1.1 Autopix AS, organisation number 926 408 763, Gaustadalléen 21, 0349 Oslo, Norway ("Autopix", "we", "us").
1.2 Autopix is established in Norway. Norway is a party to the Agreement on the European Economic Area ("EEA"), so Regulation (EU) 2016/679, the General Data Protection Regulation ("GDPR"), applies through the EEA Agreement.
1.3 This privacy policy explains how Autopix processes personal data in connection with the Autopix Vehicle Platform (web, iOS and Android), related transactional communications, and Autopix's own marketing to actual users. A new Retail platform and API are due at the end of 2026; retail images are processed manually by sub-processors today. Where retail processing uses the same account and infrastructure, this notice applies; a Retail-specific description will be added when that platform launches.
Art. 4(7)–(8); Art. 13; Art. 28.
2.1 Autopix acts in two different roles. Which role applies decides who you contact and which parts of this notice are about Autopix's own decisions.
2.2 If you use Autopix because a dealership or brand invited you, for client content the Client is the controller. Requests about that content (for example erasure of an order image) should go to the Client first. Autopix assists the Client under Art. 28(3)(e) — see section 10.
2.3 The rest of this notice focuses on processing where Autopix is controller, and summarises processor processing so you can see the full picture.
Art. 13(1)(c); Art. 4(1).
When you register, sign in or use the platform as an Autopix user, we process:
If you turn analytics on, we process usage data through Google Analytics 4 ("GA4") via Google Tag Manager in the web client — see section 5.
If you are an actual user and you consent, we may process your contact details to send marketing or newsletters. Electronic marketing also remains subject to applicable ePrivacy and Norwegian marketing rules on top of the GDPR basis.
In connection with your company's use of the service we may process:
Art. 6; Art. 13(1)(c).
Providing account data is required to use the service. If you do not provide it, we cannot create or maintain your account (Art. 13(2)(e)).
Withdrawing consent. Where we rely on consent, you may withdraw it at any time (Art. 7(3)) without affecting the lawfulness of processing before withdrawal. Turn analytics off in privacy settings, or contact us to stop marketing. Turning analytics off stops new collection from that point; data already sent to Google remains with Google under Google's retention unless deleted through Google's tools.
Art. 6(1)(a); Art. 7.
5.1 The web client uses a cookie-consent banner wired to privacy_settings. Flags are per-user and default off.
5.2 Single operative control at launch — analytics.
analytics_enabled gates GA4 via Tag Manager. The Tag Manager container does not load at all until you grant analytics consent — a strict block, not a load-then-gate pattern.
5.3 Analytics is the only consent category shown at launch. This notice does not describe a separate third-party or marketing cookie category, because no vendor sits behind one and no control that does nothing is shown to users.
5.4 The web client uses a backend-for-frontend pattern: OAuth tokens do not reach the browser. The browser holds an encrypted session cookie while the server proxies API calls. That session cookie is necessary for the logged-in service.
5.5 GA4 is configured with Google signals off, data-sharing off, ads links off, and EU data-collection settings. Contracting entities: Autopix AS (customer) and Google Ireland Limited (Google). Analytics data still reaches Google LLC in the United States through Google's own chain — see section 8.
Art. 28; Art. 13 / Art. 14 via the Client.
6.1 Dealerships and retail customers ("Clients") upload and manage client content on the platform. For that content the Client is controller. Typical categories:
6.2 What Autopix does with client content. On the Client's instructions Autopix runs an image pipeline: programmatic preprocessing, AI segmentation, machine-learning computer vision, programmatic alignment, and compositing onto templates.
Background compositing removes incidental persons from delivered output. Stored originals follow the Client's retention plan.
6.4 Autopix's obligations as processor are set out in the data-processing terms that bind Autopix to each Client: the Autopix Data Processing Terms — a separate document incorporated into the platform terms and conditions and accepted in the same click — or, where the Client and Autopix have signed a separate data processing agreement, that signed agreement.
6.5 Share and invitation recipients. The dealer (Client) is controller for those recipients and holds the Art. 14 notice obligation. Outbound email identifies the dealer as sender.
Art. 13(1)(e).
Autopix uses sub-processors to host and deliver the service. The same list appears in Schedule 1 to the Autopix Data Processing Terms (incorporated into the terms and conditions). In summary:
Autopix does not use a third-party application performance or error-tracking product. API observability is Treblle.
PowerOffice Go processes Autopix's accounting records. It never processes client content and is not one of the sub-processors in section 7.1.
Autopix transmits data on the Client's instruction to an account the Client holds with that provider. Those providers are not Autopix Art. 28 sub-processors. Processing after transmission is their responsibility and the Client's. All four process in the EEA.
Autopix queries public registries with an organisation number. They are public registers, not Autopix processors.
Autopix does not sell your personal data.
Art. 13(1)(f); Chapter V GDPR.
8.1 Primary hosting is AWS eu-central-1 (Frankfurt), EEA, in Autopix's own AWS account.
8.2 Where personal data leaves the EEA, or a third-country entity has remote access that counts as a transfer under EDPB Guidelines 05/2021, Autopix relies on a Chapter V mechanism:
8.3 Client images leave the EEA to OpenAI (classification/QC) and to 3sixtyfactory (editing/QC).
8.4 EXIF metadata, including GPS coordinates, is stripped from stored originals at ingest, before anything is dispatched to the editing pipeline or the QC partner.
Art. 5(1)(e); Art. 13(2)(a); Art. 17(3).
Deletion is genuine: image files (including thumbnails and variants) and database records are hard-deleted. Database backups are retained 7 days; deleted data ages out of backups within 7 days of deletion running.
Arts. 12–22; Art. 77.
You have the right to:
Email support@autopix.no (or use in-product export / account deletion where available). We respond within one month of receipt (Art. 12(3)), with a possible extension of up to two further months for complex or numerous requests, in which case we will tell you why.
For personal data in client content, contact the Client (controller). Autopix will assist the Client under the applicable data-processing terms (Art. 28(3)(e)), typically within 10 business days of the Client's request to Autopix.
Art. 32; Art. 13 does not require a full measures list — summary only.
11.1 Autopix implements appropriate technical and organisational measures. The contractual description for Clients sits in their data-processing terms with Autopix (see section 6.4). In short:
11.2 Autopix personnel may download client images to company-owned workstations when a task cannot be completed in the platform. Everyone with that access is bound by a written confidentiality undertaking; access is removed when a person leaves; and local copies live in a designated folder and are deleted when the task is done, and in any case within 14 days of download.
The platform is a business service for dealership and retail professionals. It is not directed at children. Autopix does not knowingly create accounts for children.
Art. 13–14 ongoing transparency.
13.1 We may update this privacy policy from time to time.
13.2 We notify account holders by email only. There is no contractual notice period beyond the minimum required by applicable law.
Controller (for account, analytics, marketing)
Autopix AS, Gaustadalléen 21, 0349 Oslo
Privacy contact
support@autopix.no · +47 477 63 333
