Privacy Policy

duomock (“we”, “us”) is run by Asad Shuja, based in England. Asad Shuja is the controller of the personal data described here under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For anything about your data, email support@duomock.com.

The images and videos you add to duomock stay on your device. The studio renders your mockup in your browser and exports are made there too. We never upload, store or see the screenshots you drop in or the files you export.

A share link holds the scene settings (device, camera, colours, text) inside the link itself. It does not include images you added, and the part of the link holding the scene is never sent to our servers.

If you sign in: your email address, the sign-in codes we send you (stored only in scrambled form, and expiring after 10 minutes), and your session: when it started and ends, your IP address and your browser’s user agent. The first time you sign in, we create an account with your email address.

If you subscribe to Pro: Stripe takes your payment details directly, so we never see or store your card number. We keep your Stripe customer ID and your subscription’s plan, status, renewal date and any cancellation date. Stripe shares your name, billing country and email with us as part of the purchase.

When you use the site: anonymous usage analytics through PostHog. This covers pages visited, actions such as exporting, applying a template or starting checkout, device and browser type, where you came from, and heatmaps of where people click. It sets no cookies. To count unique visitors, PostHog combines your IP address and browser details into a scrambled daily code on its servers and doesn’t store your IP address. We don’t record your sessions, and analytics aren’t linked to your account.

If you email us: your message and address, to reply.

• To sign you in and give you Pro: your email, session and subscription details. Our legal basis is contract: we need them to provide the service you asked for.
• To take payment, keep financial records and handle refunds and disputes: our basis is contract and legal obligation, since UK tax law requires us to keep records.
• To email you about your account: sign-in codes and notices such as a cancellation confirmation. Our basis is contract. We don’t send marketing email.
• To understand how duomock is used and make it better: anonymous analytics and heatmaps. Our basis is legitimate interests in improving the product.
• To keep the service secure: rate limits on sign-in attempts and logs used to stop abuse. Our basis is legitimate interests.

Essential: a session cookie keeps you signed in. Local storage in your browser remembers small preferences such as light or dark mode and hints you’ve already seen.

No tracking cookies. Our analytics run in PostHog’s cookieless mode, so they don’t store anything in your browser.

We don’t sell your data. We share it only with the service providers that run duomock for us, under contracts that limit what they may do with it:

• Vercel: hosts the website and handles requests to it.
• Neon: our database, hosted on Amazon Web Services in the United States. It holds accounts, sessions and subscription records.
• Stripe: payments, invoices, and the page where you manage your subscription. Stripe is also responsible in its own right for some payment data. See Stripe’s privacy policy.
• Resend: sends our emails.
• PostHog: anonymous analytics and heatmaps, hosted in the European Union.

We may also disclose data when the law requires it, or to protect our rights or someone’s safety.

Some of these providers process data in the United States. Where they do, the transfer is covered by UK safeguards: the UK Extension to the EU–US Data Privacy Framework, or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

• Sign-in codes: until used or expired (10 minutes).
• Sessions: until you sign out or 60 days after your last visit.
• Your account: until you ask us to delete it.
• Payment and subscription records: six years after the tax year they relate to, as UK tax law requires.
• Analytics: kept by PostHog for its standard retention period, and no longer than we need them.

You can ask to access, correct or delete your personal data, to restrict or object to how we use it, and to receive it in a portable format. To make a request, email support@duomock.com from the address on your account. We’ll reply within one month. If you ask us to delete your account, we delete it and your sessions and keep only the payment records the law requires.

You can cancel Pro at any time from Manage subscription in the studio.

If you’re unhappy with how we handle your data, please tell us first. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk.

duomock isn’t aimed at children, and you must be 13 or older to create an account. If you believe a child has given us personal data, email us and we’ll delete it.

If we change this policy, we’ll update the date at the top. If a change is significant, we’ll tell signed-in users by email before it takes effect.