Privacy and cookie policy

This English translation is provided for convenience only. The French version is the authoritative one and prevails in case of any discrepancy.

This policy describes how personal data is processed when you visit saymock.com or use the Saymock service (the “Service”), in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act (Law No. 78-17 of January 6, 1978, “Informatique et Libertés”).

1. Data controller

Tristan Laroubine, sole proprietor (entrepreneur individuel, EI), contact@saymock.com (the “Publisher”).

For personal data that a business customer places in its workspace (invited members, mockup content), that customer is the controller and the Publisher acts as its processor, under Article 9 of the terms of sale.

2. Data processed, purposes and legal bases

The Service contains no advertising and no third-party tracker. Your data is never sold or used to train artificial intelligence models.

Website audience measurement

The saymock.com website (not the application) measures its traffic with a tool built and hosted by the Publisher, without cookies or storage in your browser and without any third party: pages viewed, referring site and campaign links, actions on the page (links followed, command copied, contact form sent), the time the page is visible, type of browser, operating system and device, language, and a country derived from the time zone. Your IP address and your browser’s identifier are not kept: they are only used to compute an anonymous identifier, with a random key that changes every day and is then erased, so a visit can be linked neither to you nor to your visits on other days. These statistics are for the Publisher only, never shared or combined with other data, and kept for 13 months.

This measurement is exempt from consent (Article 82 of the French Data Protection Act). Your browser sends nothing if it asks not to be tracked (“Do Not Track” or “Global Privacy Control”); you can also opt out by opening this link, which remembers your choice in this browser.

Error reports during the beta

While saymock is in beta, the Service records what its team needs to understand and fix a problem: errors in your browser and on the server, the actions that preceded them (pages visited, buttons named by their label, server requests with their status and duration, editing operations by name and element identifier), your browser, window size, language and theme. What you type is never recorded; access tokens, email addresses and secrets in addresses are removed before anything is sent. When the editor hits an error, or when you send feedback from the editor, a copy of the file as it is then is kept, content included, so that the team can reproduce the problem.

These records are stored with the Service in France, seen only by the saymock team (the platform’s operators), never shared, and deleted after 30 days. When an operator opens the copy of a file, it is logged in its workspace’s audit log. This recording is temporary: it will be removed or reduced after the beta.

3. Artificial intelligence Agents

Saymock does not call any artificial intelligence model. When you connect your own Agent (Claude Code, Cursor or another MCP client), the content it reads in the Service is transmitted to it at your initiative and may be processed by the provider of the model it uses. That processing is a matter between you and that provider, under its own terms, and not the Publisher’s.

4. Recipients and processors

Your data is accessible to the Publisher and, depending on the access you grant, to the members of your workspaces and to people who have a share link. It is also processed by the following providers, solely for the needs of the Service:

• Oracle (Oracle Cloud Infrastructure): hosting of the Service, its databases and backups in the Marseille region (France);
• Forward Email: sending the Service’s emails (sign-in links, invitations);
• Google Fonts (Google): when a mockup uses a Google font, your browser downloads it from Google’s servers, which then receive your IP address;
• Google and GitHub, only if you choose to sign in with them: they then act as separate controllers;
• Payment provider, for paid plans, named at the time of subscription.

Images that a mockup loads from an external address are downloaded by your browser from the website concerned, which receives your IP address.

Data may be disclosed to the authorities upon a lawful request.

5. Transfers outside the European Union

The Service and its data are hosted in France. However, some of the providers above are established in the United States or may access the data from there. These transfers are covered by the European Commission’s adequacy decision on the Data Privacy Framework, where the provider is certified under it, or otherwise by the European Commission’s standard contractual clauses.

6. Retention periods

• Account and content: as long as the account is active, then 30 days after it is closed;
• Guest account not linked to an account: 30 days after the last activity;
• Files moved to the trash: 30 days;
• Backups: rolling 14 days;
• Sign-in session: 30 days; sign-in link sent by email: 15 minutes;
• Connection data (IP address, technical logs): one year at most, in accordance with French Decree No. 2021-1362 of October 20, 2021;
• Contact requests: three years at most after the last exchange;
• Workspace audit log: as long as the workspace exists;
• Error reports and file copies taken for them (beta): 30 days;
• Website traffic statistics: 13 months;
• Invoices and accounting records: 10 years (Article L. 123-22 of the French Commercial Code).

7. Cookies and local storage

The Service only sets the trackers strictly necessary for it to work: a session cookie to keep you signed in and secure your requests, and, in your browser’s local storage, your display preferences (light or dark theme). During the beta, the tab’s session storage also keeps a random identifier, erased when the tab is closed, that groups the error reports of that tab. The website’s audience measurement (see above) sets no cookie; if you opt out, your browser’s local storage remembers that choice. These trackers are exempt from consent (Article 82 of the French Data Protection Act), so no cookie banner is needed. You can delete them from your browser, which will sign you out.

8. Security

The Publisher implements appropriate measures: encrypted communications (HTTPS), access control by workspace, project and file, access tokens stored as hashes, daily backups and an audit log. As no system is invulnerable, the Publisher cannot guarantee absolute security; in the event of a personal data breach that presents a risk, it notifies the CNIL (the French data protection authority) and, where applicable, the people concerned.

9. Your rights

You have the right to access, rectify and erase your data, to restrict and object to its processing, and to data portability, as well as the right to give instructions on what happens to your data after your death. To exercise these rights, write to contact@saymock.com from your account’s email address; you will receive an answer within one month. If the data concerns a business customer’s workspace, your request is forwarded to that customer.

You can lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, cnil.fr.

10. Minors

The Service is not intended for people under 15, whose data is not knowingly collected.

11. Changes

This policy may change. The date of the last update appears at the top of the page; significant changes are notified to account holders by email or in the Service.