from photos)
• Professional information (YES)
• Sensory data (YES - photos)
• Inferences (YES)

Do Not Sell My Personal Information:

We do NOT sell your personal information to third parties and have not sold personal information in the past 12 months.

To submit a CCPA request, contact us at [email protected].

Sensitive personal information: precise geolocation from photos or Quick Upload when you allow it. We use it only to provide the Service and do not use it to infer characteristics about you.

12. Children's Privacy

Our Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

Upon verification, we will delete such information from our systems. We comply with the Children's Online Privacy Protection Act (COPPA) and similar regulations worldwide.

13. Marketing Communications

We may send you marketing communications about new features, promotions, and updates only if you have opted in to receive such communications. You can opt-out at any time by:

• Clicking the "unsubscribe" link in any marketing email
• Updating your notification preferences in your account settings
• Contacting us at [email protected]

Note: You cannot opt-out of transactional emails (e.g., account notifications, billing statements, security alerts) as these are necessary for the operation of your account.

14. Third-Party Services

We use the following third-party service providers to operate our Service:

Stripe (Payment Processing)

Stripe processes all payments and is PCI-DSS compliant. We do not store your full credit card details on our servers.

Supabase (Database & Authentication)

Supabase provides our database infrastructure, authentication services, and file storage.

Analytics Providers

We use analytics tools to monitor usage patterns and improve the Service. These providers may collect information about your device and usage.

These third parties have their own privacy policies and we are not responsible for their practices. We encourage you to review their policies.

Self-hosted fonts: Barlow, IBM Plex Mono, and Instrument Serif (SIL Open Font License 1.1); font files and license text are served from this site.

15. Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your personal information may be transferred to the acquiring entity. We will notify you via email and/or prominent notice on our Service before your information becomes subject to a different privacy policy. You will have the opportunity to delete your account before such transfer.

16. Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time. When we make material changes, we will notify you by:

• Email notification to your registered email address
• Prominent notice on the Service
• Updating the "Last updated" date at the top of this policy

Your continued use of the Service after any changes constitutes acceptance of the updated Privacy Policy. We encourage you to review this policy periodically.

17. Data Protection Officer

For any privacy-related concerns, data protection questions, or to exercise your rights, you may contact our Data Protection Officer at:

Email: [email protected]

Subject Line: "Privacy Inquiry" or "Data Rights Request"

18. Supervisory Authority (EU Users)

If you are located in the European Union and believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with your local Data Protection Authority (DPA).

To find your local DPA, visit: https://edpb.europa.eu/about-edpb/about-edpb/members_en

19. California Privacy Disclosures

The following table summarizes our data practices for California residents:

20. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Privacy Inquiries: [email protected]

General Support: [email protected]

Operator: William Addis, PO Box 308, Annawan, IL 61234 — [email protected]

William Addis, PO Box 308, Annawan, IL 61234

We will respond to privacy inquiries within 30 days (GDPR) or 45 days (CCPA) of receiving your request.