Privacy Policy for MOCKLIO
Last Updated: August 24, 2026
This policy applies to mockl.io and the MOCKLIO web and mobile apps. A separate, shorter policy applies to public artist portfolio pages (e.g. artistname.mockl.io).
1. Who We Are (Data Controller)
MOCKLIO
Operated by Sebastian Kluger (Einzelunternehmer)
Gensinger Straße 23, 10315 Berlin, Germany
Privacy contact: contact@mockl.io
Website: mockl.io
This Privacy Policy explains how we collect, use, disclose, and protect personal data when you use MOCKLIO’s platform services (account, mockups, videos, Loop Hub, carousel and caption tools, portfolios, shop Inquiries, and payments). By using these services, you acknowledge this policy. If you do not agree, please do not use MOCKLIO.
2. Information We Collect
2.1 Information You Provide
Account & identity: Name, email address, and authentication data (email magic link, Google sign-in, or Sign in with Apple). If you use Google or Apple sign-in, we receive the basic profile information that provider shares with us (typically name, email, and, for Google, a profile image).
Profile & preferences: Instagram username, subscription tier, credits, onboarding progress, cookie consent choice, and similar account settings.
Uploaded content: Artwork images and related files you upload to create mockups, videos, carousels, and captions. You are solely responsible for ensuring you have the right to upload and use these files; see our Terms of Service for copyright and takedown procedures.
Portfolio & listings: Text, images, videos, prices, and contact details you publish in your portfolio or shop.
Inquiries (Deal Room): If you inquire about an artwork without a MOCKLIO account, we collect your name, email, postal address, and the message you write (length-limited) to introduce you to the artist.
AI features: Text you enter for AI-assisted tools (e.g. artist bio, style, carousel context) and, when you use AI room matching, a copy of the artwork image you asked us to match (see Section 3.5).
Payment-related data: We do not store full card numbers. Payment details are processed by our payment providers (Stripe on the website; Apple App Store via RevenueCat for iOS in-app purchases; historically Paddle for older website subscriptions). We retain transaction references, amounts, and subscription status for billing support and legal compliance.
Support & communications: Messages you send to us and emails we send you (service updates, onboarding, and account-related notices).
2.2 Information Collected Automatically
When you use MOCKLIO, we automatically collect technical and usage data. Under GDPR, data such as IP address, device identifiers, and browsing activity is considered personal data where it can be linked to you.
• Device and browser type, operating system, and language
• IP address and approximate country (derived server-side)
• Pages visited, features used, and timestamps
• Referring URLs and on-site navigation paths
• Session and anonymous identifiers for product analytics
• Authentication session cookies (required to keep you logged in)
• Google Analytics data (only if you accept cookies via our cookie banner)
• Vercel Web Analytics (privacy-oriented, cookieless page-view metrics — see Section 8.2)
• Push notification token on iOS (Firebase Cloud Messaging), if you allow notifications
2.3 Information From Third Parties
We may receive information from payment processors (payment status, customer IDs), Google (if you sign in with Google), Apple (if you sign in with Apple or buy on iOS), Apple/RevenueCat (mobile subscription entitlements synced to your MOCKLIO account), and AI providers when you use an AI feature (Section 3.5).
3. How We Use Your Information
3.1 Service Delivery
• Create image mockups, videos, carousels, captions, and Share Packs from your uploads
• Host and display your portfolio and shop listings
• Operate Inquiries (Deal Room) and generate deal documents
• Suggest matching rooms when you use AI batch / room matching
• Manage your account, credits, and subscriptions
• Authenticate you and keep your session secure
3.2 Uploaded Files
We use your uploaded artwork solely to provide the services you request — for example, placing your art in room mockups, creating videos, building carousels and captions, and showing results in your account or published portfolio. We do not sell your uploads. Generated outputs are delivered to you; public display occurs only where you choose to publish a portfolio or listing. When you use AI room matching, we send a copy of that artwork to our AI provider as described in Section 3.5.
