This policy explains how PSDmate collects, uses, and protects your data in compliance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "EU GDPR"), the UK GDPR, and the UK Data Protection Act 2018.
1. Who We Are
PSDmate is a trading name of a sole trader operating from Bristol, England, and is the data controller for the personal data described below. Our address for service is 5 Brayford Square, London, E1 0SG, United Kingdom. Contact: PSDmate@proton.me or psdmate.com/contact.
2. Data We Collect
| Category | Examples | Purpose |
|---|---|---|
| Account data | Email, name | Authentication via Clerk |
| Uploaded files | PSD templates, artwork images | Mockup generation; stored in S3 |
| Generated outputs | Mockup images, videos | Delivery and history |
| Third-party tokens | Etsy OAuth token, API keys | Listing automation |
| Usage data | Generation counts, feature usage | Service operation, billing |
| Payment data | Billing info | Processed by Stripe (we do not store card data) |
We do not sell your data to third parties.
3. Legal Basis (Art. 6 GDPR)
- Contract performance — processing files to generate mockups
- Legitimate interests — abuse prevention, keeping the service secure
- Consent — product analytics and session recordings (opt-in only, see section 8); email marketing (opt-in only)
- Legal obligation — fraud prevention, tax records
4. Third-Party Processors
| Processor | Purpose | Location |
|---|---|---|
| Clerk | Authentication, account identity | USA (UK IDTA / EU SCCs) |
| Supabase | Database | EU |
| Amazon S3 (eu-west-2) | File storage — artwork, PSDs, renders | EU |
| Amazon EC2 (eu-west-2) | Render service | EU |
| Vercel | Hosting / CDN | USA (UK IDTA / EU SCCs) |
| Stripe | Payments and subscription billing | USA (UK IDTA / EU SCCs) |
| Resend | Transactional and lifecycle email delivery | USA (UK IDTA / EU SCCs) |
| OpenRouter | AI image generation, listing copy, subject detection (image + prompt) | USA (UK IDTA / EU SCCs) |
| Google (Gemini API) | Vision fallback for subject detection | USA (UK IDTA / EU SCCs) |
| Your own AI provider keys | Where you supply a key (OpenAI, Stability, Replicate, AIML, OpenRouter), requests go to that provider under your own account | Varies |
| Etsy | Listing publication, orders, stats (if connected) | USA (UK IDTA / EU SCCs) |
| Pin publication (if connected) | USA (UK IDTA / EU SCCs) | |
| Google (Drive, OAuth) | Importing artwork from your Drive (if connected) | USA (UK IDTA / EU SCCs) |
| Discord | Bot capture and community linking (if connected) | USA (UK IDTA / EU SCCs) |
| PrintShrimp | Print fulfilment (if you use it) | UK / EU |
| Cloudflare Turnstile | Bot protection on public forms | USA (UK IDTA / EU SCCs) |
| PostHog (EU Cloud) | Product analytics and session recordings (only with your permission) | EU |
Where personal data of EU users is transferred outside the EEA, the transfer is protected by appropriate safeguards under Chapter V GDPR: the UK International Data Transfer Agreement (or the UK Addendum to the European Commission's Standard Contractual Clauses) for transfers from the UK, the Commission's Standard Contractual Clauses for transfers from the EEA, and — where the receiving organisation is certified — the EU–US Data Privacy Framework together with its UK Extension. The EU's adequacy decision for the United Kingdom covers data we process in the UK.
5. Data Retention
- Uploaded files and generated outputs: retained while your account is active, deleted 30 days after account deletion.
- Etsy/API tokens: deleted immediately on revocation or account deletion.
- Payment records: retained 7 years for tax compliance.
6. Your Rights (Art. 15–22 GDPR)
You have the right to: access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, objection, and to withdraw consent at any time (without affecting prior processing). You can download a machine-readable copy of your data, and delete your account and all associated data, from Settings → Data & Privacy. You can also email PSDmate@proton.me or use the contact form to exercise any right; we respond within one month (Art. 12(3)).
If you are in the EU/EEA, you have the right to lodge a complaint with your local data protection supervisory authority (a list is available at edpb.europa.eu). If you are in the UK, you may complain to the ICO (ico.org.uk).
7. Security
Data is encrypted in transit (TLS) and at rest (AES-256 on S3 and Supabase). API keys you store are encrypted before being written to our database.
8. Cookies & Analytics
Essential cookies. Session cookies set by Clerk for authentication. These are required to sign in and cannot be turned off. We do not use advertising cookies.
Nothing optional runs until you say yes. When you first visit, a small prompt asks whether you allow analytics and session recording. Until you choose “Allow”, neither of the two things below happens: our analytics tool is not even loaded, and nothing is recorded. “No thanks” is as easy as “Allow”, and the site works exactly the same either way. Your answer is kept in your browser’s storage, which is used only to remember it.
Product analytics (with your permission). We use PostHog (EU Cloud) to see how the site and app are used — pages visited, features used, buttons clicked, loading speed and errors — so we can fix problems and improve the product. It runs without cookies, PostHog drops your IP address on arrival, and it is never used for advertising. We do not sell or share this data.
Session recordings (with your permission). PostHog also records how you use the site — mouse movements, clicks, scrolling and the pages you see — so we can watch where people get stuck. Everything you type into a form is hidden from the recording, and inside your account all text on the screen is hidden too, so your shop details and your buyers’ names, orders and addresses are never captured. Card details are entered on Stripe’s page and are never visible to the recorder. Recordings are stored by PostHog in the EU, kept for 30 days and then deleted, and only we can view them.
No advertising cookies, and no cookie wall. We do not use advertising or cross-site tracking cookies. Apart from Clerk’s sign-in cookies, this site sets no cookies.
Changing your mind. The legal basis for analytics and recordings is your consent. You can withdraw it at any time with the Analytics & session recording switch in Settings → Data & Privacy, which stops both immediately, or by emailing PSDmate@proton.me or using the contact form. Clearing your browser’s site data also resets your answer, and you will be asked again.
9. Children
PSDmate is not directed at persons under 18. We do not knowingly collect data from minors.
10. Changes
Material changes will be notified by email or in-app notice at least 14 days before taking effect.
11. Contact
PSDmate@proton.me
psdmate.com/contact