Privacy Policy

1. Scope

This Privacy Policy applies to personal data we collect when you:

• visit our website
• create an account
• subscribe to a paid plan
• use the Service
• upload content or generate outputs
• contact us
• interact with billing, support, or security systems

This Privacy Policy does not apply to third-party websites, products, or services that may link to or integrate with the Service.

2. Personal data we collect

2.1 Account data

When you create an account or sign in, we may collect:

• email address
• name
• profile image
• authentication provider identifiers
• account preferences
• account status
• subscription entitlement data

Some information may be provided by third-party login providers such as Google or other supported authentication providers.

2.2 Payment and billing data

Payments are processed by third-party providers such as Stripe. We do not receive or store full card numbers.

For subscriptions purchased from 27 August 2026, Link (a Stripe service) acts as the merchant of record and is the seller for the transaction. Link collects your payment details, billing name and address, and any tax identifier you provide, in order to take payment and to account for applicable taxes. Link determines how it uses that transaction data for those purposes, so it acts as an independent controller rather than only on our behalf, and its own privacy policy applies to that processing.

You may be offered the option to create a Link account at checkout. A Link account is provided by Link and governed by its privacy policy, not this one.

We may receive and store:

• billing name
• billing email
• country
• VAT or tax identifiers where applicable
• subscription plan
• renewal dates
• payment status
• transaction identifiers
• invoice metadata
• Stripe customer and subscription IDs

2.3 Usage, device and analytics data

When you use the Service, we may automatically collect:

• IP address
• browser type
• device type
• operating system
• approximate location derived from IP
• pages visited
• feature usage
• timestamps
• referring URLs
• performance metrics
• crash logs
• diagnostic logs
• abuse-prevention signals
• rate-limit data

We may also use privacy-focused analytics and performance tools, including Vercel Analytics or similar providers, to understand product usage, traffic sources, page performance, and technical issues.

We use this information to operate the Service, secure accounts, prevent abuse, troubleshoot issues, and improve the Service.

2.4 Content you upload or create

We may process content you upload, import, edit, or generate through the Service, such as:

• screenshots
• images
• logos
• designs
• mockups
• exported assets
• project files
• prompts
• settings
• configuration data

We process this content solely to provide and improve the Service, store projects, generate outputs, and support requested features.

Browser capture extension

When you choose to capture a browser tab with the Ultramock browser extension, it processes its visible content as a screenshot or silent video, together with the source page URL, title, dimensions and recording details. The extension saves source metadata only for captures you request; it does not access your browser history or track general browsing. It does not record your microphone or webcam. If an AI agent you have connected to Ultramock asks your editor to capture a website, the extension opens that page in a new tab and captures nothing until you click its icon on that tab.

Cursor, cleanup and scrolling controls process pointer position, clicks and scroll state locally on the selected page. These interactions operate the requested controls and are not retained as a separate activity log or sent to an analytics service. Visible cursor movement and page interactions may appear in the recording you choose to capture.

The optional Device frame setting uses Chrome's debugger permission so captures can be taken at a device's full resolution. It is used only for a capture you start with a Device frame selected, either by you or by an editor capture request you then start by clicking the extension icon. For the duration of that capture it renders the tab at the device's screen size, adds space at the top of the page for a phone's status bar, and takes the framed screenshot. During a framed recording it also watches for the tab moving to a new page, so the device size can be applied to that page too; the addresses of those pages are not stored or sent anywhere. It attaches when the capture starts, removes that space and detaches when it ends. To keep that space correct it runs a small script in the page that reads element layout and colours, so fixed headers can be shifted down and the band above them tinted to match, and it undoes those style changes when the capture ends. It does not read page text, form input, network traffic or storage. The list of devices is downloaded from ultramock.io about once a day; that request contains no capture content or page data.

Capture data is temporarily stored in your browser and transferred locally to the Ultramock editor. Temporary extension copies are removed after acknowledgement or cancellation, or cleaned up after expiry. Imported recordings remain in this browser on this device until removed; clearing browser storage can remove them. Images and project data saved through the editor follow the Service’s storage practices described in this policy.

The extension does not send capture content to advertising or analytics services, sell it, or use it for credit decisions. Capture access is used to provide the capture and import features you request. The extension itself has no remote capture-upload service.

