Privacy Policy

DudeShots is operated by:

MRJ Mark Jarvis
ul. Fabryczna 14d
53-609 Wrocław, Poland
NIP: 7532455176

We are the data controller for the personal data described in this policy. For any privacy question or request, contact us at privacy@dudeshots.com.

Account data — your email address and password (stored hashed by our authentication provider), and your subscription plan.

Content you create — images you upload or capture from a URL, and the mockups you build from them. These are processed to render your exports; we don’t use them for any purpose beyond providing the service to you.

Billing data — if you subscribe to a paid plan, our payment processor (Stripe) collects and stores your payment details directly; we only receive your subscription status, not your card details.

Technical data — your IP address, browser/device information, and cookies — see our Cookie Policy for detail.

To provide the service you’ve requested (contract, Art. 6(1)(b) GDPR) — creating your account, rendering your mockups, and processing payment for Pro subscriptions.

To secure the service and prevent abuse (legitimate interest, Art. 6(1)(f)).

For analytics cookies and any future marketing communications, only where you’ve given consent (Art. 6(1)(a)) — see our Cookie Policy.

We use a small number of processors to run the service:

• Supabase — authentication and database hosting (EU region).
• Vercel — hosting and content delivery.
• Stripe — payment processing for Pro subscriptions.
• Microsoft Clarity — behavioural analytics (session recordings and heatmaps), loaded only if you consent to Analytics cookies. Clarity masks text you type into forms by default; we additionally never send it your email address, only an anonymised account identifier.

Each acts as our processor under a data processing agreement and only handles data as instructed by us. We don’t sell your data or share it with third parties for their own marketing purposes.

Some processors above may process data outside the European Economic Area. Where this happens, it’s covered by an adequacy decision or Standard Contractual Clauses as required by GDPR.

Account and content data for as long as your account is active. Consent logs for as long as required to demonstrate compliance. If you delete your account, your profile and content are deleted immediately; residual backups are purged on our standard rotation schedule.

Under GDPR you have the right to access, correct, delete, restrict, or port your personal data, and to object to processing based on legitimate interest. You can delete your account and all associated data yourself at any time from your account page. For any other request, contact us at the email above.

You also have the right to lodge a complaint with the Polish data protection authority (Urząd Ochrony Danych Osobowych, uodo.gov.pl) or your local supervisory authority.

We’ll update this page if how we handle your data changes, and update the “last updated” date above.