This policy explains how PSDmate collects, uses, and protects your data in compliance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "EU GDPR"), the UK GDPR, and the UK Data Protection Act 2018.
1. Who We Are
PSDmate is a trading name of a sole trader operating from Bristol, England, and is the data controller for the personal data described below. Our address for service is 5 Brayford Square, London, E1 0SG, United Kingdom. Contact: PSDmate@proton.me or psdmate.com/contact.
2. Data We Collect
| Category | Examples | Purpose |
|---|---|---|
| Account data | Email, name | Authentication via Clerk |
| Uploaded files | PSD templates, artwork images | Mockup generation; stored in S3 |
| Generated outputs | Mockup images, videos | Delivery and history |
| Third-party tokens | Etsy OAuth token, API keys | Listing automation |
| Usage data | Generation counts, feature usage | Service operation, billing |
| Payment data | Billing info | Processed by Stripe (we do not store card data) |
We do not sell your data to third parties.
3. Legal Basis (Art. 6 GDPR)
- Contract performance — processing files to generate mockups
- Legitimate interests — usage analytics, abuse prevention
- Consent — email marketing (opt-in only)
- Legal obligation — fraud prevention, tax records
4. Third-Party Processors
| Processor | Purpose | Location |
|---|---|---|
| Clerk | Authentication, account identity | USA (UK IDTA / EU SCCs) |
| Supabase | Database | EU |
| Amazon S3 (eu-west-2) | File storage — artwork, PSDs, renders | EU |
| Amazon EC2 (eu-west-2) | Render service | EU |
| Vercel | Hosting / CDN | USA (UK IDTA / EU SCCs) |
| Stripe | Payments and subscription billing | USA (UK IDTA / EU SCCs) |
| Resend | Transactional and lifecycle email delivery | USA (UK IDTA / EU SCCs) |
| OpenRouter | AI image generation, listing copy, subject detection (image + prompt) | USA (UK IDTA / EU SCCs) |
| Google (Gemini API) | Vision fallback for subject detection | USA (UK IDTA / EU SCCs) |
| Your own AI provider keys | Where you supply a key (OpenAI, Stability, Replicate, AIML, OpenRouter), requests go to that provider under your own account | Varies |
| Etsy | Listing publication, orders, stats (if connected) | USA (UK IDTA / EU SCCs) |
| Pin publication (if connected) | USA (UK IDTA / EU SCCs) | |
| Google (Drive, OAuth) | Importing artwork from your Drive (if connected) | USA (UK IDTA / EU SCCs) |
| Discord | Bot capture and community linking (if connected) | USA (UK IDTA / EU SCCs) |
| PrintShrimp | Print fulfilment (if you use it) | UK / EU |
| Cloudflare Turnstile | Bot protection on public forms | USA (UK IDTA / EU SCCs) |
| Google Analytics | Site analytics — only with your cookie consent | USA (UK IDTA / EU SCCs) |
| PostHog (EU Cloud) | Product analytics, usage insights | EU |
Where personal data of EU users is transferred outside the EEA, the transfer is protected by appropriate safeguards under Chapter V GDPR: the UK International Data Transfer Agreement (or the UK Addendum to the European Commission's Standard Contractual Clauses) for transfers from the UK, the Commission's Standard Contractual Clauses for transfers from the EEA, and — where the receiving organisation is certified — the EU–US Data Privacy Framework together with its UK Extension. The EU's adequacy decision for the United Kingdom covers data we process in the UK.
5. Data Retention
- Uploaded files and generated outputs: retained while your account is active, deleted 30 days after account deletion.
- Etsy/API tokens: deleted immediately on revocation or account deletion.
- Payment records: retained 7 years for tax compliance.
6. Your Rights (Art. 15–22 GDPR)
You have the right to: access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, objection, and to withdraw consent at any time (without affecting prior processing). You can download a machine-readable copy of your data, and delete your account and all associated data, from Settings → Data & Privacy. You can also email PSDmate@proton.me or use the contact form to exercise any right; we respond within one month (Art. 12(3)).
If you are in the EU/EEA, you have the right to lodge a complaint with your local data protection supervisory authority (a list is available at edpb.europa.eu). If you are in the UK, you may complain to the ICO (ico.org.uk).
7. Security
Data is encrypted in transit (TLS) and at rest (AES-256 on S3 and Supabase). API keys you store are encrypted before being written to our database.
8. Cookies & Analytics
Essential cookies. Session cookies set by Clerk for authentication. These are required to sign in and cannot be turned off. We do not use advertising cookies.
Product analytics (no cookies). We use PostHog (EU Cloud) to record how the app is used — pages visited, features used, buttons clicked — so we can understand usage patterns, fix problems and improve the product. It runs in cookieless mode: nothing is stored on your device. It is not used for advertising, and we do not sell or share this data. The legal basis is our legitimate interest in operating and improving the service.
Google Analytics (cookies), only if you accept. Where enabled, Google Analytics sets its own cookies on your device to measure traffic. Because it stores data on your device, it does not load at all unless you accept it on the banner shown on your first visit. Declining, or simply not answering, means it never loads.
Changing your mind. Your choice is remembered in your browser and can be changed at any time in Settings → Data & Privacy, which turns off both Google Analytics and product analytics. You can also object by emailing PSDmate@proton.me or using the contact form. Because the choice lives in your browser's storage, clearing site data will make the banner ask again.
9. Children
PSDmate is not directed at persons under 18. We do not knowingly collect data from minors.
10. Changes
Material changes will be notified by email or in-app notice at least 14 days before taking effect.
11. Contact
PSDmate@proton.me
psdmate.com/contact