Chrome Web Store Limited Use

Our use of data obtained through the Ultramock browser extension complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. The following restrictions apply to extension data, including after import into the editor, and take precedence over broader uses described elsewhere in this policy.

We use extension data only to provide and support the capture, import and editing features you request. We do not use or transfer it for advertising, unrelated profiling, creditworthiness or lending. Transfers are limited to those necessary for these features, security, legal obligations, or a merger, acquisition or sale of assets, as permitted by the Limited Use policy.

We do not permit staff or service providers to read extension data except with your explicit consent for specific content, when necessary for security or legal compliance, or when aggregated and anonymised for internal operations as permitted by the Limited Use policy.

2.5 Communications

If you contact us by email, contact form, support channels, or social channels, we may collect:

• name
• email address
• message contents
• attachments
• support history
• related technical details needed to resolve issues

3. How we use personal data

We use personal data for purposes including:

• creating and managing accounts
• authenticating users
• processing subscriptions and payments
• providing paid and free features
• storing projects and outputs
• generating exports and renders
• customer support
• sending transactional emails
• fraud prevention and abuse detection
• enforcing limits and Terms of Service
• analytics and performance monitoring
• debugging and error resolution
• improving features and user experience
• complying with legal obligations
• responding to lawful requests
• protecting our rights, users, and systems

4. Legal bases for processing (UK GDPR / EU GDPR)

Where applicable, we rely on the following legal bases:

Contract

Where processing is necessary to provide the Service, manage subscriptions, authenticate access, process payments, or provide support.

Legitimate interests

Where necessary for:

• security
• fraud prevention
• abuse detection
• enforcing usage limits
• improving the Service
• internal analytics
• system administration
• defending legal claims

We balance these interests against your rights and freedoms.

Legal obligation

Where required to comply with tax, accounting, consumer protection, fraud prevention, or other legal obligations.

Consent

Where required by law for optional processing activities. You may withdraw consent at any time.

5. How we share personal data

We do not sell personal data.

We may share personal data with trusted service providers that help us operate the Service, including:

• payment processors
• hosting providers
• infrastructure providers
• database providers
• authentication providers
• email delivery providers
• analytics providers
• error monitoring providers
• customer support tools
• security and fraud prevention tools

Examples may include Stripe, Vercel, Google, and other providers we use from time to time.

These providers process data on our behalf under contractual safeguards.

Link is an exception. Where it acts as the merchant of record for your purchase, it is the seller for that transaction and decides how it processes the resulting payment and tax data. It is an independent controller of that data rather than a provider acting on our behalf.

We may also disclose personal data:

• where required by law
• to enforce our rights
• to prevent fraud or security threats
• in connection with a merger, acquisition, financing, or sale of assets

6. International transfers

Some service providers may process personal data outside the UK, EEA, or your country of residence.

Where required by law, we use appropriate safeguards such as:

• Standard Contractual Clauses
• UK International Data Transfer Addendum
• adequacy regulations
• supplementary technical and organisational measures where appropriate

7. Cookies and similar technologies

We use cookies and similar technologies for purposes such as:

• authentication
• session management
• security
• remembering preferences
• fraud prevention
• essential product functionality
• limited analytics where permitted

Some cookies are strictly necessary and may not require consent under applicable law.

Where consent is legally required for non-essential cookies or similar technologies, we will request it through appropriate consent tools.

You can also manage cookies through your browser settings.

7.1 Product analytics

We run our own product analytics to understand how people find and use Ultramock, for example which pages lead people to the editor, and where they stop. It is first-party: the data stays with us and is never sold, shared with advertisers, or used to track you on other websites.

What we collect:

• pages you visit on ultramock.io, and the site, page or campaign that brought you
• which sections of our website pages were on screen, and for how long
• how far down a page you scrolled
• clicks on our own links and buttons, questions opened in our FAQs, and whether you played our product video
• in the editor, what kind of action you take (for example “added media”, “changed the camera”, “animated”, “exported”, “saw the upgrade screen”), never the content of anything you upload or create
• your country, device type and browser family
• if you have an account: whether a visit led to signing up or subscribing, which plan, and whether you were on the Free or Pro plan at the time

We do not store your IP address or your full browser identification string for analytics, and we do not record keystrokes, form entries or screen recordings.

