Legal Center

Everything you need to know about using Pixarts Store.

Last updated: April 16, 2026

Data Controller

The entity responsible for the processing of your personal data (the "Data Controller" within the meaning of GDPR Art. 4(7)) is:

  • Platform: Pixarts Store (pixarts.store)
  • Privacy contact: privacy@pixarts.store
  • Country of operation: Poland (EU)

1. Information We Collect

Your privacy is critically important to us. Pixarts Store operates in compliance with the General Data Protection Regulation (GDPR). When you interact with our platform, we collect the following types of data:

  • Account Data: Your email address, username, and authentication tokens provided during registration.
  • Transaction Data: Records of your purchases and downloaded library. Note: Sensitive payment details (like credit card numbers) are processed directly by our secure payment provider (Lemon Squeezy) and are never touched or stored by Pixarts Store servers.
  • Usage & Technical Data: IP addresses, browser types, interaction logs, and generalized location data used for analytics, security, and calculating applicable taxes.
  • Error & Performance Data: In the event of a technical error, we may collect anonymized diagnostic data (error messages, stack traces, browser/OS version, and the URL where the error occurred) via our error monitoring system (Sentry). This data contains no personally identifiable information and is used solely to identify and fix bugs.

2. How We Use Your Information & Legal Basis (GDPR Art. 6)

We use your data strictly to operate our business and improve your experience. The table below specifies the purpose, data used, and the applicable GDPR legal basis for each processing activity:

  • Account management & service delivery — Email, username, purchase records. Legal basis: Performance of a contract (Art. 6(1)(b)).
  • Transactional emails (receipts, password resets, download confirmations) — Email address. Legal basis: Performance of a contract (Art. 6(1)(b)).
  • Platform security & fraud prevention — IP address, rate-limit logs, authentication tokens. Legal basis: Legitimate interest (Art. 6(1)(f)) — preventing unauthorized access and protecting users.
  • Error monitoring & platform stability (via Sentry) — Anonymized stack traces, browser/OS info, URL. Legal basis: Legitimate interest (Art. 6(1)(f)) — maintaining security and proper functioning of the service.
  • Marketing newsletters — Email address. Legal basis: Consent (Art. 6(1)(a)) — only sent if you explicitly opted in. You may withdraw consent at any time via the unsubscribe link in any email.
  • Tax compliance & invoicing — Purchase and billing data processed by Lemon Squeezy (Merchant of Record). Legal basis: Legal obligation (Art. 6(1)(c)).

3. Cookie Policy

Pixarts Store uses cookies and similar tracking technologies to provide core functionality, analyze site performance, and — with your consent — measure the effectiveness of our advertising campaigns. This section describes each category of cookies we use.

Visitors from the EU, EEA, UK, and other GDPR-covered territories will see our cookie consent banner on their first visit. You may change your preferences at any time using the button below.

3.1 Strictly Necessary Cookies

These cookies are essential for the website to function. They cannot be disabled. No consent is required under the ePrivacy Directive.

  • cc_cookie (pixarts.store, 6 months) — Stores your cookie consent choices so we don't ask again on every visit.
  • app_session (pixarts.store, session) — Keeps you securely logged into your account.
  • __cf_bm (Cloudflare, 30 min) — Cloudflare bot management and DDoS protection.
  • cf_clearance (Cloudflare, 30 min) — Cloudflare challenge verification; issued after passing a security check.
  • sentry-sc (Sentry, session) — Anonymous session identifier used by our error monitoring tool (Sentry) to group bug reports from the same browser session. No personal data is collected or transmitted.

3.2 Analytics Cookies (Consent Required)

These cookies help us understand how visitors interact with the site. All data is anonymized and aggregated — no personal profile is built. Provided by Google Analytics 4 (GA4) via Google Tag Manager.

  • _ga (Google, 2 years) — Distinguishes unique users for aggregated traffic analysis.
  • _ga_* (Google, 2 years) — Persists GA4 session state and measurement ID.
  • _gid (Google, 24 hours) — Identifies a single user session.

3.3 Marketing & Conversion Cookies (Consent Required)

These cookies are used solely to measure whether our advertising campaigns resulted in a purchase (conversion tracking). We do not use them to build marketing profiles or retarget you on other websites.

