Privacy Policy

1. Data Controller

2. Information We Collect

Account Information

When you register or sign up for an account, we collect:

• Email address
• Username
• Password (encrypted)
• Profile picture (optional)
• Bio/description (optional)

Profile and Social Information

When you use our community features, we collect:

• Content you post (images, designs, mockups)
• Comments you make on posts
• Likes and interactions with other users' content
• Users you follow and who follow you
• Post titles, descriptions, and categories

Usage Data

We automatically collect information about how you interact with the App:

• Pages and screens visited
• Features used and time spent
• Search queries
• Interaction with community content

Device Information

This may include:

• Device type and operating system
• Unique device identifiers
• IP address
• Language settings and time zone

Content and Files

If you upload, share, or create 3D models, designs, or AI-generated images using the App, that content and related metadata is stored on our servers.

3. How We Use Your Information

We use the collected information for purposes including:

Providing the Service: Enabling you to create, save, and share 3D mockups and designs; operating community features including posts, likes, comments, and profiles.

Community Features: Displaying your profile and posts to other users; showing content from users you follow; enabling interactions between users.

Personalization: Customizing your feed based on your interests and interactions; recommending content and users to follow.

Communication: Sending notifications about likes, comments, follows, and other community activity; sending updates about new features or changes.

Safety and Moderation: Enforcing our Terms of Service and Community Guidelines; detecting and preventing spam, abuse, and policy violations.

Improvement: Analyzing usage patterns to improve our Services; conducting research and development.

4. Public Information

When you use our community features, certain information is public by default:

• Profile: Your username, profile picture, bio, and follower/following counts are visible to all users.
• Posts: Content you share in the community (images, titles, descriptions) is visible to all users.
• Interactions: Your likes and comments may be visible to other users.

Important: Think carefully before sharing personal information in your profile or posts, as this information may be viewed by anyone using the App.

5. Legal Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data under the following legal bases:

Consent: When you have given clear consent for us to process your personal data (e.g., for marketing communications).

Contract: Where the processing is necessary for the performance of a contract with you (e.g., providing the Services you signed up for).

Legitimate Interests: To improve our services, ensure safety, and detect fraud, provided such interests are not overridden by your data protection rights.

Legal Obligations: Where we need to comply with a legal or regulatory obligation.

6. How We Share Your Information

We do not sell your personal information to third parties. However, we may share information in the following situations:

With Other Users: Your public profile, posts, comments, and likes are visible to other users of the community.

Service Providers: We share information with trusted third-party vendors (e.g., cloud hosting, analytics, content delivery) to perform services on our behalf under strict data protection agreements.

Legal Requirements: We may disclose information if required to do so by law or if we believe such action is necessary to comply with legal obligations, protect our rights, or respond to legal processes.

Business Transfers: In the event of a merger, acquisition, or asset sale, your data may be transferred to a third party, subject to the same or substantially similar privacy standards.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you the Services.

Account Deletion: If you delete your account, we will delete or anonymize your personal information within 30 days, except where we are required to retain it for legal purposes.

Content: Posts and comments you made may remain visible even after account deletion if they were shared publicly, though they will be disassociated from your profile.

8. Security Measures

We implement reasonable technical and organizational measures to protect your information:

• Encryption of data in transit (HTTPS/TLS)
• Secure password hashing
• Regular security audits
• Access controls and authentication

While we strive to use commercially acceptable means to protect your personal data, no method of transmission or storage is 100% secure.

9. International Data Transfers

Your information may be transferred to — and maintained on — servers located outside of your state, province, or country where data protection laws may differ. We will take appropriate measures to ensure your personal data remains protected in accordance with this Privacy Policy, such as entering into standard contractual clauses where required by applicable law.

10. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of any inaccuracies in your data.
• Erasure ("Right to be Forgotten"): Request deletion of your data under certain conditions.
• Restriction or Objection: Restrict or object to certain data processing activities.
• Data Portability: Receive your personal data in a structured, commonly used format.
• Withdraw Consent: Withdraw consent you have provided to us at any time.
• Account Deletion: Delete your account and associated data through your account settings.

To exercise these rights, please contact us at 3dmockupsofficial@gmail.com. We will handle your request in accordance with applicable laws.

11. Children's Privacy

Our App is not directed to children under the age of 13, and we do not knowingly collect personal information from minors. If you believe a child under the applicable age has provided us with personal data, please contact us, and we will take steps to delete such data promptly.

