Legal

Privacy Policy

Last updated: August 16, 2026

This policy explains what personal data ArcPixel collects through its website and platform, why, and the rights you have over it. It is written to meet the requirements of the EU General Data Protection Regulation (GDPR) and India's Digital Personal Data Protection Act, 2023 (DPDP Act).

1. Scope & roles

This policy covers ArcPixel (Moonlight Arc), including this marketing website and the ArcPixel application used by individuals and creative studios to build and publish portfolios.

When you create an ArcPixel account and use the platform, Moonlight Arc acts as the data controller / data fiduciary for your account, billing, and the data you provide to run the service. If you publish a portfolio that includes personal data about other people (for example, client names, team members, or collaborators), you are responsible for having a lawful basis to include that information — and our Data Processing Agreement describes how we process such content on your behalf.

2. Data we collect

We collect the following categories of data through the platform:

  • Identity & contact data: name, email, profile picture, date of birth, phone number, and secondary email.
  • Career & profile data: bio, headline, work experience, education, skills, projects, links (such as GitHub, LinkedIn, or personal website), and contact details you choose to include in your career profile.
  • Portfolio content: portfolio names, slugs, guided-field text, project descriptions, images, attachments, SEO fields, design settings, and published HTML/CSS assets generated when you publish.
  • Custom domain data: domain names you connect, verification tokens, and DNS verification status.
  • Billing data: subscription, plan, order, and invoice records. Payment card details are never stored by ArcPixel — they are handled entirely by our payment processor, Paddle.
  • AI interaction data: text you submit for AI-assisted writing, portfolio review, SEO suggestions, resume extraction, or image enhancement, and the outputs generated in response.
  • Account security data: hashed passwords, Google OAuth identifiers, two-factor (TOTP) secrets and backup codes, session tokens, device type, and audit logs of changes made to your account or portfolio data.
  • Optional marketing-site analytics: after consent, page views and product-funnel events with non-personal dimensions such as content topic, page family, locale, CTA placement, target product, and preset identifier. We do not send resume content, form entries, names, email addresses, or document data to analytics.
  • Sign-up source: when you create an account, how you reached us — the ArcPixel web page you first landed on, its language and target region, any campaign (UTM) parameters in the link you followed, the website that referred you (domain only), and your approximate country from your network connection. This is stored with your account and does not include the content of those pages or your browsing history.
  • Files: profile pictures, portfolio images, resume uploads, and task attachments stored with our cloud storage provider.

3. How we use it

  • To provide and operate the ArcPixel platform for your account.
  • To publish your portfolio at your chosen arcpixel.io address or custom domain.
  • To process subscriptions, invoices, and payments.
  • To send transactional emails (verification, password resets, billing notices).
  • To provide AI-assisted writing, review, and image tools you request.
  • To maintain audit logs for accountability and security investigations.
  • To provide customer support when you contact us.
  • To understand which content leads visitors to start using the product, when you consent to analytics.
  • To understand which pages, campaigns and regions bring new accounts (sign-up source), so we can improve our guides and outreach.
  • To comply with legal obligations, such as tax and accounting record-keeping.

4. Legal basis

Under GDPR, we rely on: performance of a contract (running your account and subscription), legitimate interests (security, fraud prevention, audit logging), and consent where specifically requested (for example, marketing emails). Under the DPDP Act, processing is based on your consent as a Data Principal, or on the permitted legitimate uses described in the Act.

Optional marketing-site analytics relies on your consent. The analytics library is not loaded before consent, and declining does not limit access to the website.

5. Sub-processors

We share data with the following processors, strictly to operate the service. See our Sub-processors page for the full list:

  • Hetzner and DigitalOcean — application and database hosting.
  • Cloudflare — file storage (R2) and network protection.
  • Paddle — payment processing, subscriptions, and invoicing.
  • Brevo, Resend, and ZeptoMail — transactional email delivery.
  • Google — OAuth sign-in and Gemini AI features.
  • Google Analytics — optional, consent-based marketing-site measurement.
  • OpenAI — optional AI features when configured.

We do not sell personal data, and we do not share it with third parties for their own marketing purposes.

6. International transfers

ArcPixel supports customers across multiple countries. Where personal data is transferred internationally (for example, to infrastructure or sub-processors located outside your country), we rely on appropriate safeguards such as standard contractual clauses or equivalent mechanisms recognized under GDPR and the DPDP Act.

7. Retention

We retain your account and portfolio data for as long as your account is active. If you cancel a paid subscription, your work remains saved as private drafts and you retain access until the end of the billing period you have already paid for. If you delete your account, we remove your portfolio content, files, and profile data promptly, except where we are required to retain records for legal, tax, or audit purposes (billing and audit logs in particular may be retained longer for accountability).

8. Your rights

Depending on your location, you have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate data.
  • Request erasure, subject to legal retention requirements.
  • Request a portable copy of your data.
  • Object to or restrict certain processing.
  • Withdraw consent where processing is based on consent.
  • Lodge a complaint with your local data protection authority.

Contact us at support@arcpixel.io and we will respond to your request.

9. Grievance officer (DPDP Act)

In accordance with the DPDP Act, grievances and data protection requests can be directed to:

10. Security

We use encryption in transit, access controls scoped by role, and audit logging to protect your data. Published portfolios are served over HTTPS, and sensitive credentials such as passwords and TOTP secrets are never stored in plain text.

11. Children's data

ArcPixel is a creative tool intended for adults and working professionals. It is not directed at, and we do not knowingly collect data from, individuals under the age of 16.

12. Changes to this policy

We may update this policy as our practices evolve. Material changes will be reflected by updating the "Last updated" date above, and where required by law, we will provide additional notice.

13. Contact

Questions about this policy can be sent to support@arcpixel.io.