Who handles your information
Pixel and Beam Creations operates Pixel Crystal Studio and is responsible for the information it collects to provide the service. Send privacy, access, correction, deletion or account-closure requests to crystal@pixelandbeam.ca. We may ask for reasonable identity verification before disclosing or changing account information.
Information we use and why
We use the name and email you supply to review an account request and respond to you. Approved accounts also have a login, password hash, account status and credit balance. We keep credit grants and deductions, orders and payment references, saved settings, referral attribution and administrative/security activity to run the service, prevent misuse, resolve support or billing issues and meet applicable obligations. Account-request notifications include the requester's name and email and, if used, referral details for authorised administrators.
Project support originals (when enabled)
When project support storage is enabled, uploaded original photos are also stored in private server storage for authorized administrator troubleshooting for up to 24 hours from upload. The Studio upload notice shows whether this is enabled. Get Help stores the current editable support snapshot, preparation and export settings, version information and minimal device/capability and error diagnostics. It queues an email to pixelandbeam@outlook.com containing an authenticated project link and expiry, with no photo attachment. Support requests do not extend expiry. Access stops at expiry even if physical cleanup is delayed. Scheduled cleanup runs every minute; server outages can delay byte deletion and must be monitored. An admin can trash, restore before expiry or permanently purge an original and its support snapshots. Separately saved projects can contain photo copies and keep their existing 24-hour expiry; generated files and financial records keep their existing policies. Support access and reproduction do not create a paid generation. Local downloaded copies remain under the downloader’s control.
Artwork and browser AI
Image background removal, face-location checks and depth estimation run in your browser. The studio's face checks locate image regions for depth refinement and do not identify a person or match an identity. Photos are not sent to an external image-to-3D service for this browser-only workflow. Model/runtime/font downloads contact third-party providers such as Hugging Face, jsDelivr and Google Fonts; those providers may receive ordinary network information such as your IP address. The studio does not use your images to train AI models.
If you save a project in the 24-hour Project folder, the server receives the project, which can include photos, original images, cutout masks, depth and settings. The toolbar's Save project button instead downloads an editable copy to your device. When you generate an export, the server receives the geometry and generation settings needed to validate, store and deliver the file. Authorised administrators and hosting/service providers can access information as needed to operate, secure or support the service. Do not upload information you lack permission to process, especially photographs of other people or children.
Payments and service providers
Stripe processes checkout and payment information under its own privacy terms. The studio stores payment references, order status and credit accounting, not your complete card number or card security code. Hostinger provides website hosting and configured notification email delivery. Providers may process information in other countries under their own infrastructure and applicable requirements. We do not sell your personal information or share your artwork for unrelated advertising.
Cookies, device storage and security
An essential session cookie keeps you signed in and protects requests. Hosting and security logs may include IP addresses, request times and technical request information used for security and diagnostics. Your device may cache model/runtime files and, in the standalone edition, reusable presets. Local downloaded files and browser data remain under your control. We use server-side account and role checks, encrypted HTTPS sessions when hosted securely, password hashing, private file storage, access checks and optional authenticator verification. Authenticator secrets are encrypted on the server and recovery codes are stored as hashes. No system can eliminate every security risk; keep your device, credentials and recovery codes secure.
Account-request security monitoring
We record the connection IP when an account request is submitted. Authorized admins can use ipwho.is to look up an approximate country, region and city for request monitoring; only the IP is sent to that provider. This identifies a network location, which may belong to a VPN, proxy or mobile network, and is not proof of identity or a precise physical location. IP and lookup details are removed after 90 days by maintenance and on admin review. Older requests are not assigned an invented historical IP. Request and email-release history remains part of the account record. See the location provider’s privacy information.
Retention and deletion
Saved projects and generated exports in the live server folder expire after 24 hours; expiry blocks downloads and automatic maintenance removes expired live copies. A hosting backup, if one is created, follows the provider's backup lifecycle. Downloaded copies and browser caches are not remotely erased. Account requests, approved accounts, saved presets, referrals and financial/security records do not share the 24-hour artwork expiry. We retain these only as needed for the service, support, security, accounting or legal obligations and review applicable deletion requests. We may need to retain records required by law or to resolve an outstanding dispute.
Your choices and privacy rights
You can choose whether to save a server project, generate a file, use a referral link or enable two-step verification. You can request information about our use of your data, access to your personal information, correction of inaccuracies, withdrawal of consent where applicable, or deletion/account closure, subject to lawful limits. Withdrawing information necessary to operate an account may prevent further service use. We respond within applicable legal requirements and explain relevant limits. Contact crystal@pixelandbeam.ca; you may also raise a concern with the relevant privacy regulator, including the Office of the Privacy Commissioner of Canada.