12. Third-Party Services and Sub-Processors

We rely on the following trusted sub-processors to operate the Service. Each has been vetted and is bound by a data protection agreement.

• Supabase: Authentication, database, and file storage (US region).
• Cloudflare R2: Object storage for design files, mockup PNGs, and generated media.
• Cloudinary: Legacy image storage and delivery for user-generated content.
• Stripe: Payment processing for Service subscriptions (does not apply to our free Shopify app).
• RevenueCat: Subscription lifecycle management for our mobile and web plans.
• Shopify Inc.: Source of merchant and buyer data received via our Shopify App integration. See Section 13 for details.
• Printful, Inc.: Print-on-demand production partner that fulfills physical orders. Receives buyer name, shipping address, and order line items required to produce and ship the physical product.
• Vercel: Application hosting and edge network.
• PostHog: Product analytics (aggregate, no personal identifiers shared without consent).

These services have their own privacy policies, and we encourage you to review them.

13. Shopify App Integration

This section applies specifically to merchants who install the 3DMockups POD app from the Shopify App Store, and to buyers who place orders through a merchant's Shopify store that include products fulfilled by 3DMockups.

13.1 Merchant Data We Receive from Shopify

When you install the 3DMockups POD app, Shopify shares the following data with us so we can operate the integration:

• Your shop domain (e.g., example.myshopify.com).
• An offline OAuth access token authorizing the specific scopes you approved at install time.
• Product, inventory, publication, and fulfillment data required to create and fulfill listings you publish from 3DMockups.
• Order webhooks (orders/paid, orders/fulfilled) for orders that contain a 3DMockups-published product.

The specific OAuth scopes we request, and the merchant-facing feature each scope enables, are documented in the Shopify Partner Dashboard listing and are limited to what the integration requires.

13.2 Buyer Data We Receive Through Merchant Orders

When one of your buyers purchases a 3DMockups product from your Shopify store, Shopify sends us an order webhook containing:

• Buyer name and email address.
• Shipping address and, where applicable, billing address.
• Line items, quantities, variant details (size/color), and total.
• Shopify order number and internal identifiers.

We use this data solely to (a) route the fulfillment to our production partner, (b) return the shipping tracking number to your Shopify order so your buyer receives Shopify's standard shipping notifications, and (c) respond to legally-required GDPR requests. We do not use buyer data for marketing, do not sell it, and do not retain it beyond the retention periods described in Section 13.4.

13.3 How We Protect Shopify Data

• OAuth access tokens are encrypted at rest using AES-256-GCM with per-installation initialization vectors before being written to our database.
• Every Shopify webhook payload is HMAC-verified against your app secret before we process it; requests that fail verification are rejected with a 401.
• All traffic between 3DMockups, Shopify, and our sub-processors uses TLS 1.2 or higher.
• Access to production data is restricted to a minimum number of authorized personnel and is logged.

13.4 GDPR / CCPA Compliance Webhooks

We implement all three mandatory Shopify compliance webhooks:

• customers/data_request: When a buyer requests a copy of their data via a merchant, we assemble and provide any personal information we hold about that buyer within 30 days.
• customers/redact: When a merchant requests deletion of a buyer's data (typically 10 days after the buyer's request), we permanently delete or irreversibly anonymize that buyer's personal information across our systems.
• shop/redact: Approximately 48 hours after a merchant uninstalls our app, Shopify sends this webhook and we permanently delete or irreversibly anonymize all data associated with that shop, including the shop record, encrypted access tokens, and any locally cached product or order data.

13.5 What Happens When You Uninstall

When you uninstall the 3DMockups POD app from your Shopify store, Shopify immediately revokes our access token and sends us an app/uninstalled webhook. We stop attempting any Shopify API calls to your shop, mark the installation as uninstalled, and wait for the shop/redact webhook (~48 hours later) to complete permanent deletion of your data as described in Section 13.4.

13.6 Cost and Billing

The 3DMockups POD Shopify app is free for merchants. We do not charge subscription fees, per-order fees, or any other Shopify-billed amount to merchants using the app.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or the law. When we update the policy, we will revise the "Effective Date" at the top. If the changes are significant, we may provide a more prominent notice or request your consent where required by law.

15. Contact Us

If you have any questions, concerns, or comments regarding this Privacy Policy or our data practices, please contact us at: