Privacy Policy

DudeShots is operated by:

MRJ Mark Jarvis
ul. Fabryczna 14d
53-609 Wrocław, Poland
NIP: 7532455176

We are the data controller for the personal data described in this policy. For any privacy question or request, contact us at privacy@dudeshots.com.

Account data: your email address and password (stored hashed by our authentication provider), your plan (Free, Pro or Lifetime Pro) and, for Lifetime Pro, when and how you got it (a payment, or a redeemed code such as one bought on AppSumo), and how you found us when you signed up: the site you came from (such as a search engine), the first page you saw and the page or button that led to sign-up. We note these in the page while you browse, without a cookie, and keep them only with your account.

One account for all our Dude apps: the apps we run under the Dude name share one sign-in. The same email and password work on each, a password change applies to all of them, and deleting your account deletes it everywhere. Each app keeps its own plan and payments.

Content you create: images you upload or capture from a URL, and the mockups you build from them. Images you upload stay in your browser: the mockup is drawn and exported there, and they aren’t sent to us. A page you capture from a URL is screenshotted on our server and sent straight back to you, not kept. We don’t use any of it for anything beyond providing the service to you.

Saved presets, watermarks and teams: when you’re signed in, the presets and watermarks you save (their settings, and any logo image in a watermark) are kept with your account so they’re there on every computer you sign in on. Your screenshots are not part of them. If you run or join a team, we keep the team’s name, who is in it, the email addresses invited to it (until the invite is used or cancelled) and what members share with it; the team’s owner sees members’ email addresses, and everyone in the team sees what is shared. Deleting an item, leaving a team or deleting your account removes what is yours; a team goes when its owner deletes it or their account.

Billing data: if you subscribe to a paid plan, our payment processor (Stripe) collects and stores your payment details directly; we only receive your subscription or payment status and a payment reference, not your card details. If you bought a code on AppSumo, AppSumo holds that purchase; we only store the code and the account it was redeemed on.

Messages you send us: your name, email address, the topic and your message when you use the contact form, the withdrawal form or email us, plus your account’s plan if you’re signed in, so we can answer and process refunds.

Technical data: your IP address, browser/device information, and cookies; see our Cookie Policy for detail.

To provide the service you’ve requested (contract, Art. 6(1)(b) GDPR): creating your account, rendering your mockups, and processing payment for Pro and Lifetime Pro, redeeming codes, answering your messages and handling withdrawals and refunds.

To keep payment and tax records (legal obligation, Art. 6(1)(c)).

To secure the service and prevent abuse (legitimate interest, Art. 6(1)(f)).

To understand how DudeShots is used and improve it (legitimate interest, Art. 6(1)(f)): we record a small number of product events on our own servers, such as a mockup being exported, a Pro option being tried, or checkout being started, completed or left unfinished, and we look at our own server logs to see how people found us. This uses no cookies and stores no IP address. If you’re signed in, the event is linked to your account, and the link is removed if you delete it. We use it to decide what to build and fix, and to write the two account emails near the end of your Pro week, which say what changes on the pictures you made (for example how many used 3D devices) and mention the Pro price. We never sell it, never share it and never use it for advertising. You can object at any time by emailing us.

For analytics cookies, only where you’ve given consent (Art. 6(1)(a)); see our Cookie Policy.

For product news and offers by email, only if you ask for them (consent, Art. 6(1)(a)): the box on the sign-up page, which starts unticked, or the switch on your account page. We record when and where you gave or withdrew consent. You can withdraw it any time with the unsubscribe link in any of these emails or on your account page, and your email address is then removed from our mailing list. Emails about your account and payments (confirmations, receipts, password resets, changes to your plan) are part of the service and don’t depend on this choice.

We use a small number of processors to run the service:

• Supabase: authentication and database hosting (UK region, London).
• Vercel: hosting and content delivery.
• Stripe: payment processing for Pro and Lifetime Pro.
• Resend: sending account, billing and support emails (EU region).
• Cloudflare: DNS, forwarding email sent to our @dudeshots.com addresses to our inbox, and Turnstile, which checks that a person, not a bot, is signing up, logging in, resetting a password or using the contact and withdrawal forms (it doesn’t use cookies for tracking).
• Microsoft Clarity: behavioural analytics (session recordings and heatmaps), loaded only if you consent to Analytics cookies. Clarity masks text you type into forms by default. We additionally hide the studio from it, so your screenshots and mockups are never recorded, hide your email address on your account page. If you’re signed in, we send it your account’s internal id (a random code, not your name or email address) so one person’s visits can be told apart. That makes the recordings pseudonymous, not anonymous: we can match the id to your account.
• Google Analytics 4: counting visits, where they come from and which pages lead to sign-ups and purchases, loaded only if you consent to Analytics cookies. Advertising features and Google Signals are off, and we never send it your email address.

Each acts as our processor under a data processing agreement and only handles data as instructed by us. We don’t sell your data or share it with third parties for their own marketing purposes.

Our database and sign-in (Supabase) are hosted in the United Kingdom (London). The UK is outside the European Economic Area, and transfers there are covered by the European Commission’s adequacy decision for the UK. Some other processors above may process data elsewhere outside the European Economic Area, for example in the United States. Where this happens, it’s covered by an adequacy decision or Standard Contractual Clauses as required by GDPR.

Account and content data for as long as your account is active. Consent logs for as long as required to demonstrate compliance. Support and withdrawal messages for up to two years after the conversation ends. Payment and refund records for as long as Polish tax law requires (currently five years). If you delete your account, your profile and content are deleted immediately; residual backups are purged on our standard rotation schedule.

Under GDPR you have the right to access, correct, delete, restrict, or port your personal data, and to object to processing based on legitimate interest. You can delete your account and all associated data yourself at any time from your account page. For any other request, contact us at the email above.

You also have the right to lodge a complaint with the Polish data protection authority (Urząd Ochrony Danych Osobowych, uodo.gov.pl) or your local supervisory authority.

We’ll update this page if how we handle your data changes, and update the “last updated” date above.