3.3 Communications
• Send transactional emails (login links, video ready, receipts)
• Respond to support requests
• Send onboarding and product tips (you may unsubscribe from non-essential emails)
• Notify you of material changes to this policy or our Terms
3.4 Product Analytics (First-Party)
We record first-party product events (e.g. feature usage, errors, funnel steps) in our own database. This processing is essential to operate, secure, and improve MOCKLIO — including diagnosing bugs, measuring reliability, preventing abuse, and understanding which features work. It is not sold to third parties and is not used for third-party advertising. When you are logged in, events may be linked to your account; otherwise we use anonymous session identifiers.
3.5 AI Features
Some MOCKLIO features use third-party AI. We only send data when you use that feature. We do not use your artwork or account data to train public AI models.
Room matching (AI batch): To suggest a room for your artwork, we send a copy of the image you uploaded (pixels, not your password) to OpenAI. OpenAI returns a short description (what is in the picture, medium, mood). We use that text to pick a matching room. If OpenAI is unavailable, we pick a room without sending the image.
Series hang (AI batch): For a multi-piece drop, we may send those short descriptions (text only, not the image files) to DeepSeek so rooms are spread across the series.
Portfolio, carousel copy, and captions: If you use the AI portfolio wizard, carousel writer, or Share Pack captions, we send the text and metadata you provide (e.g. artist bio, style, artwork title, room name — typically not the image files) to DeepSeek to generate layout and copy suggestions. If the service is unavailable, we use a built-in fallback.
What we store: We may keep the suggested room, a short reason, and (if you change the room) your choice, so matching can improve for your account. Carousel slides and captions you generate are stored with your account until you delete them.
3.6 Security, Fraud & Legal Compliance
• Rate limiting, abuse detection, and incident response
• Maintaining tax and accounting records for payments
• Responding to lawful requests and enforcing our Terms
4. Legal Basis for Processing (GDPR)
If you are in the European Economic Area (EEA) or UK, we process personal data on the following bases:
Contract (Art. 6(1)(b)): Account management, mockup and video generation, AI features you request (room matching, carousel/captions, portfolio suggestions), portfolio hosting, Inquiries, and payment fulfillment.
Legitimate interests (Art. 6(1)(f)): First-party product analytics, security monitoring, bug diagnosis, service improvement, and Vercel Web Analytics — balanced against your rights; you may object (Section 8).
Consent (Art. 6(1)(a)): Google Analytics cookies (only after you accept via our cookie banner), and any optional marketing emails where consent is required.
Legal obligation (Art. 6(1)(c)): Tax, accounting, and regulatory record-keeping.
5. How We Share Information
5.1 We Do Not Sell Your Data
We do not sell your personal information. We do not share it with third parties for their own marketing purposes.
5.2 Service Providers (Processors)
We use trusted providers who process data on our behalf, only as needed to deliver the service:
Supabase — authentication, database, and file storage (EU/US)
Vercel — website hosting and privacy-oriented Web Analytics
Google Cloud — creating and delivering your videos
OpenAI — image analysis for AI room matching (artwork pixels you submit for that feature)
DeepSeek — AI text processing for portfolio suggestions, carousel copy, Share Pack captions, and series room assignment
Stripe — website payments and subscriptions
Paddle — historical website Merchant of Record for subscriptions billed before our Stripe migration
Apple App Store / RevenueCat — iOS in-app purchases and entitlement sync
Resend — transactional and service email delivery
Google Analytics — traffic measurement (consent required; see Section 8)
Google — OAuth sign-in (if you choose Google login)
Apple — Sign in with Apple (web and iOS) and App Store purchases (if you use iOS)
Firebase (Google) — iOS push notifications (device token), if you allow notifications
Each provider maintains its own privacy policy. We use contractual safeguards (including Standard Contractual Clauses where required) for international transfers.
5.3 Public Content You Publish
Information you publish on a public portfolio or listing (e.g. artist name, artwork, prices, contact links) is visible to anyone who visits that page. You control what you publish.
5.4 Legal Requirements
We may disclose information if required by law, court order, or government request, or to protect rights, safety, and security.
