In Short: This Policy explains how we handle your Personal Data. It helps you understand what we do with your information and what your privacy rights are.
This Privacy Policy (“Policy”) explains how PixelGalaxy Inc., trading as Hypnozio brand and other hypnotherapy brands (company, we, us, or our) handles your Personal Data (“Personal Data” or “Data”) when you:
This Policy outlines what Data we collect, the purposes for which it is collected, how we use and share it, how long we retain it, your rights, and how we protect your Data. We are committed to processing your Data lawfully, fairly, and transparently in accordance with:
This Policy applies globally and is founded on the principles of the GDPR. It reflects high-standard data protection values such as lawfulness, fairness, and transparency. Specific national or regional requirements are addressed in the Regional Addenda (for the United Kingdom, Australia, the United States, Canada, and other jurisdictions) located at the end of this Policy.
If you do not agree with our practices, please refrain from using the Website, purchasing our Services or Goods or submitting your Data in any other way. This Policy is effective as of 10th of April 2026. We may update this Policy occasionally, and all updates take effect upon publication, so we encourage you to review it regularly to stay informed.
We are: PixelGalaxy Inc., your Personal Data Controller
Our company number is: 001350123
Our registered address: 1574 Woodberry Court, Brentwood, TN 37027, Williamson County
Our support e-mail address: support@hypnozio.com
We have appointed a Data Protection Officer (DPO) to oversee our data protection obligations. You can contact the DPO directly at dpo@hypnozio.com
In Short: We mainly collect only the Data needed to provide our Goods or Services and operate our Website. This section explains why we collect it and how we use it.
We only collect the Data we truly need – and only use it for clear, lawful reasons (e.g., to process your purchase, provide services, respond to your inquiries, ensure Website functionality, etc.). You can find a full list of purposes, the Data we collect, how we use it, and more detailed information in the tables below, see Section 13 of this Policy.
Here are also a few important things for you to know:
In Short: We get your Data directly from you, through your use of our Website, or from trusted third parties and public sources. This helps us operate our Services and stay in touch with you.
We might collect Data from the following sources:
In Short: Yes, but only when necessary and with strong safeguards—always ensuring your privacy is protected.
Yes - but only when necessary, and with your privacy in mind.
We may share limited Data with trusted third parties to provide our services, meet legal obligations, or support daily business operations. Whenever we do, we ensure that your Data is protected and handled responsibly. For this reason, parties who process Data on our behalf act as Data Processors and are contractually bound by Data Processing Agreements (DPAs). These agreements ensure that they follow our instructions, apply appropriate safeguards, and do not use your Data for their own purposes. We may share your Data with:
In Short: We keep your Data only as long as necessary for legal, contractual, or service-related purposes - then we delete or anonymize it securely.
We keep your Data only for as long as necessary to:
Detailed retention periods for each Data processing purpose are set out in Section 12 of this Policy.
Once the applicable retention period has expired, we will either securely delete your Data or irreversibly anonymize it within a reasonable timeframe, in line with best industry practices and legal requirements.
In Short: We use strong technical and organizational measures to keep your Data safe and work continuously to prevent unauthorized access and protect your privacy.
We are committed to protecting your Data and taking the security of your information seriously. We apply a combination of technical and organisational measures to prevent unauthorised access, accidental loss, misuse, alteration, or disclosure of Personal Data. Our security safeguard practices are based on core data protection principles and include, but are not limited to:
While we apply strong security measures, no system is entirely risk-free - especially during internet transmissions. To help protect your Data, please stay vigilant online and always use a strong, unique password, keep it confidential, secure your devices, and be cautious when sharing information, especially via suspicious links. Security incidents resulting from user actions (e.g. credential sharing or phishing) may fall outside our control.
In Short: Yes, sometimes - but only when necessary and always with strong legal safeguards to keep your Data protected.
Yes - but only when necessary, and always with strong protection in place.
We mainly store and process your Data within the European Economic Area (EEA), and there may be times when some of your Data is transferred to trusted partners or service providers located in countries outside the EEA - for example, for cloud hosting, technical support, or specialist services. Where applicable, such recipients are listed in Section 3 of this Policy.