What happens depends on where you are:

• Where the law allows analytics without consent (including the United States): we set a first-party cookie (um_vid) that recognises your browser across visits for up to 12 months. If you have an account, your visits are linked to it. You can turn this off below.
• The United Kingdom, France, Spain, Italy and the Netherlands: we ask first. Until you accept, we only count visits anonymously: nothing is stored on your device, the counts are never linked to you or your account, the individual events are deleted within 48 hours, and only an anonymous summary of each visit is kept (for example its country, device, pages and the kinds of action taken). You can turn those anonymous counts off too.
• Everywhere else consent is required (including the rest of the EU and EEA, and Quebec): we ask first, and collect nothing unless you accept.

If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as a refusal and collect nothing. Your choice is remembered with a cookie (um_consent or um_optout) that only records the choice itself; we ask again after 6 months if you refused, and after 12 months if you accepted.

We rely on legitimate interests (improving the Service) for anonymous counts, and on your consent where it is required. Individual analytics events are deleted after 30 days, and anonymous ones within 48 hours. We keep a short summary of each visit (for example the pages and sections seen and the kinds of action taken). If you have an account it is linked to it and deleted with it. Without an account, a summary stops being linked to your browser after 13 months. Summaries of anonymous visits are never linked to anyone. Deleting your account deletes the analytics linked to it.

8. Data retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including legal, operational, security, fraud-prevention, accounting, and contractual purposes.

Typical retention periods may include:

• account data: while your account remains active and for a reasonable period after closure
• projects: while you have Pro; if your plan ends, for at least 12 months after that, and we email you before they are deleted
• billing and tax records: for periods required by law
• support records: for operational, dispute-resolution, and legal needs
• usage logs and diagnostics: for security, debugging, abuse prevention, and product improvement needs
• product analytics: individual events 30 days (anonymous: 48 hours); per-visit summaries are kept, unlinked from your browser after 13 months and deleted with your account
• backups: until overwritten or deleted through normal backup cycles

Where reasonably practicable, we delete, anonymise, or de-identify personal data when no longer needed.

Some data may be retained longer where required by law, to resolve disputes, prevent abuse, enforce agreements, or protect legal rights.

9. Your privacy rights

Depending on your location, you may have rights regarding your personal data.

These may include the right to:

• access your data
• correct inaccurate data
• request deletion
• restrict processing
• object to certain processing
• withdraw consent
• receive a portable copy of your data
• complain to a supervisory authority
• appeal certain privacy decisions where applicable

To exercise a rights request, contact privacy@ultramock.io.

We may need to verify your identity before fulfilling requests.

We will respond in accordance with applicable law.

Where Link is the merchant of record for your purchases, you can also ask Stripe to delete the data held for those transactions. Doing so cancels any subscription sold through Link and deletes the associated payment records, so please make a request to us first if you want to keep your subscription active.

10. US state privacy rights

Residents of certain US states, including California, may have additional privacy rights under applicable law.

These may include rights to:

• know categories of data collected
• access specific data
• correct data
• delete data
• opt out of certain sharing or targeted advertising
• non-discrimination for exercising rights
• appeal denied requests where applicable

We do not sell or share personal information, as those terms are defined under applicable US privacy laws, and we do not use it for targeted advertising.

We honour Global Privacy Control and Do Not Track signals: when your browser sends either, our product analytics are switched off for you (see section 7.1).

To make a request, contact privacy@ultramock.io.

11. Children

The Service is not intended for children under 16.

We do not knowingly collect personal data from children under 16.

If you believe a child has provided personal data, contact us and we will take appropriate steps.

12. Security

We use reasonable technical, administrative, and organisational safeguards designed to protect personal data.

These may include:

• encrypted connections (TLS)
• access controls
• credential management
• monitoring and logging
• least-privilege practices
• managed hosting safeguards
• secure payment processing through providers

No system is completely secure, and we cannot guarantee absolute security.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

If we make material changes, we may notify users through email, in-product notice, or by updating the date at the top of this page.

Your continued use of the Service after changes take effect means you acknowledge the updated Privacy Policy.

14. Contact

For privacy-related questions or requests: privacy@ultramock.io

For legal or general enquiries: legal@ultramock.io