Privacy Notice.

Last updated October 16, 2026

1. Who we are

This Privacy Notice explains how Vector Foundry Studios ("we", "us") handles personal information when you use vectorfoundrystudios.com, the CraftMock web app at craftmock.vectorfoundrystudios.com, and the free trial (the "Service").

2. Your artwork stays in your browser

CraftMock creates mockups locally in your web browser. The artwork and images you open in CraftMock, and the mockups and videos it generates, are processed on your device and saved to your device when you download them. They are not uploaded to our servers. The only information CraftMock sends to our servers is what's needed for sign-in, licensing, and account management, described below.

3. Information we collect

• Email address — when you subscribe or sign in, so we can send one-time sign-in codes, identify your subscription, and contact you about your account.
• Subscription details — from Paddle: subscription status, subscription and customer IDs, and billing period dates. We do not receive or store your full card or bank details.
• License key records — for Etsy lifetime licenses: the key, order reference, and activation history.
• Session and device information — a random device identifier, browser type/operating system (from the user agent), approximate location (country/region/city derived from your IP by our host), and first/last-used dates for each device signed in, so we can enforce the 3-device limit and let you manage your devices.
• IP address, for security — used to rate-limit sign-in attempts and detect account sharing or abuse. We store IP addresses only in a one-way hashed (non-readable) form together with approximate location.
• Support emails — whatever you choose to send us at [email protected].

4. How we use it

To provide and secure the Service; sign you in; enforce license and device limits; prevent fraud and abuse; process subscriptions with Paddle; answer support requests; and send essential service emails (such as sign-in codes and important account or policy notices). We don't use your information for advertising.

5. Service providers we use

• Paddle (Paddle.com Market Ltd and affiliates) — our online reseller and Merchant of Record. Paddle collects and processes your payment and billing information, taxes, and invoices under its own privacy notice: paddle.com/legal/privacy.
• Resend — sends our sign-in code emails from [email protected].
• Cloudflare — hosts our websites and the CraftMock app and stores account records; it processes IP addresses and request data to deliver and protect the sites.
• Google Fonts — this company website loads fonts from Google, which receives your IP address when fonts are fetched.
• Etsy — if you buy on Etsy, Etsy handles that order under its own privacy policy.

These providers process data on our behalf or as independent controllers for their own services, and may process it outside your country, including in the United States.

6. Cookies and local storage

We use only cookies and browser storage needed for the Service to work — no advertising or tracking cookies:

• cm_sub / cm_session — secure, HttpOnly session cookies that keep you signed in (subscriber sign-in up to 30 days; license-key unlock up to 60 days).
• cm_device — a random device identifier (cookie and local storage) used for the device limit.
• CraftMock may also save your tool settings in your browser's local storage on your device.

7. How long we keep data

• One-time sign-in codes expire after 10 minutes and are deleted when used; rate-limit counters expire within an hour.
• Hashed IP entries are kept for up to 30 days of activity; device entries until you remove them or reset your devices.
• Account and subscription records are kept while your subscription or license is active and for up to 24 months afterwards (for support, renewals, and fraud prevention), unless you ask us to delete them sooner or we must keep them longer by law.
• Paddle keeps transaction records as required for tax and accounting under its own policies.

8. Your rights and choices

You can ask us to access, correct, export, or delete your personal information, or object to how we use it, by emailing [email protected] from the email address on your account. We'll respond within 30 days. Deleting your account ends access to the Service; please cancel any active subscription first. Depending on where you live (for example the EU/UK or California), you may have additional rights, including the right to complain to your local data-protection authority.

9. We don't sell your data

We do not sell or rent your personal information, and we do not share it for cross-context behavioral advertising.

10. Security

We use HTTPS, signed HttpOnly session cookies, hashed sign-in codes, rate limiting, and device limits to protect your account. No method of transmission or storage is 100% secure, but we work to protect your information.

11. Children

The Service is not directed to children under 13 (or under 16 where required), and we don't knowingly collect their personal information.

12. Changes

We may update this Privacy Notice. We'll post the new version here with a new "Last updated" date and notify subscribers of material changes by email.