Whenever we send your Data outside the EEA, we make sure that it remains protected, and your privacy rights are respected. We never transfer your Data lightly - we always assess the risks and take appropriate steps to keep your Data safe, wherever it goes. Where Data is transferred outside the EEA:
If you would like more details about these transfers, you can contact us using the details provided in Section 11 of this Policy.
In Short: Yes, but we don’t make important decisions about you based solely on AI. We may use smart tools to support our services, but all important decisions involve real people, not just programs.
Yes. We may use certain Artificial Intelligence (AI) - based tools and fully or semi-automated systems - for example, in customer support written communication, Chatbots - to enhance the speed and accuracy of our services.
However, we do not engage in automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you, within the meaning of Art. 22(1) the GDPR. Specifically:
In Short: You have rights over your Personal Data, including access, correction, deletion, objection, and more. This section outlines how you can exercise them and what to expect.
If we process your Data as set out in this Policy, or you believe we may be doing so, you have the following rights as a Data Subject. These rights apply regardless of whether we process your Data as a client, supplier, contractor, or professional contact:
Please note: Your rights are not absolute. In some cases, the exercise of your rights may be restricted under applicable data protection laws - for example, where fulfilling your request would adversely affect the rights and freedoms of others, or where we are legally required to retain certain Personal Data (e.g. for compliance, legal claims, or regulatory purposes).
If you have any general questions about this Policy, how we process Data, a complaint or if you wish to exercise any of your Data Subject rights, you can contact us by email at dpo@hypnozio.com.
To help us process your request efficiently, please:
You may also authorise someone to act on your behalf. If so, please ensure your authorized person provides us with written and signed authorisation confirming they are allowed to act for you. We may deny a request if sufficient proof of authorization is not provided.
We aim to respond without undue delay and within one month of receiving your request. If your request is particularly complex or involves multiple issues, we may extend this period by an additional month – in which case, we will inform you in advance and explain the reason for the delay.
This Addendum supplements our Global Privacy Policy and applies where your Personal Data is subject to the laws of the country or region in which you reside, or where our processing activities are specifically targeted. These regional terms complement the Global Privacy Policy and override it only where required by applicable local law.
If you are a UK resident or our processing relates to UK individuals, the processing of your Personal Data is subject to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Your Rights under UK Data Protection Law:
International Data transfers from the UK:
If we transfer your Personal Data outside the UK (e.g., to the EEA, the United States, or other countries), we ensure that adequate safeguards are in place, such as:
Supervisory Authority:
If you have concerns about how we handle your Personal Data, you may lodge a complaint with the UK’s supervisory authority: Information Commissioner’s Office (ICO), website: https://ico.org.uk.
If you are an Australia resident or our processing relates to Australian individuals, the processing of your Personal Data is subject to the the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
Your Rights under Australian Privacy Law:
Direct Marketing and Unsubscribing:
We apply the same direct-marketing principles described in Section 3 of this Policy, in full compliance with APP 7 and the Spam Act 2003. We only send direct-marketing communications in accordance with these laws. Every electronic message identifies us and includes a functional unsubscribe option. If you unsubscribe, we will cease marketing to you.
International Data transfers from Australia
We may disclose your personal information to recipients located outside Australia (e.g., in the EU, US, or other countries). Before doing so, we take reasonable steps to ensure that overseas recipients do not breach the APPs. These steps may include:
Supervisory Authority:
If a Data breach is likely to result in serious harm, we will promptly notify the Office of the Australian Information Commissioner (OAIC) and affected individuals. Also If you are not satisfied with our response to a privacy concern, you may contact OAIC, website: https://www.oaic.gov.au.
If you are a Canadian resident or our processing relates to Canadian individuals, your Personal Data is subject to the Personal Information Protection and Electronic Documents Act (PIPEDA) and other applicable privacy laws.
Your Rights under Canadian Privacy Laws:
Commercial Electronic Messages (CASL):
We apply the same direct-marketing principles described in Section 3 of this Policy, in full compliance with Canada’s Anti-Spam Legislation (CASL). We obtain express consent (or rely on a permitted implied consent), identify our business in each message, include a working unsubscribe mechanism, and maintain records of consent. You can withdraw consent or unsubscribe at any time.
