This notice covers PXLSec Accounts sign-in, account management and shared workspace access, including the login used by app.pxlsec.com, Quill, Radar and Resolve. Product reports, findings and customer engagement records may also be governed by your organization’s agreement and the relevant product terms.
Who is responsible
PXLSecurity LTD., 12 Vasil Levski Blvd., 1142 Sofia, Bulgaria (VAT BG203239331), is the controller for the Accounts identity and access service. Contact [email protected] for account or privacy requests. Your organization also determines who belongs to its workspaces and which product access to assign.
What Google shares
If you choose Google sign-in, we request only openid, email and profile. Google supplies an account identifier, email address and verification status, and basic profile information such as your name. We use these details to authenticate you, create or securely link your Accounts identity, and display account information.
We do not receive your Google password. This sign-in does not request Gmail messages, Drive files, Calendar data, contacts, Google Ads data or administrator access to your Google Workspace.
Our identity service processes Google’s authentication response and the access token needed to retrieve the requested profile information. It stores the identity link and account/profile records; it does not store Google access or refresh tokens for later access to Google APIs. PXLSec issues its own sessions and access tokens for its services.
Other account and security data
We process your Accounts identifier, sign-in methods, email verification, authenticator credentials where configured, account status, workspace memberships, invitations, assigned roles and product entitlements. We also process session information and security/access events, which may include timestamps, IP addresses, browser information and administrative changes.
Necessary session cookies and similar browser storage keep you signed in, protect requests and remember interface preferences. The public Accounts pages do not load advertising or optional analytics scripts. The wider company website has a separate website privacy policy.
Why we use this information
We use account information to provide requested sign-in and workspace services, apply access permissions, send verification and invitation messages, provide support, detect abuse, and maintain security and administrative records. Service delivery relies on performance of a contract or steps requested before one; security and administration rely on legitimate interests; legally required records rely on legal obligations. Where consent is required, you may withdraw it without affecting earlier lawful processing.
Google sign-in data is not sold, used for advertising or used to train AI models. Signing in with Google does not automatically grant organization membership, administrator rights or access to any product.
How long we keep data
We retain identity links and account records while needed to provide your account and workspace access. Security, access and administrative records are retained as needed to protect the service, investigate incidents, resolve disputes and meet applicable contractual or legal duties. Retention depends on the record and purpose; there is no single automatic deletion period for every Accounts record.
When you request deletion, we review linked workspaces and ownership, remove or de-identify information that is no longer needed, and explain any records that must be retained and why. Product or engagement records held for your organization may follow its separate agreement and retention requirements.
Disconnect Google or request deletion
To request deletion of your PXLSec account or disconnection of its Google sign-in link, email [email protected] from your account address. Tell us which action you want. We verify ownership and review any workspace ownership or access dependencies before completing the request. Do not send passwords, authenticator secrets or recovery codes.
You can also review or remove PXLSec’s connection in your Google Account connections. Removing the Google connection does not itself delete your PXLSec account or your organization’s records, and may prevent that method of sign-in. Arrange an alternative sign-in method with support if needed.
Your rights and questions
Subject to applicable law, you may request access, correction, deletion, restriction or portability of your personal data, and object to processing based on legitimate interests. You may withdraw consent where we rely on it. Contact [email protected]; we may need proportionate information to verify your identity.
You may complain to the Bulgarian Commission for Personal Data Protection (cpdp.bg) or your competent supervisory authority. We update this notice when our practices change and show its effective date above.