Privacy Policy

1. Who We Are

Scaylr ("we", "us", "our") is a web-based batch mockup generator available at scaylr.io. Scaylr is based in the United Kingdom. For privacy matters, contact us at info@scaylr.io.

2. What Data We Collect

2.1 Data You Provide

• Account information — when you sign up for a paid plan, we collect your email address and payment details. Payment card data is processed by Stripe and never stored on our servers.
• Communications — if you contact us by email, we store that correspondence.
• Templates you choose to save — on Starter and Pro, you can save PSD templates to your account (“My templates”, or a template made with Mockup from a photo) and group them into packages, so they open on any device where you're signed in. We then store the file, a small preview image and the name you give it. Saved templates are private: only you can see or load them. They are never shown to other users, never added to the Scaylr library and never used to train AI.

2.2 Data Collected Automatically

• Usage data — pages visited, features used, session duration. Used to improve the product.
• Technical data — browser type, operating system, IP address, referring URL. Used for security and analytics.
• Cookies — we use essential cookies to keep you logged in, and analytics cookies to understand how people use Scaylr. See our Cookie Policy for details.

2.3 What We Do NOT Collect

• Your PSD files — all processing happens in your browser via a sandboxed rendering engine. A PSD is only uploaded if you choose to save it to your account (see 2.1).
• Your design images — same as above. Everything stays on your device.
• Your generated mockups — exports are created and downloaded entirely client-side.

3. How We Use Your Data

• To provide and improve the Scaylr service
• To manage your account and subscription
• To process payments via Stripe
• To send transactional emails (receipts, account notifications)
• To respond to your support requests
• To comply with legal obligations

4. Legal Basis for Processing (EU/UK Users)

Scaylr is subject to the UK GDPR (as a UK-based business) and the EU GDPR (for EU users). We also comply with applicable privacy laws in the US (including CCPA for California residents) and Australia (Privacy Act 1988). We process your personal data on the following legal bases:

• Contract performance — to deliver the service you signed up for
• Legitimate interests — to improve the product, prevent fraud, and ensure security
• Consent — for non-essential cookies and marketing communications
• Legal obligation — where required by law

5. Who We Share Data With

We do not sell your personal data. We share data only with trusted third parties necessary to run the service:

• Stripe — payment processing. Stripe Privacy Policy
• Cloudflare — hosting, CDN, and security. Cloudflare Privacy Policy
• Resend — sends our emails (account emails, receipts and, if you haven't unsubscribed, occasional updates). It receives your email address and the message. Resend Privacy Policy
• OpenAI and Google (Gemini) — only when you use an AI listing feature (for example AI titles, tags and descriptions). The product image you choose and the details you enter are sent to generate the text, through Cloudflare's AI Gateway. Mockup generation itself does not use them. OpenAI Privacy Policy · Google Privacy Policy
• Microsoft Clarity — website analytics that shows how visitors use our pages (for example clicks, scrolling and page views) so we can improve them. Microsoft Privacy Statement
• Meta (Facebook) Pixel — measures how our Facebook and Instagram ads perform (for example which visits come from an ad). Meta Privacy Policy
• Photopea — a browser-based editor we load only as a backup for the few templates our own engine can't read yet. It runs in your browser. Photopea Privacy Policy
• Crisp — live chat, only if you click “Chat with us”. Crisp then receives your messages, your IP address, browser details, the page you are on and, if you are signed in, your email address and name, so we can reply. Crisp Privacy Policy
• Google Analytics — website analytics. Data may be processed in the US. Google Privacy Policy. You can opt out via the Google Analytics Opt-out Browser Add-on.

6. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we delete your personal data within 30 days, except where we are required to retain it for legal or accounting purposes (typically up to 7 years for financial records).

Accounts that have not verified their email address are automatically deleted after 30 days. Free accounts with no login activity for 12 months may also be deleted. Paid accounts and accounts with billing history are not affected by automatic cleanup.

