Trust Center
What happens to the files you send us, how long we keep them, how payments are handled, and where to look when something is wrong.
How your data is protected
- Encryption in transit and at rest
- Traffic to the API and the dashboard is carried over TLS 1.3, and stored data is encrypted at rest.
- Access control
- Accounts are authenticated, and every API request is authorised against the account that owns the resource it asks for.
- API key handling
- Keys are issued, rotated and revoked from the dashboard. A key is shown once, at creation; we cannot read it back to you afterwards.
How long we keep things
Retention is a schedule, not a promise to keep everything forever. The full schedule, including photo mockups, video outputs and billing records, is in the privacy policy.
- Rendered images
- Deleted 7 days after they are produced. Renders served through a connected custom domain are not on that schedule.
- Uploaded PSD files
- The original file you upload is not retained. We keep the extracted layers, masks and previews so the template can be rendered again.
- Templates without an active subscription
- On an account without an active subscription, a template that goes 7 days without a render enters a warning sequence and may be removed about 13 days after its last render. Warning emails go out first, and rendering it keeps it active.
- Request logs
- Kept for 30 days. What your account used stays in your billing history.
- Deletion on request
- You can ask us to delete your account data, templates and outputs at any time, and we will.
Payments
Card details never reach our servers. Checkout and card storage are handled by a PCI DSS compliant payment provider, and what we hold is the record of what you bought. Our refund policy says plainly what is and is not refundable, and the sub-processors that handle payment and delivery are named in the privacy policy.
Operational transparency
- Live service status
- A public status page carries the current state of the service and the history of past incidents, with no account needed to read it.
- Published API contract
- The OpenAPI document and the MCP manifest are public, so you can see exactly what the API accepts and returns before you write a line against it.
- Published pricing and changes
- Prices are on the pricing page rather than behind a sales call, and every shipped change is written up in the public changelog.
Reporting a security issue
Write to [email protected] with what you found and how to reproduce it. The same address reaches us for any other security or privacy question.