Trust
What you are trusting us with, and what we do about it
This page lists how Pixeloa handles your data, your money and the truth about what we show. Nothing here is aspirational: each line describes something the product enforces today, in code or in a setting we can show you.
Last checked against the product on 22 August 2026.
Security
The controls below are the ones that matter most for a small business putting its products and payment details through a web service.
Isolated at the database
Every customer table is protected by Postgres row-level security, so an account can only ever read and write its own rows. Elevated access exists only in server code, never in the browser.
API keys are never stored in plain text
A key is shown once, when you create it. We keep only its SHA-256 hash and compare it in constant time on every request. Keys are scoped to what they need and can be rotated.
Webhooks you can verify
Outbound webhooks carry an HMAC-SHA256 signature with a timestamp (the Pixeloa-Signature header), signed with a secret unique to each endpoint, so your server can reject anything we did not send.
Incoming webhooks are verified too
Stripe and Resend webhooks are accepted only with a valid signature, checked in constant time, and each event is recorded by id so a retry is never applied twice.
Secrets stay out of the code
Provider and signing secrets live in Cloudflare Worker secrets and Supabase Vault, never in the repository and never in the browser bundle.
Bot verification on the door
Cloudflare Turnstile protects sign-in, sign-up, password changes and the public contact and sales forms without puzzles and without tracking you across sites.
A published way to report problems
/.well-known/security.txt lists our security contact. We acknowledge reports within three business days and, once a fix is live, credit researchers who want it.
Your data
You own what you upload and what is generated from it. These are the mechanics behind that sentence.
Export and delete it yourself
The Privacy page in your account lets you download everything we hold about you as a file and delete your account outright. No ticket, no waiting on us. Both paths are tested end to end.
Records that cannot be quietly edited
The audit log is append-only and the credit ledger is immutable: database triggers refuse updates and deletes, for us as much as for anyone else.
Anonymised, not hoarded
When you delete your account, the records we have to keep for accounting (the credit ledger, the audit trail, the email send log, support messages) lose your identifying details and free text. The marketing send log is anonymised after 24 months in any case. Retention for every category is spelled out in the Privacy Policy.
Page analytics without visitors
Public AR and catalog pages record the event type, the platform, the surface it was viewed on and a coarse country taken from the Cloudflare edge header. No cookies, no IP addresses, no device fingerprints, nothing that identifies a person. Site-wide traffic is measured with Cloudflare Web Analytics, which also sets no cookies and does not identify visitors.
Email only when you ask for it
Product-update email goes only to accounts that opted in. Every message carries a one-click unsubscribe (RFC 8058) that works without signing in, and a bounce or a spam complaint switches the opt-in off automatically. We measure opens and link clicks on those emails, only to tell whether they are still wanted; the Privacy Policy says exactly what is kept.
Honesty
Pixeloa exists to show customers the real thing at real size, so the site holds itself to the same standard.
AI content is labelled
Every public page that shows an AI-generated model or AI-assisted text says so, and the model files carry a machine-readable provenance mark. This follows Article 50 of the EU AI Act, which we apply voluntarily.
No fabricated proof
The customer-logo strip on our landing page renders nothing until a real customer has given permission. There are no invented testimonials, review counts or usage numbers anywhere on this site.
Scale is never assumed
You confirm the real-world dimensions before a model is generated, and the model is locked to them. We do not guess on your behalf.
Failed work is refunded
If a generation fails, the credits go back automatically, to the same lot they were taken from. You pay for results, not attempts.
Billing
Money should be the least surprising part of the product.
Stripe handles the money
Payments run through Stripe; we never see or store card numbers. For qualifying purchases, Stripe acts as the merchant of record through its Link checkout, which is why your statement shows LINK.COM* and why Stripe collects and remits the applicable taxes. Invoices and receipts live in the Stripe billing portal, one click from your billing page.
No transaction fees, no view caps
Pixeloa charges for the platform, never a percentage of what you sell, and never meters how often your AR pages are viewed.
Costs before you commit
The credit cost of a generation and the balance you will have left are shown before you confirm. Nothing is billed that you did not choose.
Cancel in the app, keep 90 days
You can cancel or resume a subscription from your billing page. After a cancellation your models, pages and data stay for 90 days, with reminders along the way, before anything is deleted.
Who handles your data
We share only what each service needs to do its job. Full details, including retention and international transfers, are in the Privacy Policy.
| Service | What it processes |
|---|---|
| Google (AI vision, current provider) | The product photos you upload, to estimate dimensions and describe the item for your review. |
| Meshy | Your photos and confirmed dimensions, to generate the 3D model. |
| Supabase | Database, authentication and file storage for your account. |
| Stripe | Payments, subscriptions, invoices and receipts. Stripe holds your card details; we do not. |
| Resend | Transactional email such as reports and account notices and, only if you opt in, product-update email. |
| Cloudflare | Hosts the site and API, serves published 3D models from its storage, runs Turnstile bot verification, and measures site traffic in aggregate with Cloudflare Web Analytics (no cookies, no individual visitor tracking). |
| YouTube | One video on the how-it-works page, embedded in privacy-enhanced mode: it sets no cookies until you press play. |
What we do not do
- We do not run advertising pixels or ad-network tracking on any page.
- We do not sell or share your personal information with advertisers or data brokers.
- We do not send marketing email to anyone who has not opted in.
- We do not store your card details, on our servers or anywhere else.
- We do not publish numbers, logos or quotes we cannot show you the source of.
Built on
Cloudflare, Supabase, Stripe and Resend are trademarks of their respective owners. Their marks show the services Pixeloa runs on and imply no endorsement.
Questions about any of this?
Write to security@pixeloa.ai for security matters and support@pixeloa.ai for everything else. Answers come from a person.