How we keep your business’s data safe.
Your bookings, customers, invoices and email live on our platform. Here is what protects them, in plain words, and what we don’t claim.
What protects your data
Encrypted on the way
Every page, the booking pages and the dashboard work over HTTPS only, and browsers are told never to use an unencrypted connection to pixelvile.com.
One business, one set of data
Every request to the platform is tied to one business. Owners and staff see only their own business. Our automatic tests try to read another business’s data, and every change must refuse it before it goes live.
Passwords never stored readable
Passwords are kept only as salted, scrambled hashes. Sign-in uses a long random key in a secure cookie, we keep only a hash of it, and it expires after 30 days.
Two-step sign-in
Owners and staff can turn on codes from an authenticator app. Each code works once. Reset codes expire after 20 minutes and work once, and a reset signs out every session.
Limits on guessing and spam
Repeated wrong passwords are slowed down and then blocked. Booking and enquiry forms have limits per address and per business, and Cloudflare Turnstile checks that a person is booking.
Pages that run only our code
Our pages refuse scripts from anywhere but our own site and a few named services. Emails you receive are cleaned and shown with scripts switched off, and programs sent as attachments are refused.
Where your data lives
Cloudflare
The website, the database and email routing run on Cloudflare. Data may be processed on Cloudflare’s servers outside India, as our privacy policy says.
Messages and email
WhatsApp messages go through Meta. Emails we send go through Zoho ZeptoMail. A copy of email to your domain can go to a mailbox you choose, such as Gmail.
Backups
The database is backed up every week. Each backup is encrypted and kept for up to 90 days, and only Pixelvile can unlock it, with a key kept offline. We practise restoring a backup every quarter.
Your export
Owners can download their data from the dashboard at any time: customers, bookings, invoices and more. It’s yours, and it goes with you if you leave.
How we check our own work
- Every change runs through automatic tests before it goes live, including attempts to read other businesses’ data, typed attack strings in forms and sign-in, and double-booking races.
- The code is scanned for leaked keys, and the packages we ship are checked for known security problems.
- Our own team reviews the platform for security problems and fixes what it finds. The latest review was in November 2026.
- The live platform is checked every hour, and errors reach us by email.
No system is perfect. If something goes wrong that affects you, we’ll tell you and the authorities as the law requires.
Your data is never sold
We don’t sell personal data, and we don’t use advertising trackers. Public pages set no cookies. The dashboard uses one cookie, only to keep you signed in.
Data processing
Your business decides how its customers’ and staff’s data is used, and we process it only on your behalf. Our data processing agreement sets out how we do that under India’s DPDP Act and GDPR-style rules, and the sub-processor list names every company that handles client data for us, what it does and where.
Found a security problem?
Email support@pixelvile.com with “Security” in the subject, and tell us what you found and how to see it. Please don’t look at or change other people’s data while checking, and give us a fair chance to fix it before telling anyone else. We reply within 2 working days.
You can see whether the platform is working right now on our status page.
Questions owners ask
Do you sell or share our customers’ data?
No. Your customers’ data is never sold, rented or used for advertising. It is shared only with the services needed to run what you use: Cloudflare (hosting), Meta (WhatsApp), Zoho ZeptoMail (emails we send) and the mailbox you choose for copies.
Can Pixelvile staff see our data?
Our team can, when it’s needed to set up, fix or support your account. We don’t look at it for any other reason, and actions such as data exports and setting changes are recorded in an audit log.
Do you have a security certification?
No. We don’t hold a certification such as ISO 27001. Our checks and reviews are done by our own team, and this page says exactly what they cover.
What happens to our data if we leave?
You get an export of everything (customers, bookings, invoices and more). The domain and your content go with you.
Questions about your data?
Ask us on WhatsApp or by email before you sign anything. We’ll answer in writing.