Privacy Policy

Only data that the Service actually needs is collected. In practice this means:

• Account data: your email address and display name, your interface language, and your marketing consent state. Purpose: creating and operating your account, signing you in, and contacting you about the Service.
• Uploaded screenshots and captured URLs: images you upload and web addresses you ask the Service to capture on your behalf. Purpose: producing the mockups you request.
• Generated mockups: the images the Service produces for you, together with the generation settings used, so a series can be reviewed and re-run. Purpose: delivering and storing your results.
• Credit and payment records: purchases, subscription state, credit balance and movements, invoice records, and the buyer country resolved from the IP address of the request together with how it was resolved. Purpose: charging you correctly, issuing lawful tax documents and applying the right VAT treatment.
• Coupon redemptions: which coupon was used, by which account, and when. Purpose: honouring the discount and preventing abuse.
• Marketing consent state and timestamps: whether you opted in, when, and when you withdrew. Purpose: proving that consent was given as the law requires.
• Technical logs: IP address, browser and device information, timestamps, requested actions and error records. Purpose: keeping the Service available, diagnosing faults, and detecting abuse and fraud.

Full payment card details are never received or stored by the Operator; they are entered directly with the payment provider. The Operator does not intentionally collect special categories of data, and you should not upload screenshots containing them.

Each purpose rests on a specific legal basis under Article 6 of the GDPR:

• Performance of a contract, Article 6(1)(b): creating and running your account, generating mockups, storing your projects, and billing you for what you buy.
• Compliance with a legal obligation, Article 6(1)(c): keeping accounting and tax records, issuing invoices, retaining evidence of consent, and responding to lawful requests from authorities.
• Consent, Article 6(1)(a): marketing email and any non-essential cookie or similar storage. Consent is optional, and you can withdraw it at any time without affecting the lawfulness of processing carried out before you withdrew it.
• Legitimate interests, Article 6(1)(f): securing the Service, preventing fraud and abuse of credits and coupons, and maintaining technical logs. The Operator balances these interests against your rights and keeps the data involved to a minimum.

Under Israeli law, the corresponding basis is your informed consent to the terms of this policy when you register and use the Service, together with the Operator's legal duties.

The Service keeps a small amount of information in your browser. This is the full inventory of what it sets:

• Authentication session: keeps you signed in between pages and reloads. Strictly necessary.
• Theme preference: remembers light or dark mode. Strictly necessary for the interface to render as you chose.
• Language preference: remembers the locale you selected. Strictly necessary.
• Region cache: stores the region resolved for pricing and tax display, so it is not looked up on every page. Strictly necessary.
• Accessibility settings: stores the adjustments you make in the accessibility widget. Strictly necessary.
• Cookie consent record: stores your consent choice, the time it was given and the policy version it applies to. Strictly necessary, and required so we do not ask you again.

No analytics storage and no advertising or marketing storage are in use today. If that ever changes, the categories described in the next section will be activated, the policy version will be raised, and you will be asked again before anything non-essential is set.

Data is never sold. It is shared only with service providers acting as processors on the Operator's documented instructions, each for a defined role:

• Hosting, database, authentication and file storage: Lovable Cloud, running on Supabase infrastructure. Holds account data, projects, images, credits and payment records.
• AI image generation: OpenAI. Your uploaded screenshots, or the regions of them you select, are transmitted to be processed into mockups, together with the prompt describing the scene. Business API processing is not used to train the provider's models.
• Website capture: the capture provider that renders a public web address into a screenshot when you ask the Service to capture a URL. It receives the address, not your account content.
• Payment processing and tax documents: Tranzila. Receives the transaction data needed to take payment and to issue an invoice or receipt. Card details go to it directly.
• Email delivery: Resend. Receives your email address and the message content for transactional and, where you consented, marketing email.
• IP geolocation: the geolocation service queried to resolve the country of a request for pricing and VAT purposes. Receives the IP address of the request only.

Data may also be disclosed where the law requires it, for example to a competent authority or a court, and to professional advisers bound by confidentiality.

Data is kept only as long as it serves the purpose it was collected for:

• Account data, projects, uploaded screenshots and generated mockups: for as long as your account exists. Deleting a project deletes its images.
• Accounting, invoicing and tax records, including the buyer country and the basis on which it was resolved: seven years, as required by Israeli tax and bookkeeping rules. These records survive account deletion because the law requires it.
• Consent records, both marketing and cookie consent: for as long as the consent is relied on and for a reasonable period afterwards, as evidence that it was properly obtained.
• Technical and security logs: a short period, normally no more than twelve months, unless a specific security incident requires keeping them longer.

You can delete your account from the profile page in the product. Deletion removes your account, projects, uploaded screenshots and generated images, and anonymises what must be retained for legal reasons.

Under the GDPR and, in their Israeli equivalents, under sections 13 and 14 of the Privacy Protection Law as expanded by Amendment No. 13, you have the right to:

• Access the personal data held about you and receive a copy of it.
• Have inaccurate, incomplete or outdated data corrected.
• Have your data erased where there is no lawful reason to keep it.
• Restrict processing while a dispute about accuracy or lawfulness is resolved.
• Receive the data you provided in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible.
• Object to processing based on legitimate interests, including profiling, and to object to direct marketing at any time.
• Withdraw any consent at any time, through the unsubscribe link in every marketing email, the cookie settings link in the footer, or by writing to us.

To exercise any of these rights, write to ejarmon.design@gmail.com. The Operator answers within one month, and will say so if that period needs to be extended for a complex request. You may also complain to the Israeli Privacy Protection Authority, or, if you are in the EU, to the supervisory authority of your country of residence, place of work, or the place where you believe an infringement occurred.