International Data transfers from Canada:
Your Personal Data may be transferred outside Canada (e.g., to the EU, U.S., or other countries) for processing. We take contractual, organisational, and technical measures to ensure that any such transfers provide an adequate level of protection consistent with Canadian law or may be subject to foreign access laws.
Supervisory Authority:
If you are not satisfied with our response to a privacy concern, you may contact: Office of the Privacy Commissioner of Canada (OPC), website: https://www.priv.gc.ca. For Québec residents, you may also contact the Commission d’accès à l’information (CAI) at https://www.cai.gouv.qc.ca.
If you are a U.S. resident or our processing relates to U.S. individuals, your Personal Data may be subject to state privacy laws, including the California Consumer Privacy Act (CCPA/CPRA), Virginia Consumer Data Protection Act (VCDPA), Colorado Privacy Act (CPA), Connecticut Data Privacy Act (CTDPA), and Utah Consumer Privacy Act (UCPA).
Your Rights under U.S. State Privacy Laws (which may vary by state):
International Data transfers from USA:
If we transfer your Personal Data outside the United States (for example, to the EU, UK, or other jurisdictions), we apply contractual, organizational, and technical safeguards designed to ensure that the transferred data receives adequate protection, consistent with applicable U.S. state laws.
Do Not Sell or Share My Personal Information:
If you wish to opt out of the sale or sharing of your Personal Data, please click the “Do Not Sell or Share My Personal Information” link available on our website footer.
Universal Opt-Out Mechanisms:
Where required (e.g., under CPRA, CPA, CTDPA), we honor Global Privacy Control (GPC) signals and other recognized universal opt-out mechanisms.
Supervisory Authority:
If you have concerns about how we handle your Personal Data, you may contact your state Attorney General. For California residents, more information is available at: https://oag.ca.gov/privacy/ccpa.
When you purchase our Services via our Website or App, we process your Data to manage your order, handle payments and provide related services (e.g., order confirmation, updates, or refunds).
Identification and contact details: full name, address, email address, phone number.
Payment details: price, currency, credit card brand, type, bank identification number (BIN) number, and issuing country.
Technical information: IP address, language, device type.
GDPR Art. 6(1)(b) – Contract:
Order and payment records are retained for 10 years in line with legal, tax and accounting obligations.
In order to access and use the Hypnozio Services, you are required to create a user Account. During this process, we process certain Personal Data to properly identify you as a client, link your Account with other data processed by us, and ensure the secure and efficient operation of the Services.
Once the Account creation process is completed, you will immediately gain access to your Account functionalities, such as managing your profile and preferences, ordering or cancelling Services, viewing your usage information, and accessing other related Service features.
Identification and Account data: email address, password, registration data, and other information necessary for Account creation and operation;
Technical data: device and system information, IP address, log data and other technical parameters required to provide the Services.
GDPR Art. 6(1)(b) – Contract:
While you use the Services.
If there’s no activity (no payments or usage) for 24 consecutive months, we will consider your Account inactive and begin the contract termination process.
Various Service logs are deleted periodically within 1-12months.
Our Hypnozio service can also be accessed and operated via the mobile application “Hypnozio: Mindset Change” (the “App”). The App can be accessed using your existing Account login credentials or you have to create a new account following required steps.
The App provides you with additional functionality such as personalized insights, easier access to Services, pop-up reminders, and other features designed to help you stay focused on your goals and improve your user experience.
Currently, the App does not request or require any permissions on your device (such as Bluetooth connectivity, microphone access, or speech recognition), as its functionalities do not depend on or make use of such features.
Log in data: email address, password, password reset, log in time, other logs.
Technical data: device type, operating system version, app performance logs, and other technical parameters required to operate and maintain the App.
GDPR Art. 6(1)(b) – Contract:
GDPR Article 6(1)(f) – Legitimate interests:
While you use the Services.
If there’s no activity (no payments or usage) for 24 consecutive months, we will consider your Account inactive and begin the contract termination process.
Various Service logs are deleted periodically within 1-12months.
We process your Personal Data when it is necessary to provide you with access to and use of the Hypnozio Service, including the core functionalities of the platform and related features.
This includes creating and managing your user Accounts and subscriptions, sessions, ensuring proper functionality of the Service environment, processing your Service requests, providing support (including via AI-powered chatbot tools), maintaining communication related to Service delivery, and providing any requested updates.
