This policy explains how PSDmate collects, uses, and protects your data in compliance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "EU GDPR"), the UK GDPR, and the UK Data Protection Act 2018.
1. Who We Are
PSDmate is operated by PSDmate, United Kingdom. We are the data controller. Contact: PSDmate@proton.me.
2. Data We Collect
| Category | Examples | Purpose |
|---|---|---|
| Account data | Email, name | Authentication via Clerk |
| Uploaded files | PSD templates, artwork images | Mockup generation; stored in S3 |
| Generated outputs | Mockup images, videos | Delivery and history |
| Third-party tokens | Etsy OAuth token, API keys | Listing automation |
| Usage data | Generation counts, feature usage | Service operation, billing |
| Payment data | Billing info | Processed by Stripe (we do not store card data) |
We do not sell your data to third parties.
3. Legal Basis (Art. 6 GDPR)
- Contract performance — processing files to generate mockups
- Legitimate interests — usage analytics, abuse prevention
- Consent — email marketing (opt-in only)
- Legal obligation — fraud prevention, tax records
4. Third-Party Processors
| Processor | Purpose | Location |
|---|---|---|
| Clerk | Authentication | USA (SCCs) |
| Amazon S3 (eu-west-2) | File storage | EU |
| Supabase | Database | EU |
| Stripe | Payments | USA (SCCs) |
| OpenAI / Stability AI / etc. | AI generation (if you use AI features) | USA (SCCs) |
| Etsy | Listing automation (if connected) | USA (SCCs) |
| Vercel | Hosting / CDN | USA (SCCs) |
| Amazon EC2 (eu-west-2) | Backend compute | EU |
| PostHog (EU Cloud) | Product analytics, usage insights, service improvement | EU |
Where personal data of EU users is transferred outside the EEA, the transfer is protected by appropriate safeguards under Chapter V GDPR: the European Commission's Standard Contractual Clauses (and, where applicable, the EU–US Data Privacy Framework) for US processors, and the EU's adequacy decision for the United Kingdom for data we process in the UK.
5. Data Retention
- Uploaded files and generated outputs: retained while your account is active, deleted 30 days after account deletion.
- Etsy/API tokens: deleted immediately on revocation or account deletion.
- Payment records: retained 7 years for tax compliance.
6. Your Rights (Art. 15–22 GDPR)
You have the right to: access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, objection, and to withdraw consent at any time (without affecting prior processing). You can download a machine-readable copy of your data, and delete your account and all associated data, from Settings → Data & Privacy. You can also email PSDmate@proton.me to exercise any right; we respond within one month (Art. 12(3)).
If you are in the EU/EEA, you have the right to lodge a complaint with your local data protection supervisory authority (a list is available at edpb.europa.eu). If you are in the UK, you may complain to the ICO (ico.org.uk).
7. Security
Data is encrypted in transit (TLS) and at rest (AES-256 on S3 and Supabase). API keys you store are encrypted before being written to our database.
8. Cookies & Analytics
We use only essential session cookies set by Clerk for authentication. We do not use advertising cookies. We use PostHog (EU Cloud) for privacy-friendly product analytics — it records how users interact with the app (such as pages visited, features used, and buttons clicked) so we can understand usage patterns, fix problems, and improve the product. It runs in cookieless mode (no tracking cookies), is not used for advertising, and we do not sell or share this data. The legal basis is our legitimate interest in operating and improving the service. You can object to analytics processing at any time by contacting PSDmate@proton.me.
9. Children
PSDmate is not directed at persons under 18. We do not knowingly collect data from minors.
10. Changes
Material changes will be notified by email or in-app notice at least 14 days before taking effect.