1. Who we are
Mockstand ("we", "us", "our") is the data controller responsible for your personal data. We operate the Mockstand website and screenshot-compositing service at this domain.
Questions or requests about your data can be sent via our contact page.
2. Data we collect and why
We only collect data that is necessary to provide the Service. Here is what we hold and the legal basis for each:
Account information
When you register, we store your name, email address, and a
hashed password. We also record when your account was created and last updated.
Legal basis: contract - this data is needed to create and maintain your account.
Billing and subscription
If you subscribe to a paid plan, we store a Stripe customer ID and the date of
your first subscription. We do not store card numbers or payment details - those are handled
entirely by Stripe (see Sub-processors below).
Legal basis: contract - required to process payments and manage your subscription.
Projects and uploaded files
Projects, screenshots, background images, overlay graphics, and custom fonts you upload are stored
on our servers under your account and are not accessible to other users.
Legal basis: contract - storage is the core service you signed up for.
Caption text sent for AI translation
When you use the Auto-translate feature, the caption text from your screenshots
is sent to Anthropic's API to perform the translation. Only the text you actively submit for
translation is transmitted - no other project data or files are shared. See Sub-processors below
for Anthropic's data handling terms.
Legal basis: contract - translation is a feature you explicitly trigger.
Contact messages
If you contact us via the contact form, we store your name,
email address, and message content so we can respond.
Legal basis: legitimate interest - we have a legitimate interest in responding to
enquiries and keeping a record of support communications.
Early-access sign-ups
If you submitted your email address during our pre-launch period, we store that address to send
you a launch notification and any associated promotional code.
Legal basis: consent - you provided your email specifically for this purpose.
Server logs
Our web servers automatically log IP addresses, request paths, timestamps, and
browser user-agent strings for each request. These logs are used solely for security monitoring,
abuse prevention, and diagnosing technical issues. They are retained for a maximum of 90 days
and then deleted.
Legal basis: legitimate interest - maintaining the security and integrity of the
Service.
3. Sub-processors and data sharing
We do not sell your personal data. We share it only with the following service providers ("sub-processors") who process it on our behalf under data processing agreements:
Stripe
We use Stripe to process payments and manage subscriptions. When you subscribe, you interact directly with Stripe's payment forms; your card details are transmitted to and stored by Stripe, not us. Stripe is certified to PCI DSS Level 1. See Stripe's Privacy Policy for details on how they handle your data.
Anthropic
We use Anthropic to power the Auto-translate feature. Caption text you submit for translation is sent to Anthropic's API and processed according to Anthropic's Privacy Policy. No other data from your account or projects is shared with Anthropic.
Hosting infrastructure
Our servers and database run on a third-party cloud hosting provider. All data is stored within their infrastructure under a data processing agreement. Uploaded files and project data do not leave the hosting environment except where you explicitly trigger an export or translation.
We may also disclose personal data if required to do so by law, court order, or governmental authority, or where we believe disclosure is necessary to protect the rights, property, or safety of Mockstand, our users, or others.
4. Data retention
We keep your data for as long as your account is active and for a limited period afterwards:
- Account data, projects, and uploaded files - retained while your account is active. When you delete your account, all associated data and files are permanently deleted within 60 days (the window kept for chargeback and dispute handling).
- Contact messages - retained for up to 2 years from receipt, then deleted.
- Early-access subscribers - retained until the launch email has been sent and any promotional code redeemed, or for up to 12 months from sign-up, whichever is sooner. You can request deletion at any time.
- Server logs - automatically deleted after 90 days.
- Billing records - we may retain transaction records for up to 7 years where required by tax and accounting law, even after account deletion. These records contain only the minimum data required (order amount, date, plan) and are not used for any other purpose.
5. Your rights
Under the GDPR and equivalent laws, you have the following rights over your personal data. To exercise any of them, use your account settings where available, or contact us via the contact page and we will respond within 30 days.
- Access - you can request a copy of the personal data we hold about you.
- Rectification - you can correct inaccurate data directly in your account profile, or ask us to correct anything you cannot change yourself.
- Erasure - you can permanently delete your account and all associated data from your account settings. Billing records retained for legal reasons are the only exception (see Data Retention above).
- Portability - you can download a copy of your data (projects and uploaded files) from your account settings.
- Restriction - you can ask us to restrict processing of your data while a dispute is being resolved.
- Objection - you can object to processing based on legitimate interest (such as server log retention). We will cease that processing unless we have compelling legitimate grounds that override your interests.
- Withdraw consent - where processing is based on consent (early-access emails), you can withdraw consent at any time by contacting us.
You also have the right to lodge a complaint with your local data protection authority if you believe we have not handled your data lawfully.
6. Cookies & analytics
We use a session cookie to keep you logged in. This cookie is strictly necessary for the Service to function and does not require your consent under applicable law.
We also use Google Analytics 4 to understand how the Service is used so we can improve it. Google Analytics sets cookies and collects usage data such as pages viewed, approximate location, device and browser type, and interactions with features (for example exporting screenshots). We enable IP anonymization, and we do not use advertising or cross-site tracking cookies.
For visitors in the EU/EEA, analytics cookies are not set until you give consent via our cookie banner (Google Consent Mode); no analytics data is collected beforehand. Visitors outside the EU/EEA have analytics enabled by default. You can review or withdraw your choice at any time using the "Cookie settings" link in the site footer.
Analytics data is processed by Google LLC. See Google's Privacy Policy and Google Analytics Opt-out for more information.
7. Security
Passwords are stored as cryptographic hashes - we never store or transmit your plaintext password. Uploaded files are served only to authenticated account owners. All traffic between your browser and our servers is encrypted via HTTPS.
No system is completely secure. If you believe you have found a security vulnerability, please contact us privately via the contact page before disclosing it publicly.
8. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be communicated by updating the "Last updated" date at the top of this page. Your continued use of the Service after a change constitutes acceptance of the updated policy.
9. Contact
For any questions about this Privacy Policy, or to exercise your data rights, please use our contact page. We will respond within 30 days.