5.5 Business Transfers
If MOCKLIO is involved in a merger, acquisition, or asset sale, your information may transfer as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.
6. Data Retention
We keep data only as long as necessary for the purposes above:
Account data: While your account is active; deleted or anonymized within 30 days of a confirmed deletion request, except where law requires longer retention.
Uploads & generated media: Until you delete them or your account is deleted, plus a short backup window (up to 30 days).
Inquiries (Deal Room): For the life of the inquiry and up to 6 years thereafter for legal and dispute purposes.
AI matching metadata: Suggested room, short reason, and your room choices: while your account is active, then deleted with your account (plus backup window).
Payment records: Up to 10 years as required by German tax and commercial law.
First-party analytics events: Up to 24 months, then aggregated or deleted.
Google Analytics:Per Google’s retention settings (configurable; default up to 14 months).
Support emails: Up to 3 years after the ticket is closed.
Request deletion at contact@mockl.io.
7. Data Security
We use technical and organizational measures including encryption in transit (TLS), access controls, authenticated APIs, rate limiting, and need-to-know access to production systems. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.
8. Your Rights and Choices
8.1 GDPR / EEA Rights
You may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent at any time (without affecting prior lawful processing). Contact contact@mockl.io; we respond within 30 days. You may lodge a complaint with the Berlin Commissioner for Data Protection.
8.2 Cookies & Tracking
Essential cookies: Authentication session cookies are required to keep you logged in.
Google Analytics:Loaded only if you click “Accept” on our cookie banner. If you click “Opt out,” Google Analytics is not loaded. Your choice is stored in your browser and, if logged in, in your account profile.
Vercel Web Analytics:We use Vercel’s privacy-oriented analytics to measure page views. It does not use advertising cookies and does not require consent under our current configuration. You can still block it with browser privacy tools.
First-party analytics: Operates as described in Section 3.4 and is necessary for service operation and bug tracking; it is not disabled by the cookie banner.
8.3 Marketing Communications
Unsubscribe from non-essential emails via the link in any marketing message or by contacting us. Transactional emails (receipts, security, video-ready notifications) cannot be opted out while you have an account.
8.4 Account Settings
Update your name, Instagram username, and other profile fields in your dashboard. For data export or deletion, email us.
9. Children’s Privacy
MOCKLIO is not directed to anyone under 18. We do not knowingly collect personal information from minors. If you believe a child has provided us data, contact contact@mockl.io and we will delete it.
10. International Data Transfers
Your data may be processed in the EU, United States, and other countries where our providers operate. In particular, OpenAI typically processes room-matching images in the United States, and DeepSeek may process text outside the EEA. When transferring data from the EEA, we rely on appropriate safeguards such as Standard Contractual Clauses and provider compliance programs.
11. Third-Party Links
Our site may link to third-party websites (e.g. artist Instagram, payment portals). We are not responsible for their privacy practices. Review their policies before sharing data with them.
12. Policy Updates
We may update this policy to reflect changes in our practices or legal requirements. Material changes will be notified by email to registered users. The “Last Updated” date shows the current version.
13. Do Not Track
Some browsers send “Do Not Track” signals. There is no industry standard for responding to DNT; we do not currently alter tracking based on DNT alone. Use our cookie banner to control Google Analytics.
14. California Privacy Rights (CCPA/CPRA)
If you are a California resident, you have the right to:
• Know what personal information we collect, use, and disclose
• Request deletion of your personal information
• Request correction of inaccurate personal information
• Opt out of the “sale” or “sharing” of personal information — we do not sell or share data for cross-context behavioral advertising
• Limit use of sensitive personal information — we use uploads only to provide the service you request
• Non-discrimination for exercising your privacy rights
• Use an authorized agent — provide written permission and verification of identity
Submit requests to contact@mockl.io. We verify identity before fulfilling requests.
15. Contact Us
Email: contact@mockl.io
Postal:MOCKLIO, Gensinger Straße 23, 10315 Berlin, Germany
Imprint: mockl.io/imprint
We aim to respond within 30 days.
By using MOCKLIO, you acknowledge that you have read and understood this Privacy Policy.