The processing of your Personal Data is strictly limited to what is necessary to deliver and maintain the Hypnozio Service in accordance with our contractual obligations.
Note! When you interact with our AI-powered chatbot, we process the information you provide to respond to your requests and improve the Services. The chatbot is not intended to provide professional advice. While we implement measures to limit the processing of sensitive personal data (such as health data), you remain responsible for the information you choose to submit.
Identification data: name, surname, email address, and user ID (where applicable);
Service usage data: logs of access and interactions with the Hypnozio platform, service requests, and feature usage history;
AI Chatbot data - messages, queries, responds;
Technical data: IP address, device type, operating system version, and other technical information necessary to ensure service functionality and security.
GDPR Art. 6(1)(b) – Contract:
GDPR Art. 6(1)(f) – Legitimate interest:
While you use the Services.
If there’s no activity (no payments or usage) for 24 consecutive months, we will consider your Account inactive and begin the contract termination process.
Various Service logs are deleted periodically within 1-12months.
AI Chatbot chats – retained for up to 6 months from the relevant session.
The Hypnozio Service gives you the option to complete a short personalization quiz or questionnaire to help tailor our programs, recommendations, or offers to your goals and preferences (for example, lifestyle habits, wellbeing, or product choices).
Completing the quiz is entirely optional. You can choose to fill it out when selecting a specific service that requires personalization, or any time later if you wish to receive more tailored guidance. You can continue to use the Hypnozio Service even if you decide not to complete it.
Some quizzes are anonymous and do not collect any information that can identify you. These responses are used only in summary form to help improve our programs and user experience.
Other quizzes may ask for basic contact details (such as your name or email address) so we can provide personalized recommendations or adjust your program. Any wellbeing- or lifestyle-related details you choose to share are processed only with your knowledge and consent and solely to personalize your experience.
This information is never used for medical assessment, diagnosis, shared with third parties, or automated decision-making that could affect you.
Identification and contact data: name, email address (only if provided);
Quiz and questionnaire data: responses related to wellbeing, lifestyle, or preferences;
Technical data: device or session information (only where necessary to deliver the quiz).
GDPR Art. 6(1)(a) – Consent:
Quiz responses containing Personal Data are stored for up to 6 months from submission, unless you withdraw your consent earlier. After that, the data is anonymized or securely deleted.
None.
We process your Personal Data when handling payments related to your orders, subscriptions, discounts, returns, or refunds.
This processing also includes the performance of tax obligations, such as issuing invoices, maintaining accounting records, and fulfilling other legal statutory requirements.
Payment Information: payment method (card type, last few card digits), payment token, transaction amount, transaction date and time, refund reasons.
Billing & Legal Data: name, email, phone, billing address, IBAN/account number, payment records, invoices, VAT and other required accounting or legal documentation.
Customs or Import/Export Information (where applicable): personal identification codes or customs data required by law in certain countries (e.g., for shipments subject to customs clearance).
GDPR Art. 6(1)(b) – Contract:
GDPR Art. 6(1)(c) – Legal obligation:
We retain accounting-related data for 10 years, as required by financial and tax regulations.
If you contact us in writing (via Live Chat, customer support emails, social media or otherwise), we will keep a record of the facts of your contact and the information you have provided to us, including your Personal Data, to properly process your request and respond to your question, request or complaint.
We use artificial intelligence (AI)-based tools (fully or semi-automated) to assist our customer support team. These tools are used for suggesting draft responses, transcribing and summarising conversations, and providing automated replies to frequently asked or trained questions.
Note! All AI-generated outputs are reviewed and validated by human staff where decisions could affect your rights. We do not rely solely on automated decision-making that produces legal or similarly significant effects. We do not use your data for training AI models unless fully anonymized.
Contact by email / or via Livechat, Customer Support: name, surname, email address, residential address. Purchase details and other information required to verify your identity (if needed). Other information related to the written request, attached documents or other visual content, all correspondence history.
GDPR Art. 6(1)(b) – Contract:
GDPR Art. 6(1)(f) – Legitimate interest:
Written communication - 3 years after your inquiry was closed.
We may retain some information longer if we are required to do so to comply with applicable laws or based on justified interests.
