Privacy policy

Data controller

PXL AS (org. no. 931 787 969) is the data controller for the personal data processed on pxl.no. Send questions about privacy and requests to exercise your rights to post@pxl.no. Our postal address is PXL AS, Brygga 11, 2317 Hamar, Norway.

When we process personal data on a client's behalf in a project, the data processing agreement with that client applies, not this policy.

Visiting the website

Every request to pxl.no passes through Cloudflare, which serves the pages from the nearest data centre and blocks attacks. To do that, Cloudflare processes your IP address and details of the request, such as the page requested, the browser and the time. The website itself runs on servers we operate ourselves in the EU/EEA.

We count visits with Plausible Analytics, which we host ourselves on the same servers. Plausible sets no cookies and does not store your IP address. To count unique visitors, Plausible hashes the IP address and browser together with a random value. The random value is replaced and deleted every day, so no visitor can be followed from one day to the next. All we see are totals: which pages are visited, where visitors came from, their country and their type of device.

The legal basis is our legitimate interest in running a secure website and knowing which pages are used (GDPR Art. 6(1)(f)). The cookies the website uses are listed on the cookies page.

Contact and booking a meeting

The contact form sends your name, email address, topic, message and, if you add it, your company. When you book a meeting, you send your name, email address and the time, and optionally your phone number, company and a message.

Messages from the contact form are sent by email through Mailgun to our inbox in Google Workspace. When you book a meeting, we create an event in our Google Workspace calendar with you as a guest, and Google sends you the invitation. If you choose a video call, Google adds a Meet link to the event.

The legal basis is your request for a reply or a meeting before any agreement (Art. 6(1)(b)) and our legitimate interest in answering enquiries (Art. 6(1)(f)). We delete enquiries and meetings two years after our last contact. If you become a client, we keep contracts and invoices for five years after the end of the financial year, as the Norwegian Bookkeeping Act requires.

Job applications

The application form sends your name, email address, CV as a PDF and cover letter, and optionally your phone number and a link to LinkedIn or a portfolio. The application is emailed, with the CV attached, through Mailgun to our inbox in Google Workspace. The website does not store it; it only sits in the server's queue until the email has been sent.

The legal basis is your request that we consider you for a position (Art. 6(1)(b)). We delete the application and CV six months after the position is filled. If we would like to keep your application for future openings, we ask you first.

Spam protection with reCAPTCHA

When you send the contact form, a booking or a job application, the page loads Google reCAPTCHA v3. reCAPTCHA assesses whether a human is sending the form and sends your IP address and details of your browser and device to Google. Google may also read and set its own cookies. The script only loads when you send a form.

The legal basis is our legitimate interest in stopping spam and abuse of the forms (Art. 6(1)(f)). Google processes the data under Google's privacy policy.

Search and Howdy

The search field in the knowledge base sends your search terms to our own search engine, Meilisearch, on our servers. Searches are not stored.

Howdy is a chatbot that answers from the articles in the knowledge base. Before a message leaves our server, we remove passwords, API keys, tokens and email addresses from it. The masked message and the latest messages in the conversation are sent to:

• Google Gemini, which turns the question into a vector for the search, summarises follow-up questions and writes the answer. We use the paid API, under which Google does not use the content to improve its products.
• TypeSafe AI, whose model Jev judges which articles answer the question.

The conversation is kept in your browser and deleted when you close the tab. When Howdy finds no answer, or suggests that you contact us, we log the masked message to improve the knowledge base. If you answer "Did this help?", we log only the article and your answer. The logs are deleted after 90 days at the latest. Please do not include personal data about others or sensitive information in your message.

The legal basis is our legitimate interest in answering the question you ask and improving the articles (Art. 6(1)(f)).

Service providers

These providers process personal data on our behalf:

Transfers to the US rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses. We do not sell personal data, and we share it only with the providers above unless the law requires otherwise.

Your rights

You have the right to:

• access the data we hold about you
• have mistakes corrected
• have your data erased
• restrict the processing
• object to processing based on our legitimate interest
• receive the data you have given us in a machine-readable format

Send your request to post@pxl.no. We reply within one month. If you believe we process personal data unlawfully, you can complain to the Norwegian Data Protection Authority, Datatilsynet.

Security

All traffic to pxl.no is encrypted with HTTPS. The forms reject forged submissions (CSRF), and the number of submissions per IP address is limited. Howdy removes passwords, keys and email addresses from messages before passing them on.

Changes

We update this policy when we change how we process personal data. The date at the top shows when it last changed.