Privacy Policy

1. Who we are

IziDisplay is a cloud-based digital signage platform that lets businesses manage the content shown on Android TV screens. The Service is operated by PYONLINE E.A.S, a company established in Asunción, Republic of Paraguay. For the purposes of this policy, IziDisplay (PYONLINE E.A.S) acts as the controller of the personal data described here.

You can reach our data protection contact at:

[email protected]

2. Data we collect

We collect only the data needed to provide and secure the Service:

• Account data — your name, email address, company name, and a hashed password. We never store passwords in plain text.
• Media content — images, videos, and other files you upload to display on your screens. You decide what to upload; we store and deliver it on your behalf.
• Device data — identifiers, names, pairing information, and status heartbeats (online/offline, last seen) of the Android TV devices you connect to your account.
• Usage and audit data — logs of account actions (such as sign-ins, content changes, and device pairing) kept for security and accountability.
• Cookies and local storage — a single essential, httpOnly refresh-token cookie that keeps you signed in. We do not use advertising or third-party analytics cookies. Your browser’s local storage holds interface preferences, such as your language.

3. Purposes and legal bases

We process personal data only where we have a valid basis to do so:

• Performance of a contract — creating and managing your account, storing and delivering your media to your devices, sending transactional emails such as login and registration verification codes, and providing support.
• Legitimate interest — keeping audit logs, monitoring device status, securing the Service, and preventing fraud and abuse.
• Consent — any optional features or communications that require it. You may revoke consent at any time.
• Compliance with legal obligations — retaining records where required by applicable law.

4. Sub-processors

We rely on a small number of service providers (processors) to run the Service:

These providers process data only on our instructions and under contractual safeguards. We do not sell personal data.

5. Data retention

We keep personal data for as long as your account is active and as needed to provide the Service.

If you delete your account, we delete or anonymize your personal data and uploaded media within 30 days, except where we must retain certain records to comply with legal obligations or to establish, exercise, or defend legal claims.

6. Security

We apply technical and organizational measures appropriate to the risk, including:

• Encryption in transit (HTTPS/TLS) for all connections to the Service.
• Passwords stored only as cryptographic hashes.
• Role-based access controls and tenant isolation, keeping each customer’s data separate.
• Audit logging of account actions.
• Production access restricted to authorized personnel.

No system is perfectly secure. If we become aware of a security incident affecting your personal data, we will notify you and, where required, the competent Paraguayan authority, in accordance with applicable law.

7. Your rights

Under the data protection framework of the Republic of Paraguay — including the constitutional guarantee of habeas data — you may at any time request:

• Confirmation that we process your data, and access to it.
• Correction of incomplete, inaccurate, or outdated data.
• Anonymization, blocking, or deletion of unnecessary or excessive data.
• Portability of your data to another provider.
• Deletion of data processed on the basis of your consent.
• Information about the third parties with whom we share data.
• Revocation of consent at any time.

To exercise any of these rights, email us at the address below. We will respond within the timeframes set by applicable law. You may also seek habeas data relief before the Paraguayan courts and contact the competent Paraguayan data protection authority.

[email protected]

8. International transfers

IziDisplay is operated from the Republic of Paraguay, but parts of the Service run on infrastructure abroad: our application and database are hosted on Vultr servers located in São Paulo, Brazil, and Cloudflare (media storage and delivery) and Resend (transactional email) may process data in the United States or elsewhere. These international transfers are protected by contractual safeguards agreed with each provider and by the providers’ own data protection commitments.

9. Children

The Service is intended for businesses and is not directed at children or adolescents. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, contact us and we will delete it.

10. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top indicates the latest revision. If the changes are material, we will notify you by email or through the Service before they take effect.

11. Contact

Questions, requests, or complaints about this policy or about your personal data can be sent to:

[email protected]