We have the right, in performing our rights and obligations under the Terms (“ToS”), to contact you at any time (e.g., provide transactional communication). We may send you important notifications and information by e-mail or SMS.
Note! This important communication is not considered marketing, and you cannot opt out of it.
Identification and contact details: name, surname, mobile phone number, e-mail address, residential address.
Technical data: copies of electronic messages/SMS, delivery status and date, message opening (reading) status and date, links opened from the message content.
GDPR Art. 6(1)(b) – Contract:
Electronic communications history logs are kept for 1 month, unless longer retention is required for legal purposes.
We process your Personal Data to inform you about Services and Goods, promotions, new features, or to request your feedback. This includes sending general or personalized marketing content e.g., newsletters, promotional messages, surveys via email or SMS.
When you agree to receive marketing communications from the Company, this may include marketing information and offers about this specific brand and other brands operated within the Company. Marketing content may be customised based on the Data we already hold about you (e.g., previous purchases, browsing history, selected preferences), in order to provide you with relevant offers or content.
If you are an existing customer, we may contact you with marketing content about the same or similar products or services, even if you haven’t given explicit consent, provided that you were given the opportunity to object when your contact details were collected, that an opt-out option is included in each message, and that such contact is permitted by applicable law.
Remember! You have the right to object to or withdraw your consent for direct marketing at any time, free of charge, by:
Contact details: full name, e-mail address, telephone number, country;
Logs: consent collection logs (date, method, preferences, unsubscribe information, opt-out requests).
Marketing interaction data: information about how you engage with our marketing materials - such as message delivery and opening status, link clicks, campaign participation, communication preferences, unsubscribe or opt-out actions, and interaction timestamps.
Purchase and engagement history (if applicable): information derived from your previous transactions or marketing interactions, such as products purchased, referral sources, links used, or responses to promotional campaigns.
GDPR Art. 6(1)(a) – Consent:
GDPR Art. 6(1)(f) – Legitimate interest:
3 years from consent given date, unless you opt-out earlier.
We manage our business profiles and accounts on various social networks. If you are interested in our Services and follow our profiles on social networks, participate in our games, promotions, share your photos with us or tag us in your photos, public posts, etc., we collect and use your Data, which we receive directly from you, when you are active in our accounts.
Please note that our accounts are integrated into social networking platforms (e.g. Facebook, Instagram, Linkedin, etc.) and therefore all social platform providers as independent data controllers have full access to collect your Personal Data.
You can find detailed information on the data processing, purposes and scope of data use by each social networking platform in the privacy policy of the respective social network.
Also if you want to exercise your rights in relation to data processed by social networks, it is more efficient to contact the controller of the social network directly.
Identifiers: name, surname, and profile photo;
Public interactions: likes, follows, comments, shares;
Participation: messages you send (content, time, attachments, history), active participation in games/events, any photos you send us or tag us in.
GDPR Art. 6(1)(a) – Consent:
The provider of the social network concerned shall set the time limits for the retention of data. We recommend that you check the privacy policy of the social network concerned.
We normally retain and don’t delete them unless you withdraw consent, request deletion, or the platform enforces earlier deletion.
We may process your Personal Data in case we become a party or concerned party in legal proceedings to which you are subject to, or we are statutorily required to collect and/or provide information about you in order to comply with the applicable law.
Also, in all cases where we suspect fraud, theft, unlawful reselling, misuse of marketing activities with our brand names, or other unlawful activities involving our Website, Company, brands and or services, we report such cases to the appropriate pre-trial investigation authorities (such as the police or prosecutor’s office).
All information that we uphold about you and that is a part of the legal process e.g. accounting and legal case files, legal documents, other information you provide us with, other information that we are statutorily required to collect and/or provide. Also, pleadings, claims, court decisions.
If the case arises - information about criminal offenses and convictions.
GDPR Art. 6(1)(f) – Legitimate interest:
As long as the legal proceedings are going and 10 years from the date of entry into force of the court or authority's decision, or the date on which the legally binding decision is fully implemented
When you visit and browse our Website, we process certain Personal Data for statistical, analytical, marketing, and performance monitoring purposes. This helps us improve the functionality, stability, security, and overall user experience of our Website.
