Privacy Policy

Atozium is operated by Pixfar (“we”, “us”). This policy covers the website, dashboard, API, and the agents for Android, iOS, Windows, macOS, and Linux.

Pixfar is the controller of account and billing data. When an organization enrolls devices and views device information, that organization is the controller of the device holders’ personal data and Pixfar processes it on the organization’s instructions to provide the service.

Contact [email protected] for privacy requests.

We collect the name, email address, and authentication data needed to run the account. Passwords are stored as hashes by the authentication system. If you turn on multi-factor authentication, we store the factors required to check it.

We store organization memberships, roles, and the actions those members take in the audit log.

We store session information: browser and platform, approximate IP address, country when the host provides it, and sign-in and last-seen times. You can view and revoke sessions under Account → Security.

If you sign in with Google, Google sends us the identity information you approve on Google’s screen, such as your email and name. Google’s own policy covers Google’s processing.

Device data is collected only after the device holder installs the agent, accepts the in-app disclosure, and the device is enrolled with a code or with the account flow.

We store a random installation ID and a public key created on the device. The private key stays on the device. We do not collect IMEI, hardware serial numbers, phone numbers, SIM identifiers, MAC addresses as a device identifier, or advertising IDs.

We store manufacturer, model, operating system version, and app version. On plans that include device status, we store battery level and charging state when the device has a battery, network type such as Wi-Fi or cellular, and storage and memory totals. A desktop computer with no system battery is shown as having no battery.

We store a push token (Firebase Cloud Messaging on Android, and the equivalent push token on iOS) only to wake the agent. The push payload is an identifier, not the content of a command and not the contents of the screen.

We store last-seen time so the dashboard can show whether the device is online.

Screen images are sent only during a screen session that an authorized member starts and that the device is allowed to accept.

On Android, a session asks the device holder unless that person has turned on managed access. A notification stays on the device the whole time the screen is viewed. On iPhone and iPad, the device holder must start the broadcast from the system sheet, and iOS shows a red recording indicator. Sharing cannot start silently on iOS. On Windows, macOS, and Linux, a notification stays visible on the computer while sharing is on.

Atozium is built not to record or store the frames. We keep short-lived signaling metadata for the session, currently about one day, so the session can connect and so the audit log can show that a session happened. We do not keep a video.

Remote control, when the plan and the device allow it, works only during a screen session. On Android it requires the device holder to turn on the Atozium accessibility service. On a computer it uses the mouse on the selected monitor. It is not available on iPhone or iPad. We do not log keystrokes, and we do not read passwords or PINs.

Safety Audio is a live two-way session. It starts only after the device holder has allowed it, either by accepting the session or by turning on a setting that permits it. The microphone is on only while the session is active, a visible indicator stays on, and the audio is encrypted in transit. Atozium does not record or store that audio. Safety Audio is not part of the desktop agent.

Local Listen, if the device holder taps Start Listening, routes sound to headphones on that same device. That audio is not sent to Atozium or to the organization and is not recorded by the app.

Notification mirroring is off unless the device holder turns it on and grants notification access. It is not available on iOS. Mirrored items can include the app name, title, and text. They are kept for 30 days and then deleted.

Files are limited to the Atozium folder and folders the device holder chooses, plus files an authorized member uploads for that device. Files are stored for the organization until you delete them, until an expiry you set, or until the organization is deleted. An upload that never finishes is removed after about 24 hours.

If app listing is available and allowed, we store the app names needed to show the list. We do not read the private data inside those apps.

Phone location is collected only when the device holder grants location permission and an authorized member requests a fix. We store latitude, longitude, accuracy, and time. Desktop location, when requested, is a city-level coordinate from the computer’s public IP. The agent asks a lookup service for coordinates and stores those coordinates. It does not store the IP address in the location record. The lookup service receives the IP address in order to answer. Location history is kept with the device until the device or the organization data is deleted.

We do not collect contacts, SMS or other carrier messages, call logs, or call audio. We do not use the camera. We do not offer keylogging, password or PIN capture, or lock-screen bypass. We do not sell personal data and we do not use screen content or files for advertising.

The Android disclosure shown before enrollment matches these limits. Optional features stay off until the device holder turns them on.

