Data Policy

• Account data: users, roles, organisation details.
• Project data: products, mockups, artwork, colourways, briefs.
• Client data: contacts, share links, approvals, comments.
• Operational data: logs, audit trails, email events.

• Data is stored in managed cloud infrastructure.
• Encryption at rest (AES-256) and in transit (TLS 1.2+).
• Files such as artwork uploads are stored in object storage with access controlled by signed, time-limited URLs.
• Where data is transferred outside the UK/EEA, we rely on Standard Contractual Clauses and equivalent safeguards offered by each provider.

Your data is hosted with the following third-party providers, each acting as a processor under contract:

• Supabase (via Lovable Cloud) — primary application database, authentication, and file storage. Data resides in AWS data centres in the European Union (eu-west-2, London) unless otherwise agreed.
• Cloudflare — edge hosting, CDN, and DDoS protection. Requests are served from Cloudflare's global edge network; persistent data is not stored at the edge.
• Google (Google Cloud / Vertex AI & Gemini API) — AI inference for mockup generation and image edits. Prompts and images required to fulfil a generation are sent to Google's model endpoints (typically EU or US regions). Google is contractually prohibited from using this content to train its models.
• OpenAI — AI inference for selected text and image features. Inputs are processed in OpenAI's US infrastructure under a zero-retention / no-training data processing agreement.
• Stripe — payment processing and subscription management. Card details are handled directly by Stripe (US/EU); we only store billing metadata.
• Resend — transactional email delivery (verification, approvals, notifications). Email addresses and message contents are processed in the EU/US.

• Row-level security ensures users only access data in their own organisation.
• Role-based permissions (admin, member, client) limit available actions.
• Engineering access to production data is restricted, audited, and used only for support, recovery, or abuse investigation.

• AI-assisted features (mockup generation, image edits, suggestions) send the minimum necessary inputs — typically your prompt and the relevant image — to third-party model providers.
• These providers act as processors under contracts that prohibit using your content to train their models.
• AI outputs are stored alongside your project so you can review, version, and approve them.

• Share links you create are unguessable and can be revoked or expired at any time.
• Approvals captured via share links record the approver's email, timestamp, and IP for audit purposes.

• We take encrypted daily backups with point-in-time recovery for our primary database.
• Backups are retained for up to 30 days.
• Backups are used solely for disaster recovery.

• Active project and client data is retained while your account is active.
• You can delete individual projects, products, or files at any time; deletions are processed immediately and removed from backups within 30 days.
• If you cancel and close your account, all account data is deleted within 90 days, except minimal records we must retain for legal or accounting reasons.
• You can request an export of your data before deletion.

• We use a small set of vetted subprocessors for hosting, email delivery, payment processing, and AI inference.
• A current list is available on request from [email protected].

• If we become aware of a security incident affecting your data, we will notify affected customers without undue delay.
• Where required, we will notify within the timeframes set by applicable law.

• Keep credentials secure and use strong, unique passwords.
• Only upload content you have the rights to use.
• Manage share links and revoke access when no longer needed.

• For data requests (export, deletion, access), email [email protected].