Privacy  Policy

The data controller responsible for your personal data is Mockgo LTD. You can reach us about any privacy matter at mockgopro@gmail.com, and you can request our registered company details by email.

References to “Mockgo”, “we”, “us”, or “our” in this document refer to Mockgo LTD and the Mockgo product.

Mockgo is intended for users who are at least 16 years old. We do not knowingly collect personal data from anyone under 16. If you believe a minor has created an account, contact us at mockgopro@gmail.com and we will remove the account and associated data.

We only collect what is needed to operate Mockgo:

• Account information. Email address, password (stored as a one-way hash, never in plain text), and the date you joined.

• Marketing preference. Whether you opted in to product updates and helpful guides at signup, plus the timestamp of that choice.

• Usage data. High-level counters such as the number of mockups generated and the time saved. We do not access or store the design files you process. Those stay on your computer.

• License & devices. Activation status, plan tier, billing interval, and device information (machine name, platform, a hashed device fingerprint) so the plugin can verify your license on up to two computers.

• Support communications. When you message support, we store the conversation, any image attachments you send, and your email so we can reply.

• Technical metadata. Standard server logs (IP address, browser, request time) used for security, abuse prevention, and debugging.

• Analytics and advertising data. On our website, our analytics and advertising partners (Google, Meta, and TikTok) may set cookies and collect device and usage identifiers, your IP address, and the pages and actions you take. In addition, when you complete a purchase, we send a conversion event from our servers to Google, Meta, and TikTok to measure our advertising: to Meta and TikTok this includes a hashed (irreversible) version of your email plus your IP address and browser identifiers, and to Google we send measurement data (a pseudonymous client identifier and the order value), not your email. None of this ever includes the design files you process in the plugin. See Section 8 to control it.

• Payment information. Handled entirely by our payment processor LemonSqueezy. We never receive or store your card number, CVV, or full billing address. We only keep the metadata LemonSqueezy returns (subscription status, plan, billing dates).

We use your data only for these purposes:

• Provide the service. Create your account, authenticate logins, deliver the plugin, track plan usage, and enforce device limits.

• Operate billing. Process subscriptions, send receipts, and manage upgrades, cancellations, and refunds via LemonSqueezy.

• Customer support. Respond to your messages and resolve issues you report.

• Service emails. Send transactional emails such as email verification, password changes, billing receipts, and support replies. These cannot be unsubscribed from while your account is active.

• Marketing emails. If, and only if, you ticked the optional checkbox at signup, we send product updates and tips. You can unsubscribe at any time using the link in every marketing email.

• Security & abuse prevention. Detect fraud, rate-limit abuse, and enforce our Terms of Service.

• Improve Mockgo. Analyse aggregated usage patterns to fix bugs and prioritise features.

• Analytics and advertising. With your consent where required, measure website traffic and the performance of our marketing, understand which pages and features people use, and build and measure advertising audiences with Google, Meta, and TikTok. You can change this any time via Cookie Settings in the footer.

For users in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data on these legal bases:

• Performance of a contract. To deliver the service you signed up for (account, plugin, billing, support).

• Legitimate interests. To keep the service secure, prevent abuse, and improve features. We balance these interests against your privacy rights.

• Consent. For optional marketing emails, and for analytics and advertising cookies in regions where consent is required (EEA, UK, Switzerland). You can withdraw consent at any time using Cookie Settings, without affecting your access to the service.

• Legal obligation. When we must retain or disclose data to comply with applicable law.

We do not sell your personal information for money. We share it with the providers below. Most act as our processors and handle data only on our instructions; the advertising and analytics platforms (Google, Meta, TikTok) act as independent or joint controllers for the ad measurement and audience-building described in Section 8, and we “share” data with them for cross-context behavioural advertising as defined by California law (see Section 10 and Your Privacy Choices):

• Supabase (cloud infrastructure). Hosts our database, authentication, file storage, and realtime layer. Data is stored in Frankfurt, Germany (EU).

• Cloudflare (hosting and privacy-first analytics). Hosts the Mockgo website and provides cookieless, aggregate performance metrics (Cloudflare Web Analytics). May process data globally, including the United States.

• Google. Google Analytics 4 and Google Ads measurement. Processes website usage and device data for traffic analytics and ad measurement (a pseudonymous client identifier, not your email). May process data in the United States.

• Meta (Facebook and Instagram). The Meta Pixel and Conversions API measure our advertising and build audiences. We share event data including a hashed email and IP address. May process data in the United States.

• TikTok. The TikTok Pixel and Events API measure our advertising and build audiences. We share event data including a hashed email and IP address. May process data in the United States.

• Resend (email delivery). Sends transactional and marketing emails on our behalf.

• LemonSqueezy. Acts as Merchant of Record for all payments. They are an independent data controller for payment data they collect directly from you. See their privacy policy at lemonsqueezy.com/privacy.

• Adobe Photoshop. The plugin runs inside Adobe Photoshop on your computer. Adobe is not a sub-processor of ours, but using Photoshop is governed by Adobe’s own terms.

We may also disclose data when required by law, to protect our rights, or in connection with a corporate transaction (such as a merger or sale of assets), in which case we will give you reasonable notice.

