Privacy Policy

1. Who we are

Mockupanda is run by Federico Cella, who is the data controller for the personal data described here.

For anything in this policy, including requests to access or delete your data, write to hello [at] mockupanda [dot] com.

Postal address:

2. What we collect

Account data. Your email address, and if you sign in with Google, your name and profile picture. Created when you register and kept while your account exists.

Artwork and templates. The image files you upload, the mockups generated from them, and the template settings you save. These are your files. We do not use them to train models, we do not sell them, and we do not look at them except when you ask us to help with a specific problem.

Payment data. Handled entirely by Stripe. We receive a customer id, subscription status and the last four digits of your card. We never see or store your full card number.

Usage data. Pages viewed, features used, and errors encountered. This includes session recordings, which capture how you move through the interface. Only collected with your analytics consent.

Advertising data. Identifiers that link a visit to an ad you clicked, so we can tell which campaigns work. Only collected with your advertising consent. See section 5.

Consent records. When you answer the cookie banner we store your choice, the time, the version of the banner you saw, and the country your request came from. We are required to be able to prove consent was given, and this is how we do it.

Support messages. Anything you send us through the feedback form or by email.

3. Why we use it, and on what legal basis

To run the service (your account, your files, generating mockups, taking payment). Legal basis: performance of our contract with you.

To keep records tax law requires us to keep (invoices and transaction history). Legal basis: legal obligation.

To keep the service secure and working (rate limiting, fraud prevention, debugging). Legal basis: our legitimate interest in operating a service that is not abused.

To understand usage and measure advertising. Legal basis: your consent, where consent is required (see section 5). Where it is not, our legitimate interest in improving the product and spending our advertising budget sensibly. You can object or withdraw at any time.

4. AI processing

Some features send your uploaded image to an AI provider: detecting the frame corners in a template, classifying an upload as a print or a product, generating template imagery, and generating reflections. We use Google (Gemini) and Replicate for this.

This means the image leaves our infrastructure and is processed by that provider under their terms. It happens only for the features listed above, and only when you use them.

5. Cookies and tracking

We group cookies into three categories. Strictly necessary cookies keep you signed in and remember your consent choice, and cannot be turned off. Analytics and advertising cookies are optional.

If you are in the EEA, the UK or Switzerland, nothing optional is loaded until you accept. Analytics and advertising scripts are not requested at all before then.

Everywhere else, analytics and advertising are on by default and you can switch them off at any time, with the same effect.

We also send conversion events to Meta from our own servers, matched using the identifiers above. This is the same data the browser pixel would send and is subject to the same consent: turn advertising off and neither the pixel nor the server events run.

Withdrawing consent stops future collection and deletes the identifiers already stored on your device.

Cookie preferences to change your choice at any time.

6. Who we share data with

We do not sell personal data. We share it with the processors below, each of which handles it on our instructions and for no other purpose.

We may also disclose data where we are legally required to, or to establish or defend legal claims.

7. International transfers

Several processors above are in the United States. Where personal data leaves the EEA or the UK, the transfer relies on the European Commission's Standard Contractual Clauses, the UK Addendum where applicable, or the provider's certification under the EU-US Data Privacy Framework.

8. How long we keep it

Account data and your files: for as long as your account is open. Delete your account and they go with it.

Payment and invoice records: as long as tax law requires, which is normally several years after the transaction, regardless of whether your account is still open.

Advertising identifiers: up to 90 days from your last visit, or until you withdraw consent, whichever comes first.

Analytics and session recordings: in line with our PostHog retention settings, and deleted on request.

Consent records: kept as evidence that consent was given, for as long as we could be asked to prove it.

9. Your rights

If you are in the EEA or the UK you have the right to access your data, to correct it, to have it deleted, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent at any time. Withdrawing consent does not affect processing that already happened.

If you are in California or another US state with similar law, you have the right to know what we collect, to have it deleted, to correct it, and to opt out of targeted advertising. Turning off advertising in your Cookie preferences is a valid opt-out. We do not sell personal data and we do not knowingly process sensitive personal information.

To exercise any of these, email hello [at] mockupanda [dot] com. We will not charge you or treat you differently for asking.

You also have the right to complain to a data protection authority. Ours is the Agencia Española de Protección de Datos (AEPD) in Spain. You can also complain to the authority where you live: in the UK that is the Information Commissioner's Office, and every EU country has its own.

10. Children

Mockupanda is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has given us data, email us and we will delete it.

11. Changes

We may update this policy. The date at the top always reflects the current version. If a change affects what we collect or why, we will ask for your consent again rather than rely on the answer you gave to an older version.

12. Contact

Questions about this policy or about your data: hello [at] mockupanda [dot] com.

See also our Terms of Service.