Privacy Policy

1. Scope

This Privacy Policy applies to personal data we collect when you:

• visit our website
• create an account
• subscribe to a paid plan
• use the Service
• upload content or generate outputs
• contact us
• interact with billing, support, or security systems

This Privacy Policy does not apply to third-party websites, products, or services that may link to or integrate with the Service.

2. Personal data we collect

2.1 Account data

When you create an account or sign in, we may collect:

• email address
• name
• profile image
• authentication provider identifiers
• account preferences
• account status
• subscription entitlement data

Some information may be provided by third-party login providers such as Google or other supported authentication providers.

2.2 Payment and billing data

Payments are processed by third-party providers such as Stripe. We do not receive or store full card numbers.

For subscriptions purchased from 27 August 2026, Link (a Stripe service) acts as the merchant of record and is the seller for the transaction. Link collects your payment details, billing name and address, and any tax identifier you provide, in order to take payment and to account for applicable taxes. Link determines how it uses that transaction data for those purposes, so it acts as an independent controller rather than only on our behalf, and its own privacy policy applies to that processing.

You may be offered the option to create a Link account at checkout. A Link account is provided by Link and governed by its privacy policy, not this one.

We may receive and store:

• billing name
• billing email
• country
• VAT or tax identifiers where applicable
• subscription plan
• renewal dates
• payment status
• transaction identifiers
• invoice metadata
• Stripe customer and subscription IDs

2.3 Usage, device and analytics data

When you use the Service, we may automatically collect:

• IP address
• browser type
• device type
• operating system
• approximate location derived from IP
• pages visited
• feature usage
• timestamps
• referring URLs
• performance metrics
• crash logs
• diagnostic logs
• abuse-prevention signals
• rate-limit data

We may also use privacy-focused analytics and performance tools, including Vercel Analytics or similar providers, to understand product usage, traffic sources, page performance, and technical issues.

We use this information to operate the Service, secure accounts, prevent abuse, troubleshoot issues, and improve the Service.

2.4 Content you upload or create

We may process content you upload, import, edit, or generate through the Service, such as:

• screenshots
• images
• logos
• designs
• mockups
• exported assets
• project files
• prompts
• settings
• configuration data

We process this content solely to provide and improve the Service, store projects, generate outputs, and support requested features.

Browser capture extension

When you choose to capture a browser tab with the Ultramock browser extension, it processes its visible content as a screenshot or silent video, together with the source page URL, title, dimensions and recording details. The extension saves source metadata only for captures you request; it does not access your browser history or track general browsing. It does not record your microphone or webcam.

Cursor, cleanup and scrolling controls process pointer position, clicks and scroll state locally on the selected page. These interactions operate the requested controls and are not retained as a separate activity log or sent to an analytics service. Visible cursor movement and page interactions may appear in the recording you choose to capture.

Capture data is temporarily stored in your browser and transferred locally to the Ultramock editor. Temporary extension copies are removed after acknowledgement or cancellation, or cleaned up after expiry. Imported recordings remain in this browser on this device until removed; clearing browser storage can remove them. Images and project data saved through the editor follow the Service’s storage practices described in this policy.

The extension does not send capture content to advertising or analytics services, sell it, or use it for credit decisions. Capture access is used to provide the capture and import features you request. The extension itself has no remote capture-upload service.

Chrome Web Store Limited Use

Our use of data obtained through the Ultramock browser extension complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. The following restrictions apply to extension data, including after import into the editor, and take precedence over broader uses described elsewhere in this policy.

We use extension data only to provide and support the capture, import and editing features you request. We do not use or transfer it for advertising, unrelated profiling, creditworthiness or lending. Transfers are limited to those necessary for these features, security, legal obligations, or a merger, acquisition or sale of assets, as permitted by the Limited Use policy.

We do not permit staff or service providers to read extension data except with your explicit consent for specific content, when necessary for security or legal compliance, or when aggregated and anonymised for internal operations as permitted by the Limited Use policy.

2.5 Communications

If you contact us by email, contact form, support channels, or social channels, we may collect:

• name
• email address
• message contents
• attachments
• support history
• related technical details needed to resolve issues

3. How we use personal data

We use personal data for purposes including:

• creating and managing accounts
• authenticating users
• processing subscriptions and payments
• providing paid and free features
• storing projects and outputs
• generating exports and renders
• customer support
• sending transactional emails
• fraud prevention and abuse detection
• enforcing limits and Terms of Service
• analytics and performance monitoring
• debugging and error resolution
• improving features and user experience
• complying with legal obligations
• responding to lawful requests
• protecting our rights, users, and systems

4. Legal bases for processing (UK GDPR / EU GDPR)

Where applicable, we rely on the following legal bases:

Contract

Where processing is necessary to provide the Service, manage subscriptions, authenticate access, process payments, or provide support.

