Privacy Policy

Last updated: July 2026

1. Introduction

SudoMock ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mockup rendering service.

Our service is operated by SudoMock, located at 1209 MOUNTAIN ROAD PL NE, STE N, ALBUQUERQUE, NM 87110, USA. We are committed to GDPR and CCPA compliance.

2. Information We Collect

2.1 Information You Provide

Account information (email address, password hash)
Payment information (processed securely through Stripe - we never store card details)
API usage data and preferences
PSD files and design assets you upload (processed only for rendering)
Communication data when you contact support

2.2 Automatically Collected Information

Usage analytics and performance metrics
Device information and IP addresses (for security and fraud prevention)
Cookies and similar tracking technologies (see Cookie Policy)
API request logs (for debugging and optimization)

3. How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve our rendering service
Process transactions and manage subscriptions
Send you technical notices, updates, and support messages
Respond to your comments and questions
Monitor and analyze usage patterns for optimization
Detect, prevent, and address technical issues and fraud
Comply with legal obligations

4. Data Processing & Storage

Uploaded Files: Your uploaded 2D source images are stored securely and are not deleted on a schedule. Uploaded PSD templates on unfunded accounts may be removed after a period of inactivity. A template that has gone 7 days without a render enters a warning sequence and may be removed about 13 days after its last render. Rendering a template keeps it active, as described in Section 8. You can ask us to delete any uploaded file at any time. We do not claim ownership or rights to your content.

Rendered Outputs: Image renders are deleted 7 days after they are produced, including the preview attached to an order. Video outputs are not on that schedule. Section 8 covers custom domain renders and each of these, and you can ask us to delete your renders at any time.

Data Location: Our servers are located in the United States. By using our service, you consent to data processing in the US.

5. Third-Party Services

We use the following third-party services that may process your information:

Supabase: Authentication and database services (GDPR compliant)
Stripe: Payment processing (PCI DSS compliant)
Google Analytics: Browser and server-generated usage measurement
Mixpanel: Product usage and account analytics, including session replay recordings of in-app screens and interactions
Meta: Browser and server-generated advertising measurement, attribution, and conversion events
Brevo: Messaging, service automation, and web tracking
Intercom: Live support, account messaging, and interaction analytics
Cloudflare: CDN and security services
Shopify: E-commerce platform integration (see Section 5.1 below)

5.1 Shopify Integration

If you use our Shopify app ("SudoMock - Product Customizer"), the following additional data practices apply:

Data We Access Through Shopify APIs

Our app requests the following Shopify API scopes:

read_products: To display your product catalog so you can map products to mockup designs
write_products: To store mockup configuration on products via Shopify metafields (namespace: sudomock)
read_themes: To check theme compatibility when embedding the customizer button

We do not request access to customer personal data, orders, customer accounts, or any protected customer data fields (name, email, phone, address).

Data Collected from Merchants

Shop domain (e.g., your-store.myshopify.com) for identifying your connection
Connection to your existing SudoMock account via OAuth. We store the access credentials Shopify issues for that connection, along with the shop contact details Shopify returns with them (the name and email of the installing user)
Customizer configuration preferences (colors, feature toggles, display mode)

Data Collected from Your Customers (Buyers)

When your customers use the product customizer on your storefront:

Artwork uploads (while designing): Design files uploaded by your customers are stored securely so the design can be rendered, and so the source file is available to you for fulfillment. We do not use them for anything else.
Artwork uploads (order fulfillment): The design file is stored when the design is rendered. When a customized product is added to the cart, the design file(s) and the final preview image are attached to the order as URLs, so you can produce the item. These files are kept for fulfillment. You can ask us to delete them at any time.
No cookies or tracking: Our storefront theme extension does not set cookies, use local storage, or employ any tracking technologies on your customers' devices.
No other personal data: Beyond the artwork itself, we do not collect names, emails, addresses, or any other personally identifiable information from your customers.
Rendered outputs: Preview renders generated while designing are stored on our CDN and deleted 7 days after they are produced, including the preview attached to an order. Section 8 covers custom domain renders. The design file attached to an order is kept for fulfillment as described above.

GDPR Compliance Webhooks

Our app implements all mandatory Shopify GDPR webhooks: customers/data_request, customers/redact, and shop/redact. Beyond the artwork itself, the app holds no personal data of your customers. Artwork kept for fulfillment sits in your SudoMock account, where you can remove it, and you can ask us to delete it at any time.

App Uninstallation

When you uninstall the SudoMock app from your Shopify store, we automatically disconnect and deactivate the store connection in our system. Metafields set on your products remain in Shopify (you can remove them via the Shopify admin). Your SudoMock account and credits are not affected by uninstallation.

6. Your Rights (GDPR & CCPA)

You have the right to:

Access: Request a copy of your personal data
Rectification: Request correction of inaccurate data
Erasure: Request deletion of your personal data ("right to be forgotten")
Restriction: Request limitation of processing
Portability: Request transfer of your data in a structured format
Objection: Object to processing of your data
Opt-out: Opt-out of sale of personal information (CCPA - note: we do not sell data)

To exercise these rights, please contact us at [email protected]. We will respond within 30 days.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

Encryption in transit (TLS 1.3) and at rest
Regular security audits and penetration testing
Access controls and authentication
Secure API key management

However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy:

Account data: Kept for as long as your account exists. You can ask us to delete it at any time, and we will
PSD templates: When you upload a PSD we extract its layers, masks and previews and keep those so the template can be rendered; the original file you uploaded is not retained. What we keep is held while your account is funded. Uploaded PSD templates on unfunded accounts may be removed after a period of inactivity. A template that has gone 7 days without a render enters a warning sequence and may be removed about 13 days after its last render. Rendering a template keeps it active. We send warning emails first. You can ask us to delete them at any time
2D source images: Not deleted on a schedule, and no automatic time limit applies. You can ask us to delete them at any time
Rendered outputs: Image renders are deleted 7 days after they are produced, including the preview attached to an order. Video outputs are not on that schedule
Custom domain renders: Not on the 7 day schedule for as long as your custom domain stays connected. Some render types may still be removed sooner. If you stop using custom domains, these renders may be removed later. You can ask us to delete them at any time
Video outputs: Not deleted on a schedule, and no automatic time limit applies. You can ask us to delete them at any time
Order fulfillment artwork: Design files attached to orders are kept for fulfillment. You can ask us to delete them at any time
Usage logs: Request logs are kept for 30 days. The record of what your account used is kept as part of your billing history
Billing records: Kept for at least 7 years, as tax and accounting law requires

9. Cookies

We use cookies to enhance your experience. Our cookies include:

Essential: Required for the website to function (authentication, security)
Functional: Enable features such as Intercom live chat support
Analytics: Help us understand usage patterns and service performance
Marketing: Measure advertising effectiveness and conversion attribution

You can manage your cookie preferences at any time. For details, see our Cookie Policy.

Account, product-usage, security, billing, conversion, and service events created on our servers may be processed separately from browser cookies by the providers listed above.

10. Children's Privacy

Our service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected data from a minor, please contact us immediately.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. For significant changes, we will also notify you via email.

12. Contact Us

If you have any questions about this Privacy Policy or your data, please contact us:

Email: [email protected]
Support: [email protected]
Address: 1209 MOUNTAIN ROAD PL NE, STE N, ALBUQUERQUE, NM 87110, USA