8pixel

Privacy policy

Last updated: 2026-10-11

Private beta. 8pixel is in a private beta by invitation. The company is not registered yet, so the name on these pages is a working name. We do not take payments.

8pixel is a website builder (“we”, “us”, or “8pixel”). This policy describes what information we collect, how we use it, and your rights.

1. Data Controller

8pixel (working name). Contact: contact@8pixel.app, or the contact form.

Data roles

For 8pixel user account, billing, and support data, 8pixel is the controller. When a customer's published website collects data from its visitors, the customer is controller and 8pixel is processor. That customer's own privacy notice governs the visitor relationship. Our Data Processing Agreement governs that processing.

If you hold the account for someone else, the account holder is the controller towards us. You warrant that you may appoint us. The account holder has access to everything in the account, including details visitors submitted on the website. If ownership is handed over, the previous owner by default remains an editor until someone removes them.

2. What We Collect

If you join the waitlist, we store your email, any note you add, and your request status to review your request and send a confirmation or invitation. Resend delivers those emails. You can remove your entry using the link in the confirmation email. We delete the details 12 months after the last change, or 30 days after you create an account. Cloudflare Turnstile protects the waitlist against bots by processing technical browser signals, including your IP address. We do not send your email or note to Turnstile.

If you write to us through the contact form, we store your name, email address and message so we can reply. If you ask to hear when the iPhone or Windows app is out, we store your email address and which app you want.

Before you have an account, we write no AI drafts for you. Creating a website needs an account.

Our copy of the public company register

So that you do not have to type in facts about your own business, we keep a copy of the free dataset that Bolagsverket and Statistics Sweden publish about Swedish legal persons. Sole traders are excluded. The copy is refreshed weekly.

3. Why We Process Data

4. Sub-processors and Third Parties

We share data with the following service providers:

We never sell your data to third parties.

The current list with purposes, data categories, and regions is available on the Sub-processors page.

5. Storage and Security

We use encrypted connections when data is transmitted. Providers may process or store data in the EU/EEA, the US, or other regions depending on the service and configuration. We document regions in the sub-processor list and update the information when a provider or processing changes.

Some of our providers process data outside the EU and EEA, in practice in the United States. The transfer then rests on one of two safeguards.

Clerk, Resend and Vercel are certified under the EU-US Data Privacy Framework, which the European Commission has found to provide an adequate level of protection.

OpenRouter are covered by the European Commission's Standard Contractual Clauses, Module 2.

For the remaining providers outside the EU and EEA, among them Convex, Browserless, Browserbase, Cloudflare Browser Rendering, Firecrawl, Geoapify, Google Places and Google Cloud Translation, the safeguard is assessed per provider and we have not read it ourselves yet. We would rather write that than assert a safeguard we have not checked.

If you want the evidence for a particular safeguard, contact us and we will send a copy.

Account data is normally removed after a 30-day cancellation period following an approved deletion request. Website data is removed when a website is deleted. Accounting duties, backups, and providers' own retention periods can require limited data to remain longer.

Domain details have a rule of their own. The personal or company identity number is erased as soon as the registration is settled, just as reliably when it fails or the payment never arrives as when it succeeds. The remaining contact details stay for as long as you hold the address. If the purchase never happens, they are cleared automatically 30 days after the last attempt. This category is not part of the self-serve data export, because the records sit alongside payment state at our providers. Ask us at the address below and we will hand them over once we have verified it is you asking.

The domain is not the only exception. The self-serve export covers most of what we hold, but a few categories come on request instead: security and audit logs, payment records held at our providers, and a small number of technical records we cannot tie to the right person without checking who is asking. Ask us at the address below and we will hand them over after an identity check.

6. Your Rights (GDPR)

You have the right to:

Contact us at contact@8pixel.app to exercise your rights. We respond within 30 days.

7. Cookies

8pixel uses necessary cookies for login sessions. No advertising cookies are used. Your published websites may include analytics tools (e.g. Google Analytics) if you enabled them in settings. These are governed by the respective provider's privacy policy.

The 8pixel app uses necessary sign-in and security cookies. Optional product analytics, masked session replay and voluntary surveys are enabled only after consent. On published customer sites, optional analytics and marketing tools load only after consent.

8. Changes

We may update this policy. Material changes will be communicated via email or an in-app notice. Continued use after notice constitutes acceptance of the updated policy.

9. Contact

Privacy questions: contact@8pixel.app