Privacy Policy

1. Who we are

IziDisplay is a cloud-based digital signage platform that lets businesses manage the content shown on Android TV screens. The Service is operated by PYONLINE E.A.S, a company established in Asunción, Republic of Paraguay. For the purposes of this policy, IziDisplay (PYONLINE E.A.S) acts as the controller of the personal data described here.

You can reach our data protection contact at:

khaldun@brimostech.com

2. Data we collect

We collect only the data needed to provide and secure the Service:

• Account data — your name, email address, company name, and a hashed password. We never store passwords in plain text.
• Media content — images, videos, and other files you upload to display on your screens. You decide what to upload; we store and deliver it on your behalf.
• Device data — identifiers, names, pairing information, and status heartbeats (online/offline, last seen) of the Android TV devices you connect to your account.
• Usage and audit data — logs of account actions (such as sign-ins, content changes, and device pairing) kept for security and accountability.
• Cookies and local storage — a single essential, httpOnly refresh-token cookie that keeps you signed in. We do not use advertising or third-party analytics cookies. Your browser’s local storage holds interface preferences, such as your language.

3. Browser extension

IziDisplay offers an optional Chrome browser extension that sends an image you find on a web page to one of your own screens. The extension is part of the Service and is covered by this policy. Installing it is optional, and it can be removed at any time.

The extension handles only the following data, and only when you ask it to:

• Sign-in credentials — the email address and password you type into the extension are sent to the IziDisplay API for the sole purpose of signing you in. The extension does not store your password.
• Session tokens — after sign-in, an access token and a refresh token are kept in the browser’s extension storage on your own device so that you stay signed in. They are sent only to the IziDisplay API.
• Your screens — the name, status, location labels, and local network address of the screens on your account, cached on your device so the extension can show the list and deliver an image over your local network.
• The image you choose — only the web address (URL) of the image you click is sent to the screen you selected, through the IziDisplay API or directly over your local network. The screen then loads the image itself.
• Your preferences — which screen you selected and how long an image should stay on it.

The extension does not collect your browsing history, does not read or change the content of the pages you visit beyond identifying the image you click, and contains no analytics, advertising, or tracking code. We do not sell or transfer this data to third parties, do not use it for any purpose unrelated to sending images to your screens, and do not use it to determine creditworthiness or for lending purposes. Removing the extension deletes the data it kept on your device.

4. Purposes and legal bases

We process personal data only where we have a valid basis to do so:

• Performance of a contract — creating and managing your account, storing and delivering your media to your devices, sending transactional emails such as login and registration verification codes, and providing support.
• Legitimate interest — keeping audit logs, monitoring device status, securing the Service, and preventing fraud and abuse.
• Consent — any optional features or communications that require it. You may revoke consent at any time.
• Compliance with legal obligations — retaining records where required by applicable law.

5. Sub-processors

We rely on a small number of service providers (processors) to run the Service:

These providers process data only on our instructions and under contractual safeguards. We do not sell personal data.

6. Data retention

We keep personal data for as long as your account is active and as needed to provide the Service.

If you delete your account, we delete or anonymize your personal data and uploaded media within 30 days, except where we must retain certain records to comply with legal obligations or to establish, exercise, or defend legal claims.

7. Security

We apply technical and organizational measures appropriate to the risk, including:

• Encryption in transit (HTTPS/TLS) for all connections to the Service.
• Passwords stored only as cryptographic hashes.
• Role-based access controls and tenant isolation, keeping each customer’s data separate.
• Audit logging of account actions.
• Production access restricted to authorized personnel.

No system is perfectly secure. If we become aware of a security incident affecting your personal data, we will notify you and, where required, the competent Paraguayan authority, in accordance with applicable law.

8. Your rights

Under the data protection framework of the Republic of Paraguay — including the constitutional guarantee of habeas data — you may at any time request:

• Confirmation that we process your data, and access to it.
• Correction of incomplete, inaccurate, or outdated data.
• Anonymization, blocking, or deletion of unnecessary or excessive data.
• Portability of your data to another provider.
• Deletion of data processed on the basis of your consent.
• Information about the third parties with whom we share data.
• Revocation of consent at any time.

To exercise any of these rights, email us at the address below. We will respond within the timeframes set by applicable law. You may also seek habeas data relief before the Paraguayan courts and contact the competent Paraguayan data protection authority.

khaldun@brimostech.com

9. International transfers

IziDisplay is operated from the Republic of Paraguay, but parts of the Service run on infrastructure abroad: our application and database are hosted on Vultr servers located in São Paulo, Brazil, and Cloudflare (media storage and delivery) and Resend (transactional email) may process data in the United States or elsewhere. These international transfers are protected by contractual safeguards agreed with each provider and by the providers’ own data protection commitments.

10. Children

The Service is intended for businesses and is not directed at children or adolescents. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top indicates the latest revision. If the changes are material, we will notify you by email or through the Service before they take effect.

12. Contact

Questions, requests, or complaints about this policy or about your personal data can be sent to:

khaldun@brimostech.com