  • _rdt_uuid (pixarts.store, 1 year) — Reddit Pixel unique conversion tracking ID. Used to report whether a Reddit ad led to a purchase.
  • _pin_unauth (pixarts.store, 1 year) — Pinterest conversion tracking for unauthenticated visitors.
  • _pinterest_ct_ua (pixarts.store, 1 year) — Pinterest conversion tracking user agent token.
  • _gcl_au (pixarts.store, 3 months) — Google Tag Manager conversion linker; associates ad clicks with conversions.

3.4 Managing Your Preferences

You can enable or disable non-essential cookie categories at any time. Use the button above, or navigate to Account → Preferences if you are logged in. Withdrawing consent does not affect any processing that occurred prior to withdrawal.

4. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law:

  • Account data (email, username) — Retained for the duration of your account. Upon account deletion, purged from active databases within 30 days.
  • Purchase & transaction records — Retained for 5 years to comply with Polish and EU tax/accounting obligations (legal retention requirement).
  • Security & rate-limit logs (IP addresses) — Retained for a maximum of 90 days, then automatically deleted.
  • Error monitoring data (Sentry) — Anonymized; retained for 30 days on Sentry's infrastructure per their data retention policy.
  • Newsletter subscription — Retained until you unsubscribe or withdraw consent.

5. Data Sharing & Third Parties

We do not sell your personal data to anyone. We only share necessary data with trusted, GDPR-compliant service providers required to operate the platform:

  • Cloudflare — Hosting, CDN, and bot protection (Turnstile). Data may be processed in the US under Standard Contractual Clauses (SCCs). Privacy Policy
  • Lemon Squeezy — Merchant of Record, handles all payment processing, VAT collection, and tax compliance. Acts as an independent data controller for payment data. Privacy Policy
  • Sentry — Error monitoring. Data processed: anonymized error reports (stack traces, browser info, URL). Legal basis: Legitimate Interest (GDPR Art. 6(1)(f)). No personal data is sent to Sentry. Privacy Policy
  • Google (Analytics & Tag Manager) — With your consent, anonymized usage data is sent to Google Analytics 4 via Google Tag Manager for traffic analysis. Data processed in the US under SCCs. Privacy Policy
  • Reddit — With your consent, conversion events (purchases) are reported to Reddit via Reddit Pixel for advertising attribution. No personal data other than a hashed identifier is shared. Privacy Policy
  • Pinterest — With your consent, conversion events are reported to Pinterest via Pinterest Tag for advertising attribution. No personal data other than a hashed identifier is shared. Privacy Policy

6. Your Rights (GDPR Art. 15–22 & CCPA)

Depending on your location, you have the following rights regarding your personal data:

  • Right of access (Art. 15) — You may request a copy of the personal data we hold about you.
  • Right to rectification (Art. 16) — You may request correction of inaccurate or incomplete data.
  • Right to erasure (Art. 17) — You may request deletion of your personal data. You can initiate this directly from the "Security Settings" tab in your dashboard. Upon deletion, all personal records are purged from our active databases within 30 days.
  • Right to restriction of processing (Art. 18) — You may request that we restrict processing of your data in certain circumstances.
  • Right to data portability (Art. 20) — You may request your data in a structured, machine-readable format.
  • Right to object (Art. 21) — You may object to processing based on legitimate interest at any time.
  • Right to withdraw consent (Art. 7(3)) — Where processing is based on consent (e.g., newsletters), you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at privacy@pixarts.store. We will respond within 30 days.

7. Right to Lodge a Complaint (GDPR Art. 13(2)(d))

If you believe that the processing of your personal data violates GDPR, you have the right to lodge a complaint with a supervisory authority. In Poland, the competent authority is:

  • Urząd Ochrony Danych Osobowych (UODO)
  • Website: uodo.gov.pl
  • Address: ul. Stawki 2, 00-193 Warsaw, Poland

If you are located in another EU member state, you also have the right to complain to the supervisory authority in your country of residence.

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the updated policy on this page with a revised "Last updated" date. We encourage you to periodically review this page.