Privacy policy
Last updated
What we collect, why we collect it, and how to make us delete it.
Who is responsible
TODO: registered company name, trading as Mockupccino, is the controller for the personal data described here. Contact details are on the imprint.
What we collect
Account data. Your email address and a bcrypt hash of your password. We never store the password itself and cannot recover it. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Content you upload. The artwork you drop onto a mockup, the designs you save, and the images you export. These are yours; we process them only to render and store what you asked for. Legal basis: performance of a contract.
Technical logs. Request logs including IP address, user agent, and timing. IP addresses are also used to rate-limit sign-up, sign-in and password reset, which is what stops one attacker locking everyone out. Legal basis: legitimate interest in operating and securing the service (Art. 6(1)(f) GDPR).
Billing data. If you subscribe, Stripe holds your payment details and we hold a customer identifier, your plan, and your invoice history. Card numbers never touch our servers.
AI prompts. Only when you use the AI image tools, and only the prompt you typed. We do not send your uploaded artwork to an AI provider.
Cookies
One cookie, mockupccino_session, which keeps you signed in. It is strictly necessary for the service to function and therefore does not require consent. It is httpOnly, so no script can read it.
We do not run advertising, tracking or profiling cookies. No analytics script is served: an analytics integration exists in the code but is switched off in production and will not be switched on without asking you first.
Who else processes it
We use the following processors. Transfers to the United States rely on the European Commission’s Standard Contractual Clauses.
| Processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Application hosting, database, and object storage | Germany (EU) |
| Stripe, Inc. | Payment processing and subscription billing. Card details go to Stripe directly and never reach our servers. | United States (SCCs) |
| Resend (Plus Five Five, Inc.) | Transactional email — address verification and password reset | United States (SCCs) |
| Functional Software, Inc. (Sentry) | Error monitoring and diagnostics | United States (SCCs) |
| fal.ai (Features and Labels, Inc.) | AI image generation — only for prompts you explicitly submit to the AI tools | United States (SCCs) |
| Google Ireland Ltd. (Google Analytics 4)not currently active | Usage analytics. Configured but NOT enabled: no analytics script is served and no measurement id is set in production. | Ireland (EU) |
We do not sell personal data, and we do not share it with anyone outside this list.
How long we keep it
Account data lives for as long as the account does. Sessions expire after 30 days. Exported render files are removed from storage after one day by an automatic lifecycle rule; your saved designs and uploaded artwork stay until you delete them or delete your account.
One honest caveat. When an account is deleted, every database record goes immediately and nothing in the product can reach the files any more — every file URL is signed on demand from a record that no longer exists. The stored bytes themselves are removed by a separate cleanup pass, which is built but not yet running on a schedule. If you want your files erased from storage on a specific date, email us and we will do it by hand and confirm.
Your rights
Under the GDPR you can ask for access, correction, deletion, restriction, portability, and you can object to processing based on legitimate interest. Email lionel@pixeden.com and we will answer within 30 days.
You can delete your account yourself, without asking us, from account settings. It is immediate and irreversible.
You also have the right to complain to a supervisory authority in your country of residence.
Changes
If we change this policy in a way that affects you, we will say so by email before it takes effect. The date at the top always reflects the current version.