Privacy Policy

Notice at collection

HumbleFoundry LLC, operator of StudioMock, collects the categories below for the stated purposes. We do not sell personal information for money. When optional advertising technologies are enabled with consent, disclosure of identifiers and online activity to advertising partners may be considered a “sale,” “sharing,” or targeted advertising under some privacy laws. We do not use or disclose sensitive personal information to infer characteristics about you.

• Identifiers and account details: name, email, account identifier, authentication status, plan, and credit balance, used to create and secure accounts, provide the Service, and communicate with you.
• Commercial information: subscription, billing status, transaction, tax, and Stripe customer identifiers, used to process purchases, manage subscriptions, prevent fraud, and keep required records. Stripe, not us, receives complete payment-card details.
• User Content: artwork, product and model-reference photographs, prompts, source videos, generated images and videos, and project metadata, used to provide image and video generation, storage, and support. We do not send User Content to advertising pixels.
• Internet, device, and advertising activity: IP address and approximate location, device and browser information, cookie or advertising identifiers, referring pages, pages viewed, interactions, ad clicks, conversions, request logs, generation attempts, and security events, used to operate, troubleshoot, secure, analyze, and measure the Service and our advertising.
• Inferences: broad interests or audience segments derived from website and advertising activity, used to measure campaigns and, where enabled, help deliver more relevant advertising.
• Communications: support, privacy, copyright, and legal correspondence, used to respond, keep records, and resolve disputes.

Retention periods or criteria for each category appear in the Retention section. See our Cookie Notice for details about necessary, analytics, and advertising technologies.

Sources of personal information

We receive information directly from you when you sign in, upload material, enter prompts, purchase a plan, connect a social account, or contact us; automatically from your browser, device, and use of the Service; and from service providers and advertising partners involved in authentication, hosting, AI processing, payments, analytics, campaign measurement, and advertising.

How we use information

We use personal information to provide requested features; authenticate users; render and privately store mockups; process requested AI scene changes; administer credits and subscriptions; process transactions; provide support; prevent abuse, fraud, and security incidents; analyze traffic and product performance; measure advertising and conversions; build or use advertising audiences where permitted; improve our website, campaigns, and reliability; enforce our agreements; and comply with legal obligations.

Authorized support personnel may access content stored in your account when reasonably necessary to respond to support requests or troubleshoot technical issues. Access is restricted to authorized personnel.

We do not use private uploaded artwork, prompts, product or model-reference photographs, or generated images to train general-purpose AI models unless you separately and expressly opt in. We do not use that content to personalize third-party advertising, and we do not use model-reference photographs for biometric identification. Do not submit sensitive or confidential content that is unnecessary for your requested mockup.

How we disclose information

We disclose information reasonably necessary to service providers acting for us: OpenAI for authentication, image safety screening and AI image processing; Google for AI video generation and remixing through its first-party Gemini API; Kling AI for video features that use Kling; Cloudflare for application hosting, database, object storage, and network security; and Stripe for checkout, payment processing, tax features, and subscription management.

With optional analytics or advertising enabled, Google and Meta may receive online identifiers, device and browser information, pages viewed, interactions, ad-click information, and conversion events through Google Analytics, Google Ads, Meta Pixel, or related measurement tools. They may use this information to provide measurement, attribution, audience, and advertising services and may act as independent businesses for some processing. We do not intentionally send User Content, payment-card details, or sensitive personal information through these analytics or advertising tools. Google AI video processing is separate from these optional tools and occurs when you submit a video request, including when optional analytics and advertising are turned off. Current provider details appear on our Service Provider & Advertising Partner List.

We may also disclose information to professional advisers; when reasonably necessary to comply with law or valid legal process; to protect rights, safety, and security; or as part of a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate protections.

We do not sell personal information for money. Depending on applicable law, the use of advertising pixels, audience tools, or cross-context advertising may be treated as sale, sharing, or targeted advertising. You can control this processing as described below.

AI processing and provider retention

AI image generation is provided by OpenAI. When you submit a generation, scene change, or saved-image remix, StudioMock sends the prompt and the image inputs needed for that request to the provider. Depending on the feature, those inputs may include uploaded artwork, product or model-reference photographs, a prepared scene or product reference, or a saved mockup with visible artwork. Some scene-editing features keep the separate artwork layer in the editor and send only the scene or product reference. When you select an image for upload, we send it to OpenAI for content safety screening before displaying it in the editor or accepting it for use. Upload and save endpoints also screen submitted images. Generation submission starts the additional AI image generation processing. Necessary technical request metadata is also processed.

We use this processing to deliver the AI feature you request. Only submit material you have permission to share, including any required client authorization or permission from people shown in photographs. Avoid unnecessary sensitive personal information or confidential material.

OpenAI states that API inputs and outputs are not used to train its models by default, unless the API customer explicitly opts in to data sharing. This describes its published API default, not a promise of zero retention. Our commitment not to use private User Content for general-purpose model training without a separate, express opt-in also applies to provider data-sharing choices we control.

Under OpenAI’s published default API controls, abuse-monitoring logs may contain prompts, responses, or other customer content and are generally retained for up to 30 days, unless longer retention is legally required. Image inputs are subject to safety screening; flagged images may be retained for manual review, including under certain enhanced retention controls. Retention depends on the endpoint, applicable safety or legal requirements, and contractual controls. We do not promise that generation data is never stored, never reviewed, or immediately deleted by the provider. See OpenAI’s API data controls.

Deleting a StudioMock mockup or account initiates our deletion workflow for the content we store, subject to the retention exceptions below. It does not automatically erase provider abuse-monitoring or safety records; those records follow the provider’s applicable retention controls and legal obligations. Contact our privacy contact below for deletion or other rights requests involving provider processing.

