Privacy Policy

The controller of personal data processed on the Pixelbrain website and in the application is:

Controller vs. processor. For your user account data and website visit data, we are the controller. For data that you enter into the application or that flows into it from your connected accounts — content, comments, messages, advertising data, and especially contacts from lead forms — we are the zpracovatelem and you are the controller. We process this data only according to your instructions and to the extent necessary to operate the service.

This policy applies to the processing of personal data via the marketing website www.pixelbrain.ai and via the Pixelbrain application (app.pixelbrain.ai) — a cloud-based business system. It describes what data we collect, for what purpose, how we handle it, and what your rights are.

We pay special attention to data obtained when connecting your accounts on social networks (Instagram, Facebook, Threads, TikTok, LinkedIn, X, Pinterest, and others) and when connecting ad accounts (Meta Ads, Google Ads, Sklik, and others) — see sections 4–10.

• Account and identification — name, email, company name, login credentials.
• Contact details — if you contact us via a form or email.
• Content data — posts, media, and plans you create in the application.
• Data from connected social networks — see section 4.
• Data from ad accounts — campaign structure and performance metrics, see section 9.
• Contacts from lead forms — personal data of individuals who filled out your ad form, see section 10.
• Message content — if you use the feature for replying to comments and messages, see sections 7 and 8.
• Technical data — logs, IP address, device and browser type (for operation and security).

The application allows you to connect your social media accounts to plan and publish content from one place. The connection is made exclusively through the official OAuth login of the respective network — we never obtain or store your passwords to social networks.

When connecting an account, we may obtain and store:

• account identifier (user/page ID), username, and account name,
• profile picture,
• access (and, if applicable, refresh) token issued by the respective network,
• metadata about granted permissions (scopes).

We use this data exclusively to manage and publish content on the connected account at your instruction, and to display post statuses and basic metrics. We do not use data from the platforms for profiling, nor do we sell it.

Access tokens are encrypted (AES) and stored separately. They are never sent to the browser or made available to third parties. They are used solely for authorised API calls to the respective network on behalf of your account.

You can invalidate the token at any time — by disconnecting the channel in the application or by revoking permissions directly in the settings of the respective social network.

We publish to connected accounts only the content you create or schedule yourself, based on your action in the application. We do not publish anything without your instruction.

If you connect an Instagram, Facebook, or Threads account, we process data obtained via the Meta API in accordance with the Meta Platform Terms a Developer Policies.

Specifically, this includes:

• posts and media, which we publish or schedule at your instruction,
• comments on your posts, including the name and profile of their author — so you can reply to them from one place,
• metriky of your posts (reach, interactions),
• message content in Messenger and Instagram Direct, if you use this feature — including the automated private reply to a comment, which you set up yourself.

We process messages and comments from third parties as a zpracovatel for you. We do not use them for profiling, for training models, nor do we sell them.

Application removal and deletion. When you remove our application in your Facebook, Instagram, or Threads settings, Meta sends us a notification, and we immediately invalidate the stored tokens and mark the channel as disconnected. If you submit a data deletion request via Meta, we will automatically delete the corresponding channel and its associated data and return a confirmation code for you to verify the request status.

If you connect a TikTok account, we process data obtained through the TikTok API for Business in accordance with the TikTok Terms of Service, Developer Guidelines a TikTok Privacy Policy.

Specifically, this concerns:

• posts and media (videos and photos) that we publish to your connected account on your instruction, including the caption, the privacy level you chose and the interaction settings,
• profile data of the connected account — username, display name and profile picture, so we can label the channel in the application and tell it apart from the others,
• metriky of posts published through Pixelbrain — views, likes, comment count and shares,
• comments on those posts, including the author's name, profile picture and text — we show them in a shared inbox so you can reply to them.

Comments come from third parties. For those we act as a zpracovatel on your behalf: we display them only to you, and we do not use them for profiling, ad targeting, resale or model training.

We do not process data about other accounts, public TikTok content outside your own posts, or audience statistics. Writes happen only on your instruction — we publish a post you composed yourself and send a reply you wrote yourself.

Disconnection and deletion: disconnecting the channel in the application immediately invalidates the stored tokens and stops all further syncing. Deleting the channel also removes the stored comments and metrics. You can also revoke access at any time directly in your TikTok account settings.

If you connect an ad account (Meta Ads, Google Ads, Sklik, Microsoft Ads, LinkedIn Ads), we process the structure and performance of your ads so you can manage and evaluate them from the application. This includes campaign names and settings, budgets, and performance metrics (impressions, clicks, costs, conversions), as well as the ad account identifier.

We do not process payment details for ad accounts — billing remains exclusively with the respective ad platform. We create, modify, or pause campaigns only at your instruction, or according to automated rules that you set up yourself.

Performance metrics are aggregated and do not contain personal data of the individuals who saw the ad.

If you use ad forms (lead ads), we transfer the contacts of individuals who have filled them out to the application — typically name, email, phone number and answers to questions in the form.

For this data, we are the zpracovatelem a you are the controller. This means that you, as the advertiser, are responsible for the legal basis of the processing, for informing these individuals, and for handling their rights. We only transfer and store the data in your isolated space within the application so you can work with it in the CRM.

We do not use this data for any of our own purposes, we do not pass it on to other customers, and we do not combine it with the data of other customers.

Personal data we do not sell and we do not use it for training AI models. We share it only with providers necessary for the operation of the service:

• hosting and infrastructure — operation of servers and databases in the EU,
• social networks and ad platforms, to which you publish at your instruction or with which you manage ads,
• AI model provider — only for content that you yourself submit to the AI assistant (e.g., a draft post text); this data is not used for training,
• email delivery provider — sending transactional and marketing messages.

All processors are bound by corresponding agreements. We will provide you with an up-to-date list of processors upon request.

Some providers (e.g., social media platforms) are based outside the EU/EEA. Transfers are carried out on the basis of standard contractual clauses under Art. 46 GDPR, or another valid mechanism.

We retain data linked to the duration of the account until you delete it yourself or cancel the account — you need it for publication history and performance comparison over time. You can request a shorter retention period or the deletion of specific data at any time and we will carry it out without undue delay, unless we are prevented from doing so by a legal obligation.

You can at any time:

• disconnect a social channel in the application (Marketing → Social Media → Channels) — this will delete the stored token and associated data,
• revoke permissions for the application directly in the settings of the respective social network (for Meta: Settings → Apps and Websites) — Meta will inform us of the removal, and we will promptly invalidate the tokens,
• submit a deletion request via Meta — we will process it automatically, delete the corresponding channel and its associated data, and return a confirmation code to check the request status,
• request the deletion of all personal data by emailing friends@pixelbrain.ai — we will handle the request without undue delay, within 30 days at the latest.

We apply appropriate technical and organisational measures — encryption of sensitive data (including tokens), access control, isolation of individual customer data (multi-tenancy), and encrypted transmission (HTTPS).

In connection with the processing of personal data, you have the right:

• of access to your data,
• to rectification of inaccurate data,
• to erasure ('right to be forgotten'),
• to restriction of processing, a to data portability,,
• to object to processing based on legitimate interest,
• odvolat souhlas (for processing based on consent),
• to lodge a complaint with the Office for Personal Data Protection — www.uoou.cz.

The use of cookies on the website is described in a separate Cookie Policy.

We may update this policy in line with changes in legislation or processing methods. The current version is always available on this page with the date of the last update. We will inform you of any significant changes.

For any questions regarding personal data protection or to exercise your rights, please contact us at friends@pixelbrain.ai.