Legitimate interests

Where necessary for:

• security
• fraud prevention
• abuse detection
• enforcing usage limits
• improving the Service
• internal analytics
• system administration
• defending legal claims

We balance these interests against your rights and freedoms.

Legal obligation

Where required to comply with tax, accounting, consumer protection, fraud prevention, or other legal obligations.

Consent

Where required by law for optional processing activities. You may withdraw consent at any time.

5. How we share personal data

We do not sell personal data.

We may share personal data with trusted service providers that help us operate the Service, including:

• payment processors
• hosting providers
• infrastructure providers
• database providers
• authentication providers
• email delivery providers
• analytics providers
• error monitoring providers
• customer support tools
• security and fraud prevention tools

Examples may include Stripe, Vercel, Google, and other providers we use from time to time.

These providers process data on our behalf under contractual safeguards.

Link is an exception. Where it acts as the merchant of record for your purchase, it is the seller for that transaction and decides how it processes the resulting payment and tax data. It is an independent controller of that data rather than a provider acting on our behalf.

We may also disclose personal data:

• where required by law
• to enforce our rights
• to prevent fraud or security threats
• in connection with a merger, acquisition, financing, or sale of assets

6. International transfers

Some service providers may process personal data outside the UK, EEA, or your country of residence.

Where required by law, we use appropriate safeguards such as:

• Standard Contractual Clauses
• UK International Data Transfer Addendum
• adequacy regulations
• supplementary technical and organisational measures where appropriate

7. Cookies and similar technologies

We use cookies and similar technologies for purposes such as:

• authentication
• session management
• security
• remembering preferences
• fraud prevention
• essential product functionality
• limited analytics where permitted

Some cookies are strictly necessary and may not require consent under applicable law.

Where consent is legally required for non-essential cookies or similar technologies, we will request it through appropriate consent tools.

You can also manage cookies through your browser settings.

8. Data retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including legal, operational, security, fraud-prevention, accounting, and contractual purposes.

Typical retention periods may include:

• account data: while your account remains active and for a reasonable period after closure
• billing and tax records: for periods required by law
• support records: for operational, dispute-resolution, and legal needs
• usage logs and diagnostics: for security, debugging, abuse prevention, and product improvement needs
• backups: until overwritten or deleted through normal backup cycles

Where reasonably practicable, we delete, anonymise, or de-identify personal data when no longer needed.

Some data may be retained longer where required by law, to resolve disputes, prevent abuse, enforce agreements, or protect legal rights.

9. Your privacy rights

Depending on your location, you may have rights regarding your personal data.

These may include the right to:

• access your data
• correct inaccurate data
• request deletion
• restrict processing
• object to certain processing
• withdraw consent
• receive a portable copy of your data
• complain to a supervisory authority
• appeal certain privacy decisions where applicable

To exercise a rights request, contact privacy@ultramock.io.

We may need to verify your identity before fulfilling requests.

We will respond in accordance with applicable law.

Where Link is the merchant of record for your purchases, you can also ask Stripe to delete the data held for those transactions. Doing so cancels any subscription sold through Link and deletes the associated payment records, so please make a request to us first if you want to keep your subscription active.

10. US state privacy rights

Residents of certain US states, including California, may have additional privacy rights under applicable law.

These may include rights to:

• know categories of data collected
• access specific data
• correct data
• delete data
• opt out of certain sharing or targeted advertising
• non-discrimination for exercising rights
• appeal denied requests where applicable

We do not sell personal data as commonly defined under applicable US privacy laws.

To make a request, contact privacy@ultramock.io.

11. Children

The Service is not intended for children under 16.

We do not knowingly collect personal data from children under 16.

If you believe a child has provided personal data, contact us and we will take appropriate steps.

12. Security

We use reasonable technical, administrative, and organisational safeguards designed to protect personal data.

These may include:

• encrypted connections (TLS)
• access controls
• credential management
• monitoring and logging
• least-privilege practices
• managed hosting safeguards
• secure payment processing through providers

No system is completely secure, and we cannot guarantee absolute security.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

If we make material changes, we may notify users through email, in-product notice, or by updating the date at the top of this page.

Your continued use of the Service after changes take effect means you acknowledge the updated Privacy Policy.

14. Contact

For privacy-related questions or requests: privacy@ultramock.io

For legal or general enquiries: legal@ultramock.io