Provider processing may take place in the United States or other countries where its infrastructure operates. The international-transfer provisions below apply. Our provider list identifies current providers; the generation notice and this information will be updated before requests are routed to a different AI provider. Material changes to processing previously collected content will receive notice or consent where required.

AI video generation and remixing

Google provides the Video Ad Maker, other video workflows, and template remixes through its first-party Gemini API. Kling AI processes video features that use Kling. The creation screen identifies the provider for the feature. When you submit a request, StudioMock sends that provider your prompt, any starting video or selected clip, product, artwork or model-reference images needed for the request, and technical request metadata. OpenAI screens prompts and uploaded images for content safety. StudioMock stores generated videos and request status to deliver the feature. Only submit content you are authorized to share, including any required likeness permissions.

Google publishes separate data-processing terms for its paid Gemini API services. Under those terms, prompts and responses are not used to improve Google products, but may be logged for safety, security and legal purposes. Processing may occur wherever Google or its agents maintain facilities. Retention depends on the API feature and applicable terms; this is not a promise of zero retention or immediate provider deletion. Deleting a video from StudioMock does not automatically erase Google records. See Google’s Gemini API terms and its data-processing terms.

Kling’s API privacy policy describes storage in Singapore and support by teams worldwide. Its retention and training terms differ from Google’s and OpenAI’s. Deleting content from StudioMock does not automatically erase Kling records. Contact us for provider-related privacy requests. See Kling’s API Privacy Policy. Our international-processing provisions and privacy rights also apply to video requests.

Retention

• Account identifiers and settings: while the account is active, then for the period reasonably necessary to complete deletion, prevent fraud, resolve disputes, and meet legal obligations.
• User Content and generated output: while stored in your account or until deletion is requested, followed by a limited period for secure deletion from backups where applicable.
• Analytics and advertising data: first-party event records are deleted after 90 days. Optional identifiers and consent expire after 180 days. Provider data is retained according to the configured retention periods for the relevant Google or Meta product, subject to our operational needs and the provider’s policies. Browser identifiers may persist until they expire or you clear them.
• Cookie and advertising choices: optional consent choices expire after 180 days, after which we ask again. Suppression records prevent stale identifiers from restarting collection. Privacy-request evidence is generally retained for three years; provider identifiers in a deletion case are removed when its outcome is confirmed.
• Billing and transaction records: generally up to seven years after the transaction or longer if required for tax, accounting, chargeback, or legal obligations.
• Generation-attempt rate-limit records: seven days.
• Security and technical logs: generally up to 12 months, unless a longer period is necessary to investigate an incident or protect the Service.
• Support, privacy, copyright, and legal correspondence: generally three years after the matter closes, or longer when needed for an active dispute or legal hold.

We may retain deidentified or aggregated information that cannot reasonably identify you. We delete or deidentify information when it is no longer reasonably necessary for the purposes described above.

Your choices and privacy rights

Depending on where you live, you may have rights to know or access personal information, correct it, delete it, receive a portable copy, restrict or object to processing, opt out of sale, sharing, or targeted advertising, limit certain uses of sensitive information, withdraw consent, and appeal a denied request. You also have the right not to receive discriminatory treatment for exercising applicable rights.

Use the “Privacy choices” control available on every page to accept, reject, or change optional analytics and advertising technologies. Rejecting optional technologies does not affect necessary site functions. Browser settings and provider controls may offer additional choices, but clearing browser storage may also clear the choice saved on this device.

We process recognized legally binding opt-out preference signals, including Global Privacy Control, as an opt-out of advertising-related sale or sharing for that browser or device. Legacy “Do Not Track” signals that do not communicate a legally recognized choice may not be acted upon. You may also use Google’s and Meta’s advertising settings to manage how those companies use information.

Use Privacy & data to export your account and linked tracking data, or stop tracking and erase linked first-party events. Provider deletion requests are tracked separately until their outcomes are verified. To submit another privacy request, email contact@studiomock.ai or write to the address below. Describe the right you want to exercise and the account email involved. We may verify your identity or an authorized agent’s authority and will respond within the period required by applicable law.

You can manage payment methods and cancellation through the Stripe billing portal. You may also contact us if you cannot access your account.

Security, international processing, and legal bases

We use administrative, technical, and organizational measures designed to protect personal information, including authenticated access to private account data and access controls for stored media. No system is completely secure, and we cannot guarantee absolute security.

Information may be processed in the United States and other countries where our providers operate. Where required, international transfers must be covered by a legally recognized transfer mechanism or applicable exception.

For people in the European Economic Area, United Kingdom, or Switzerland, our legal bases are performance of a contract for accounts, generation, storage, credits, and billing; our legitimate interests in securing, supporting, and improving Service reliability; compliance with legal obligations; and consent for optional analytics, advertising, and other processing when we request it. You may withdraw consent at any time through “Privacy choices” and object to processing based on legitimate interests. You may also complain to your local data-protection authority.

Children

The Service is intended for adults and is not directed to anyone under 18. We do not knowingly collect personal information from children under 13. If you believe a child provided personal information, contact us so we can investigate and delete it as appropriate.

Changes to this Policy

We may update this Policy to reflect changes to the Service, providers, or law. We will post the revised effective date and provide additional notice when required. We will not materially expand how we use previously collected personal information without notice or consent where required.

Contact

HumbleFoundry LLC is responsible for this Policy. Our Privacy Officer and public data-protection contact can be reached at contact@studiomock.ai or by writing to HumbleFoundry LLC, 100 E San Marcos Blvd, Suite 400, San Marcos, CA 92069. This contact receives privacy-rights requests, complaints, and suspected data-incident reports.

Localized supplemental notices for Canada and Québec, Mexico, Brazil, Japan, Taiwan, and Singapore are available in our Regional Consumer & Privacy Notices.