Saved templates are kept while you have an active Starter or Pro plan or trial. If your plan or trial ends, they are kept for 30 days so nothing is lost if you come back, and we email you before they go; after that they are permanently deleted. If you delete a template or your account, its files are deleted straight away.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — ask us to delete your data ("right to be forgotten")
• Portability — receive your data in a machine-readable format
• Objection — object to processing based on legitimate interests
• Withdraw consent — where processing is based on consent

To exercise any of these rights, email us at info@scaylr.io. We will respond within 30 days.

California Residents (CCPA)

If you are a California resident, you have the right to know what personal information we collect, the right to delete it, and the right to opt out of its sale. We do not sell personal information. To exercise your rights, contact us at info@scaylr.io.

Australian Residents

If you are located in Australia, you have rights under the Privacy Act 1988 (Cth). You may request access to or correction of your personal information by contacting us at info@scaylr.io. If you are unsatisfied with our response, you may contact the Office of the Australian Information Commissioner.

8. Cookies

We use the following types of cookies:

• Essential cookies — required for the service to function (session, authentication). Cannot be disabled.
• Live chat — nothing from our chat provider (Crisp) loads until you click “Chat with us”. Once you do, Crisp stores a cookie and local storage in your browser to keep your conversation, and the chat stays available on the pages you visit next. Clearing your browser data for scaylr.io removes it.
• Site version cookie — when we test two versions of a page, a first-party cookie (scaylr_ab, 90 days) remembers which version you were shown, so the page doesn't change between visits. It holds only the version letter, nothing about you, and is never shared.
• Analytics cookies — Google Analytics and Microsoft Clarity, to understand how visitors use Scaylr (pages visited, session duration, clicks and scrolling, referral source). This data is anonymised where possible. Can be declined via your browser settings or our cookie consent banner.
• Advertising cookies — the Meta Pixel, to measure how our Facebook and Instagram ads perform.

You can manage cookie preferences through your browser settings or our cookie consent banner.

9. Data Security

We implement industry-standard security measures including HTTPS encryption, secure storage, and access controls. Mockups are made in your browser: your designs and templates are not uploaded to make them. Templates you choose to save to your account are kept in private, encrypted storage (Cloudflare R2) that only your signed-in account can read. The exception is the AI listing feature, which sends the image you choose to the AI provider (see section 5). Payment data is handled entirely by Stripe's PCI-compliant infrastructure.

10. International Transfers

Scaylr is hosted on Cloudflare's global network. Some of the providers in section 5 (for example Stripe, Resend, OpenAI, Google, Microsoft, Meta and Crisp) may process data in the United States or elsewhere outside the UK. As a UK-based business, we ensure that any international transfers of personal data from the UK comply with UK GDPR requirements, using appropriate safeguards such as Standard Contractual Clauses where applicable. EU users' data transfers are protected under equivalent EU GDPR mechanisms.

11. Children's Privacy

Scaylr is not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us at info@scaylr.io.

12. Shopify App — Merchant Data

This section applies specifically to merchants who install Scaylr through the Shopify App Store.

Data collected via the Shopify integration

When you install Scaylr through the Shopify App Store, we collect and store the following: your shop domain, shop name, and a Shopify OAuth access token used to act on your behalf within your store. We also store product data you choose to publish through Scaylr, including titles, descriptions, images, and tags.

How we use it

Your shop credentials are used solely to create and manage product listings in your Shopify store at your direction. We do not sell, share, or use your store data for any purpose other than providing the Scaylr service to you.

Data retention and deletion

When you uninstall the Scaylr app from your Shopify store, we permanently delete all associated shop data — including your access token, shop domain, and any stored listing data — within 48 hours. You may also request deletion at any time by contacting info@scaylr.io.

GDPR compliance for Shopify merchants

In accordance with Shopify's requirements, Scaylr supports the following mandatory data webhooks: customer data access requests, customer data deletion requests, and shop data deletion. If you or your customers submit a data request through Shopify, we will respond within the required timeframe.

Shopify as a data processor

Scaylr accesses your store data through Shopify's official API under the permissions you grant at installation. Shopify's own privacy policy governs data processed on their platform.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by posting a notice on the website. The "Last updated" date at the top of this page reflects the most recent revision.

14. Contact

For any privacy-related questions or requests, contact us at:
info@scaylr.io