Privacy Policy

Specpixel Entertainment PTY LTD (ABN available on request, Melbourne, Victoria, Australia — 'Specpixel', 'we', 'us') operates the specpixel.com platform, including client services, the contractor marketplace, the sales portal, the Creator Forge, and the New Citizen game hub. This policy explains — in plain English — what personal data we collect, why we collect it, how long we keep it, who we share it with, and the rights you have over it. We comply with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and the EU/UK General Data Protection Regulation (GDPR) for all users worldwide.

Account details — your display name, email address, password hash, and date of birth. Why: to run your account and verify you are 18 or older. Legal basis: contract, and our legal obligation to age-restrict an adults-only platform.

Device and browser information for security and fraud prevention — on login we collect a browser fingerprint made from your screen resolution, GPU renderer string, installed font count, timezone, browser version, a canvas fingerprint hash and a WebGL hash. Why: to detect ban evasion, account sharing fraud and coordinated abuse. This data is stored on our servers only, is never shown to other users or included in any public or client-facing response, and is reviewed by humans — it never triggers an automatic ban. Legal basis: legitimate interest in platform security and fraud prevention.

Connection data — your IP address (stored as a one-way hash) and a VPN/proxy detection verdict at login. Why: fraud and ban-evasion review. Legal basis: legitimate interest.

Role and program records — academy progress, contracts, earnings, commissions, sales and support messages. Why: to operate the programs you join and pay you. Legal basis: contract.

Game records — your in-game characters, bank balance, property, phone messages and activity on New Citizen servers. Why: to run the game you are playing. Legal basis: contract.

Identity verification documents (contractors only) — legal name, date of birth and a government ID image. Why: to verify identity for paid contractor work. Legal basis: legal obligation and contract. ID images are encrypted, used only for verification, and permanently deleted after the retention window stated at upload.

Payment card details are never seen or stored by us — all card processing is handled by Stripe. We store only transaction references, amounts and statuses.

Account and game data: kept while your account is active. If you do not log in for 24 months we email you a warning; if you still do not log in within 30 days of that warning, your account and all associated personal data are automatically and permanently deleted.

Browser fingerprints and login security signals: kept for 12 months, then deleted.

Behavioural security events (first-session activity used for ban-evasion review): kept for 90 days, then deleted.

Tax, invoice and payment records: kept for the period required by Australian tax law (generally 5 years) — these cannot be deleted early.

Account deletion and compliance logs: we record only an anonymised account identifier and a timestamp, so we can prove a deletion happened without keeping any of your personal data.

We share personal data only with the processors needed to run the platform: Stripe (payments), Resend (transactional email), proxycheck.io (IP reputation check at login — IP address only), our LLM content-moderation provider (images you upload for avatars/banners, for safety scanning), and our cloud hosting providers. Some processors store data outside Australia; we take reasonable steps to ensure they handle it consistently with the APPs (APP 8) and GDPR transfer rules.

We never sell personal information to anyone, and we never share your data with advertisers.

Download your data: open your Profile → Privacy & Data → Download My Data to receive a complete export of everything we hold about you as a JSON file, normally within minutes and always within 30 days.

Delete your account: Profile → Privacy & Data → Delete My Account permanently and irreversibly wipes your profile, game records, messages, fingerprints and security data — everything except records the law requires us to keep (tax/payment records) and an anonymised deletion log. We complete deletions immediately, and always within 30 days.

Withdraw consent: you can change cookie choices at any time (the consent banner reappears if you clear cookies or after 12 months), unsubscribe from any marketing email in one click, and delete your account to withdraw all processing consent.

You may also request access or correction (APP 12/13, GDPR Art. 15/16) by emailing business@specpixel.com or opening a support ticket.

We use strictly-necessary cookies/storage for login sessions and security. Optional analytics are OFF until you accept them in the cookie consent banner. You can accept all, reject non-essential, or customise — and your choice is stored with a timestamp and re-asked every 12 months or when you clear cookies.

If a data breach is likely to result in serious harm, we will notify affected users and the Office of the Australian Information Commissioner as soon as practicable and within 72 hours of confirming the breach, telling you what happened, what data was involved, what we have done to contain it, and what you should do.

Data requests, questions and complaints: business@specpixel.com — we respond within 30 days. If you are not satisfied, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au, or to your local EU/UK supervisory authority.