Mockgo’s primary database is hosted in the European Union (Frankfurt). Some providers (Cloudflare, Resend, LemonSqueezy, Google, Meta, TikTok) may process data in the United States or other countries. Where the recipient is certified under the EU-US Data Privacy Framework (and its UK and Swiss extensions), we rely on that framework; otherwise we rely on Standard Contractual Clauses or equivalent safeguards approved by the relevant authorities. TikTok may also process data outside these regions, subject to the same safeguards.

We use cookies and similar technologies for three purposes:

• Essential. Required to keep you signed in and run core features. Always on; these do not require consent.

• Analytics. Google Analytics 4 helps us understand traffic and how the site is used. Cloudflare Web Analytics is also used but is cookieless, collects no personal data, and runs in all regions without consent.

• Advertising. The Google, Meta, and TikTok pixels, and equivalent server-side events, let us measure our advertising and build audiences. They set cookies and share limited event data, including a hashed email (Meta and TikTok) and your IP address, with those platforms.

The main non-essential cookies and identifiers we or our partners set:

• _ga, _ga_* (Google Analytics). Distinguish visitors and sessions for analytics. Up to 2 years.

• _fbp, _fbc (Meta). Identify a browser and ad click for advertising measurement. Up to 90 days.

• _ttp (TikTok). Identify a browser for advertising measurement. Up to 13 months.

Where the law requires prior consent (EEA, UK, Switzerland), analytics and advertising cookies are off by default and load only if you accept them in our cookie banner, where you can accept or reject them with equal prominence. In other regions they are on by default and you can opt out. You can change or withdraw your choice at any time using the “Your Privacy Choices” link in the footer, and we honor the Global Privacy Control (GPC) browser signal as an opt-out.

California residents can use the same “Your Privacy Choices” control to opt out of the “sharing” of their personal information for cross-context behavioural advertising. Opting out stops both the browser pixels and the server-side advertising events. You can also block cookies in your browser settings and opt out directly with each provider (Google, Meta, TikTok).

• Active accounts. We keep your data for as long as your account is active.

• Account deletion. When you delete your account from the dashboard, we permanently remove your account, subscriptions, license devices, support threads, and uploaded attachments within 24 hours.

• Encrypted backups. Database backups containing your data are retained for up to 30 days after deletion before being permanently overwritten.

• Service logs. Server logs, which may include your IP address, are kept for up to 90 days for security and debugging, then deleted.

• Legal retention. We may retain limited records (such as payment receipts) longer where required by tax, accounting, or other applicable law.

Depending on where you live, you have the following rights:

• Access. Request a copy of the personal data we hold about you.

• Rectification. Ask us to correct inaccurate or incomplete data.

• Erasure. Ask us to delete your data. You can do this yourself from the dashboard or by emailing us.

• Restriction. Ask us to limit how we use your data.

• Portability. Receive your data in a structured, machine-readable format.

• Objection. Object to processing based on legitimate interests, including direct marketing.

• Withdraw consent. Withdraw consent for marketing emails at any time using the unsubscribe link or by contacting us.

• Lodge a complaint. EEA users can lodge a complaint with their local data protection authority. UK users can complain to the ICO.

For California residents (CCPA/CPRA): you have the rights to know, access, correct, and delete your personal information, to opt out of its “sale” or “sharing”, and to not be discriminated against for exercising these rights. We will never deny you service or charge you a different price for exercising a privacy right.

In the preceding 12 months we collected these categories of personal information, and “shared” the ones noted for cross-context behavioural advertising:

• Identifiers. Email, account ID, device and cookie IDs, IP address. Shared with Google, Meta, and TikTok for advertising.

• Internet and network activity. Pages viewed and actions taken on the website. Shared with Google, Meta, and TikTok for advertising.

• Commercial information. Subscription plan, billing interval, and purchase history. Not shared for advertising.

• Sources. You, your browser and device, and our payment processor (LemonSqueezy).

We do not sell your personal information for money, and we do not knowingly sell or share the personal information of anyone under 16. We do “share” the identifiers above with Google, Meta, and TikTok for cross-context behavioural advertising. We do not collect Sensitive Personal Information as defined by the CPRA beyond your account login credentials, which we never use or disclose for advertising or any purpose that would trigger the right to limit.

To opt out, use the “Your Privacy Choices” link in the footer or reject advertising in our banner; we also honor the Global Privacy Control (GPC) signal. An authorized agent may submit a request on your behalf with proof of authorization.

To exercise any right, email mockgopro@gmail.com or use the controls in your dashboard. We acknowledge requests within 10 business days and respond within 45 days (California) or one month (EEA and UK), extendable where the law allows for complex requests. We may first need to verify your identity.

We only send marketing emails (product updates, tips, and offers) if you ticked the optional consent box at signup. You can unsubscribe at any time using the link in every marketing email or by emailing mockgopro@gmail.com. Transactional emails (account, billing, support) are not marketing and continue while your account is active.

We use industry-standard safeguards: HTTPS everywhere, hashed passwords, encrypted data at rest and in transit, principle-of-least-privilege access, and per-user row-level security on our database. No system is perfectly secure, so we cannot guarantee absolute security, but we work continuously to reduce risk.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected users without undue delay, in accordance with GDPR Articles 33 and 34.

Mockgo is not directed at children under 16 and we do not knowingly collect their personal data. If you become aware that a child has provided us with personal data, please contact us and we will delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and, where required by law, notify you by email. Continued use of Mockgo after the update constitutes acceptance of the revised policy.

For any privacy-related question or to exercise your rights, email mockgopro@gmail.com.