Privacy Policy
This policy explains what personal data Directory Assets ISLT UG ("we", "us") processes when you use the Directory Plus editor, the Directory Plus Figma plugin, and plus.directory (together, the "Service"), and the rights you have under the General Data Protection Regulation (GDPR). For the mockups.directory shop, the shop's own privacy policy applies.
The short version. We keep data collection minimal: your email for login, your subscription status for access, and billing handled by Stripe. Your artwork renders in your browser. We do not upload or store your designs, unless you save them to your Library. Library files are encrypted on your device, so we store them but cannot open them. We use essential cookies, and cookies for ad measurement only if you agree.
1. Controller
Directory Assets ISLT UG, Friedrichstraße 155, 10117 Berlin, Germany — hi@mockups.directory. Full details in the Impressum.
2. What we process, and why
| Data | Purpose | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Email address + one-time login codes | Account login (magic-link), service emails | (1)(b) contract |
Session cookie (dp_session, httpOnly, up to 30 days) | Keeping you signed in | (1)(b) contract |
| Subscription & purchase status | Knowing which mockups you can access | (1)(b) contract |
| Billing data (name, payment method, invoices) — held by Stripe, not stored on our servers | Payments, taxes, accounting | (1)(b) contract · (1)(c) legal obligation |
| Library (if you set one up): the files you save, encrypted on your device so that we cannot read them, their names and folders (also encrypted), and what we need to run it: the number and size of your files, when they were saved or deleted, and your encrypted keys | Storing what you choose to save | (1)(b) contract |
| Render history: the mockup, the time, the scene and a picture of the pose without your artwork (the picture of the render itself stays in your browser) | So you can find, reopen and license your past renders | (1)(b) contract |
| Licence records of renders with a Commercial License | Proof of the licence you bought, and accounting | (1)(b) contract, (1)(c) legal obligation |
| Technical logs (IP address, timestamps) kept short-term by our hosting providers | Security, abuse and fraud prevention | (1)(f) legitimate interest |
| Usage statistics: which mockups you render and download and when; visits to our pages and the steps towards subscribing, told apart by a random identifier kept in your browser's storage; where a visit came from (the referring site, and the campaign named in a link); your country, as two letters, never your IP address; and basic device details (browser, graphics, screen) sent once per session | Running and improving the Service, seeing which mockups and features are used, measuring our own marketing, and helping customers with problems | (1)(f) legitimate interest |
Advertising measurement, only if you agree: a Meta browser identifier and click identifier (cookies _fbp, _fbc), your IP address and browser details, the page you visited on plus.directory/subscribe, and whether a subscription followed | Seeing which of our Instagram and Facebook ads lead to visits and subscriptions, and letting Meta show our ads to people likely to be interested | (1)(a) consent |
Your content: the designs you place into mockups are processed locally in your browser to produce your renders. We do not receive, upload, or retain your artwork, with one exception: files you choose to save to your Library. Those are encrypted on your device with keys only you hold, before they are sent to us. The pictures in your render history are kept in your own browser and never sent to us; we keep a picture of the pose without your artwork, so a render can be recognised on another device. We store the encrypted files and cannot open them, and neither can our service providers. We also cannot reset your Library password or recover a Library whose keys are lost.
3. Cookies
We use cookies that are strictly necessary to operate the Service, primarily the dp_session login cookie. These need no consent.
Advertising cookies, only with your consent. On our subscribe page we ask whether we may use cookies for ad measurement. If you agree, the Meta pixel (Meta Platforms Ireland Ltd.) is loaded and sets the cookies _fbp and, if you arrived from an ad, _fbc (each kept up to 90 days). Through it Meta receives your IP address, browser details, the page visited and, if you subscribe, the fact that a subscription took place. We do not send Meta your email address, your payment details or anything about your designs. If you decline, or if your browser sends a Global Privacy Control signal, none of this is loaded or sent.
We keep your answer for six months and then ask again. You can change it at any time with Cookie settings at the foot of the subscribe page. Withdrawing consent stops further collection and does not affect what was lawfully processed before.
4. Processors and recipients
We share data only with the service providers needed to run the Service, under data-processing agreements:
- Stripe — payment processing and billing portal
- Shopify — store accounts and purchase records (mockups.directory)
- Resend — transactional email (login codes, receipts)
- Railway — API hosting and database (account data, and the encrypted keys and encrypted details of your Library)
- Netlify — web hosting; encrypted Library files pass through it on their way to storage
- Bunny CDN — content delivery of mockup assets (no account data), and storage of encrypted Library files in Germany
- Meta Platforms Ireland Ltd. (Instagram and Facebook advertising): receives the advertising data described in section 3, only from visitors who agreed. For this processing Meta and we are joint controllers, under Meta's Controller Addendum. Meta may transfer data to Meta Platforms, Inc. in the United States, which is certified under the EU-U.S. Data Privacy Framework.
Some providers process data outside the EU/EEA; where they do, transfers rely on adequacy decisions or EU Standard Contractual Clauses.
5. Retention
Account data is kept while your account is active and deleted or anonymised after closure, except where law requires longer retention (e.g. invoices and accounting records: up to 10 years under German HGB/AO). Login codes expire within minutes; technical logs are short-lived.
Library. Library files are kept until you delete them; files in the Trash are removed after 30 days. When your subscription ends, your Library stays readable for 15 days and is then permanently deleted.
Render history. Your render history is kept while you subscribe and deleted 15 days after your subscription ends. For renders that carry a Commercial License we keep a licence record, without any picture of your artwork, for as long as the licence can be relied on and as accounting law requires. If you delete your Library yourself, its keys are destroyed at once and its files are removed within 24 hours.
6. Your rights
You have the right to access, rectify, erase, restrict, and port your personal data, to object to processing based on legitimate interests, and to withdraw consent where processing is based on consent. Contact hi@mockups.directory — we respond within the statutory deadlines. Library files are encrypted with keys only you hold, so we cannot read them or give you readable copies; you can download them yourself while your Library is available. You also have the right to lodge a complaint with a supervisory authority; ours is the Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI).
7. Changes
We may update this policy as the Service evolves; material changes will be announced by email or in the Service. The current version always lives at this address.