Privacy Policy

Last updated: October 4, 2026

This policy explains which personal data MockupChat (mockupchat.com) processes, why, and what rights you have under the EU General Data Protection Regulation (GDPR).

1. Controller

Lucas Kleipödszus, lkmedia, Felchenstraße 21, 76437 Rastatt, Germany. Email: lucas@lkmedia.net. See also our imprint.

2. Hosting, server logs and abuse protection

The website and app run on Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). When you visit the site, Cloudflare processes technical data such as your IP address, date and time, requested URL, referrer and browser information in order to deliver the site, keep it secure and defend against attacks. We use your IP address to rate-limit sign-in email requests; uploads and other API requests are rate-limited per account. This keeps the service from being abused.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure and stable service). Log and rate-limit data is kept only as long as needed for these purposes, as a rule no longer than a few days.

3. Drafts in your browser

The editor stores your current draft in your browser's local storage so you don't lose your work. This data stays on your device and is not sent to us until you save it as a cloud project. Storing it is strictly necessary for the editor you requested (§ 25 (2) TDDDG). You can delete it at any time by clearing your browser data.

4. Account and sign-in

If you create an account, we process your email address, and optionally your name and profile picture, plus session data (a session cookie, IP address and browser information of the session). You sign in with a one-time link we send by email; emails are delivered through Amazon SES (Amazon Web Services EMEA SARL, Luxembourg; region EU/Ireland). If Google sign-in is offered and you choose it, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) transmits your name, email address and profile picture to us.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract). The session cookie is strictly necessary for signing in (§ 25 (2) TDDDG). We do not use cookies for analytics or advertising.

5. Projects and uploads (Pro)

Projects you save and images you upload are stored on Cloudflare (database and object storage) and are only accessible to your account. Legal basis: Art. 6(1)(b) GDPR. We keep them until you delete them or your account.

Please only upload content you are allowed to use, and avoid including other people's personal data in mockups unless you have the right to do so.

6. Payments

Pro subscriptions are processed by Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland). Stripe collects your payment details and billing address (needed to calculate taxes) directly. We never see your full card number; we receive your customer ID, subscription status and billing period, and the invoice data required for our accounting. Stripe is an independent controller for some processing, e.g. fraud prevention; see stripe.com/privacy.

Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for statutory retention. Invoices and accounting records are kept for the periods required by German tax and commercial law (up to 10 years, § 147 AO, § 257 HGB).

7. Recipients and transfers outside the EU

We use these service providers, bound by data processing agreements where they act on our behalf:

  • Cloudflare, Inc. — hosting, database, file storage, security
  • Amazon Web Services EMEA SARL — sign-in email delivery (Amazon SES)
  • Stripe — payment processing and invoicing
  • Google — only if you use Google sign-in

Some of these providers are based in the USA or may process data there. Transfers rely on the EU–U.S. Data Privacy Framework where the provider is certified, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

8. How long we keep data

Account data, projects and uploads: until you delete your account. Payment and invoice records: as required by law (see section 6). Server logs and rate-limit counters: briefly, see section 2. To delete your account, email us at lucas@lkmedia.net.

9. Your rights

You have the right to:

  • access the data we hold about you (Art. 15 GDPR)
  • rectification (Art. 16) and erasure (Art. 17)
  • restriction of processing (Art. 18) and data portability (Art. 20)
  • object to processing based on our legitimate interests (Art. 21)
  • withdraw any consent you gave, with effect for the future (Art. 7(3))
  • lodge a complaint with a data protection supervisory authority (Art. 77)

To exercise your rights, email lucas@lkmedia.net. We do not use automated decision-making or profiling.

10. Security and changes

All connections are encrypted with TLS. We may update this policy when the service changes; the current version is always available on this page.