Privacy Policy

Pixmint ("Pixmint", "we", "us") runs Pixmint Control Center at https://crm.pixmint.agency. We decide what information the tool holds and how it is used, so we are responsible for it. Our office and operations are in Bangladesh, we work with clients in Singapore, the United Kingdom and Ireland and anywhere else in the world, and we handle personal data in line with the data protection laws that apply to us and to the people concerned. Depending on where you are, that can include the laws of Bangladesh, Singapore's Personal Data Protection Act (PDPA), and, for people in the United Kingdom and the European Economic Area (including Ireland), the UK GDPR and the EU GDPR. You can reach us at info@pixmint.agency.

This policy applies to our team members who sign in, to the people and businesses whose details our team records as part of client work, to people who sign an agreement through a signing link we send them, and to anyone who visits this website.

Team members

Name, work email address, role, an optional profile photo, and sign-in details (passwords are stored only as a one-way hash by our authentication provider). We keep a record of actions taken in the tool, such as who changed which record, to keep the work accountable and secure. For payroll, the tool also holds salary details, which only authorised owners and managers can see.

Clients and their contacts

What our team enters about the businesses we work for: business name, contact person, email address, phone number, billing address, website and social media links, notes, package and fee details, invoices and payments, contracts, performance reports, and content plans (captions, schedules, and the images and videos for posts).

People who sign an agreement

When a client opens a signing link we sent them, the page records the signature they draw, the date and time they sign, and keeps the signed agreement as a PDF. Opening the page does not require an account.

Technical information

Our servers keep ordinary operating logs (for example requests and errors) so we can keep the service running and investigate problems.

Our files for each client live in a Google Drive account owned by Pixmint. The tool can connect to that one account so the team can see, add and organise those files from inside the tool. This section describes exactly what that connection does.

What is connected

Only Pixmint's own Google account, connected once by a Pixmint owner. Team members do not sign in with Google, and the tool does not access any other person's Google account. The permission requested is https://www.googleapis.com/auth/drive (see and manage files in Google Drive).

Why this permission is needed

Our client folders already exist in Drive and are also used outside the tool. The narrower Drive permissions only reach files the app itself created, so they cannot show the existing folders and files our team works with. The tool limits itself further: it only works inside one chosen "Clients" folder and refuses to open or change anything outside it.

What the tool does with Drive data

• Lists folders and files inside the Clients folder and shows their names, sizes and dates.
• Shows previews and thumbnails and lets team members download files, or several files as one ZIP, according to their role.
• Uploads files a team member chooses into a folder they pick, and creates, renames, moves and moves to the Drive trash the files and folders a team member chooses to change. It never permanently deletes anything.
• Attaches Drive files to content posts. Only a reference (the file's Drive ID and name) is stored; the file itself stays in Drive.
• Searches file and folder names inside the Clients folder.

What we store

In our database: the connected account's email address, the Drive folder chosen as the Clients folder, which Drive folder belongs to which client, and the IDs and names of files attached to content posts. The long-lived sign-in token that lets the tool keep working is stored encrypted (AES-256-GCM) and is only ever used by our server; it is never sent to a web browser. Short-lived access tokens are kept in server memory for about an hour. File contents are not copied into our database: they pass through our server only while a team member previews, downloads or uploads them, and are not kept afterwards. One exception applies to a client who has no Drive folder connected: files uploaded for that client are held temporarily in our cloud storage and deleted after the post is published.

Who can see it

Authorised Pixmint team members, limited by role (for example, a content creator only sees the files of clients they are assigned to, and only owners and account managers can browse the whole Clients folder). Pixmint staff do not read Drive files other than as part of their work for the client concerned, or where needed for security, support or to meet the law.

Sharing

We do not sell Google user data, we do not use it for advertising, and we do not transfer it to anyone except the service providers listed in section 5, who help us run the tool, or where the law requires it. We do not use Google user data to develop, improve or train generalised artificial-intelligence or machine-learning models.

Keeping you in control

A Pixmint owner can disconnect Google Drive at any time from Integrations in the tool, which deletes the stored sign-in token straight away. Access can also be removed from the Google account's "Third-party apps with account access" page at myaccount.google.com/connections. Disconnecting does not delete anything in Drive. To have the stored links and IDs removed as well, email info@pixmint.agency.

Google API Services User Data Policy

Pixmint's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• To run client work: plan and produce content, store and share files, and keep records.
• To prepare contracts, invoices and reports, and to record payments.
• To manage team access, keep the tool secure, and investigate problems.
• To meet our legal, tax and accounting obligations.

We do not use this information for advertising and we do not sell it.

If the UK GDPR or EU GDPR applies to you, our reasons for using your information (our "legal bases") are: to carry out a contract with you or the business you work for, or to take steps before one; our legitimate interests in running, securing and improving our business, which we balance against your rights; to meet legal obligations; and, where we ask for it, your consent.

We use trusted providers to run the tool. They process information only on our behalf and for that purpose:

• Supabase: database and sign-in.
• Oracle Cloud: the server that runs the tool.
• Cloudflare: secure connection to the site, and temporary media storage.
• Google: Google Drive, as described in section 3.
• Social media platforms such as Meta, only if we connect a client's account to read its performance numbers.

We may also disclose information when the law requires it, or to protect our rights, our clients or other people.

We use only what the tool needs to work: sign-in session cookies, a short-lived security cookie while a Pixmint owner connects Google Drive, and your browser's local storage for display choices such as light or dark theme and list or grid view. We do not use advertising or analytics cookies.

• All traffic uses HTTPS.
• Access is by invitation and limited by role, enforced on our server.
• Secrets such as the Google sign-in token are kept on the server only, and the token is encrypted in our database.
• Changes to records and files are logged with who made them.

No system is perfectly secure. If we learn of a breach that affects your information, we will tell the people affected and the authorities where the law requires it.

We keep information for as long as we work with the client or team member concerned, and afterwards as long as we need it for legal, tax and accounting reasons, which can be several years depending on the law that applies. Stored Google sign-in tokens are deleted when Google Drive is disconnected. Files in Drive stay in Pixmint's Drive until we remove them there.

Wherever you are, you can ask what personal data we hold about you, ask us to correct it, and ask us to delete it when we no longer need it. If you are in the United Kingdom or the European Economic Area you can also ask us to restrict or stop certain uses, ask for a copy of your data in a portable format, and withdraw any consent you gave at any time. If you are in Singapore you can ask for access and correction and withdraw consent under the PDPA. Withdrawing consent may limit the services we can provide, and we will explain how.

Email info@pixmint.agencyand we will reply as soon as reasonably possible, normally within 30 days. If you are not happy with our reply, you can complain to your local data protection authority, for example the UK Information Commissioner's Office (ICO), Ireland's Data Protection Commission, or Singapore's Personal Data Protection Commission.

Pixmint is based in Bangladesh, and our team uses the tool from there. Our main server runs in Singapore, and our other providers may store or process information in other countries. When personal data of people in the United Kingdom or the European Economic Area is sent to a country without an official "adequate protection" decision, we rely on safeguards such as standard contractual clauses where the law requires them.

The tool is for business use and is not directed at children. We do not knowingly collect personal data from anyone under 18.

We may update this policy. The date at the top shows when it last changed, and for significant changes we will tell team members in the tool.

Pixmint, Bangladesh. info@pixmint.agency