We use personal data to provide the service, authenticate users and devices, enforce plan limits, prevent abuse and covert monitoring, keep audit logs, take payment, and answer support requests.

We use approximate location of a website session, such as country from the hosting network, to show the currency offered in that region, including taka pricing for Bangladesh.

We do not use device content to train public models.

We share data with processors who help us run Atozium, only for that purpose:

• Supabase, for the database, authentication, file storage, and realtime delivery.
• Google Firebase Cloud Messaging, to wake Android agents. Push payloads are identifiers, not screen or file content.
• Stripe, for card payments, and EPS, for Bangladesh checkout, when you pay with that method. They receive billing details.
• The company that hosts the website. That may be Vercel or a server we operate.
• Sentry, when error monitoring is enabled, for error reports from the website. Those reports can include a URL and technical details, and they are not a copy of a device screen.
• A TURN relay, when it is configured, to connect a live screen or audio session across networks. The relay carries encrypted media. It is not a recording.
• ipwho.is or ipapi.co, only when a desktop location is requested. They receive the computer’s public IP and return coordinates. We do not control their logs.

Organization members see device data according to their role. A device holder’s organization, not other customers, can see that device.

We share information if the law requires it, to respond to a valid legal process, or to protect a person from covert surveillance. We do not sell personal data.

Account, device, and file data is stored with our database and storage provider, which may be outside the country where you or the device holder live. Card and local-payment data is processed in the provider’s regions. When we transfer personal data from a country that requires a transfer tool, we use the provider’s contractual safeguards, such as standard contractual clauses, where that provider offers them.

• Audit logs: for the number of days in your plan’s audit retention, shown on the billing page, and then deleted. Plans differ. An unlimited plan keeps them until the organization is deleted.
• Mirrored notifications: 30 days.
• Screen-session signaling metadata: about 1 day. Screen video is not stored. Safety Audio is not stored.
• Organization events and webhook delivery logs: 30 days.
• Cloud files: until you delete them, until an expiry you set, or until the organization is deleted. Incomplete uploads: about 24 hours.
• Expired enrollment codes: 30 days.
• Location fixes: until the device or the organization is deleted.
• Account deletion: you can request it from your account. It waits a grace period, currently 14 days, and you can cancel during that time. Organizations you own alone are deleted with the account. If other members remain, you must transfer ownership first. After the grace period we delete the profile, memberships, sessions, and personal activity tied to you.
• Organization deletion: the owner confirms the organization’s URL slug. Devices are revoked immediately. After the same style of grace period, currently 14 days, we delete organization data, including devices, files, commands, groups, notifications, location history, audit logs, API keys, and webhooks.
• Billing records: after deletion we keep the records tax and accounting law requires. Those retained records are detached from the deleted account and contain the organization name, amounts, and dates, not device content.

A failed payment or a downgrade does not delete your data. Data is deleted when you delete it, when a retention period above ends, or when the organization deletion finishes.

We use TLS in transit, encryption at rest from our infrastructure providers, tenant isolation so one organization cannot read another’s rows, hashed API keys, and short-lived device credentials checked against the key created on the device. Administrative actions are written to an audit log. Organizations can require multi-factor authentication.

No method of transmission or storage is perfectly secure. You must protect your password, enrollment codes, and the devices you enroll.

Depending on where you live, you may have the right to access, correct, export, delete, or restrict personal data, and to object to certain processing.

Account holders can export a JSON file of their profile, memberships, sessions, activity, and uploaded file list from the account page, and can request account deletion there.

Device holders should contact the organization that enrolled the device first, because that organization decides the management. They may also write to [email protected] or [email protected]. If we are the processor, we will refer the request to the organization or help the organization answer it.

You may lodge a complaint with the data-protection authority where you live. EU and UK users may contact their supervisory authority. This does not remove any right you have under the law of Bangladesh or any other country.

We do not knowingly let a child open an organization account. If you believe a child has created one, write to [email protected].

We will update the date at the top of this page when the policy changes. If a change is material, we will also notify account owners by email when we have an address for them.

Pixfar, operator of Atozium. Privacy: [email protected]. Abuse: [email protected]. Support: [email protected].