Depending on your cookie preferences and consent choices, we may collect various information through cookies and similar tracking technologies, using trusted tools such as Google Analytics 4 or other authorized analytics and marketing platforms. Detailed information is provided in our Cookie Policy.
Identifiers: IP address or other device identifiers;
Technical information: device type, browser type, language settings, hardware/software settings and configurations, referring URLs (websites visited before/after);
Usage information: pages visited on our Website, interactions, clicks, or session behavior, visit timestamps, session duration, selected interface or account preferences (if applicable).
GDPR Art. 6(1)(a) – Consent:
For more information on the retention periods of cookies, please refer to our Cookie Policy.
We process your Personal Data when you participate in our contests, competitions, games, or events. This is done to manage your participation, communicate with you, and (where applicable) publish or promote the outcomes of the activity.
Identifiers: full name, email address, phone number;
Participation: social media engagement (comments, shares, “likes”, “follows”, reactions) contest entries, responses, evaluation/ratings, event attendance;
Media content: submitted or captured photos/videos, image/voice in recording.
GDPR Art. 6(1)(a) – Consent:
Contest participant data – retained for 1 year after the announcement of winners or as described in specific contest terms, unless a shorter or longer period is specified.
We process your Personal Data when you submit, create, or allow us to use content that features you for promotional purposes. This includes:
Where applicable, a separate image-use or content-use agreement will be signed before publication or distribution, or consent will be collected via a dedicated form.
Identifiers: full name, username or profile name;
Media content: photo, video, or audio recording;.
Participation: testimonials, reviews, or other content you provide or permit us to use, social media identifiers (tags, mentions, handles), image-use or promotional content agreement (if applicable), consent logs.
GDPR Art. 6(1)(a) – Consent:
GDPR Art. 6(1)(b) – Contract:
UGC and campaign content: retained for up to 2 years from the date of collection or consent, unless a shorter or longer period is specified or consent is withdrawn.
Advertising campaign content: archived for up to 10 years for legal, contractual, or compliance purposes.
When you participate in our Affiliate Program (e.g., promoting our Goods or Services via links, campaigns, or other agreed methods), we process your Personal Data to manage your participation, track referrals, calculate commissions, and make payments. We may also use your Data to communicate with you about affiliate program updates, compliance checks, complaints or performance reporting.
Identifiers: name, surname, and contact details (e-mail address, phone number), Affiliate account/login details;
Payment and billing details: bank account, or other payment identifiers, invoices;
Performance and tracking data: referral codes, campaign statistics, generated leads/sales, IP address, cookies where applicable;
Cookies: tracking data where applicable (subject to Cookie Policy and local regulations).
GDPR Art. 6(1)(b) – Contract:
GDPR Art. 6(1)(f) – Legitimate interest:
Affiliate program data – retained for the duration of your participation in the program and up to 5 years after termination (for accounting, legal, and fraud-prevention purposes).
Payment records – retained for 10 years to comply with financial/accounting laws.
Affiliate photos and videos - as agreed in specific affiliate program, or mutual agreement.
We process your Personal Data when you submit a review or feedback through our website, post-purchase surveys, user account, or other communication channels. This processing includes verifying the origin and authenticity of the feedback, moderating its content to prevent misuse (e.g., offensive, false, or misleading statements), and publishing verified reviews to ensure transparency, improve our services, and maintain customer trust.
Identifiers: name, surname, and contact details (e-mail address, phone number);
Feedback content: review text, rating, comments, photos, or other media voluntarily submitted by you.
GDPR Art. 6(1)(a) – Consent:
Feedback and reviews retained and published for up to 3 years or until withdrawn.
We process your Personal Data automatically and through technical logs whenever you access, browse, or interact with our website or online services. This includes processing necessary to maintain service functionality, detect and prevent unauthorized activities, ensure information system security, and comply with applicable cybersecurity or legal obligations.
Technical and usage data: IP address, device type, operating system, browser type and version, session identifiers, access time, and pages visited, cookie data.
Log and diagnostic data: server and application logs, error reports, authentication events, and security alerts.
GDPR Art. 6(1)(f) – Legitimate interest:
Technical and log data are typically retained for up to 12 months from collection unless a longer period is required for security investigations, legal obligations, or incident resolution.
