MockupFlow is a local-first desktop application: your designs, listings, and encrypted API keys live on your own machine. The third parties below are the service providers ("sub-processors") that may process limited data on our behalf to run licensing, software updates, payments, and the offline webhook relay. This page complements our Privacy Policy.
| Provider | Purpose | Data processed | Region | Transfer safeguard |
|---|---|---|---|---|
| Supabase | License validation, software-update bootstrap, and the offline webhook relay/proxy (Etsy API proxy; Shopify/Printify/Gelato order-webhook queue) | License key + machine fingerprint; transiently, order-webhook payloads (incl. customer name/address) queued ≤7 days; Shopify GDPR webhook audit log 7 years | US | SCCs (per Supabase DPA) |
| Lemon Squeezy (Stripe) | Payments & merchant of record (checkout, tax/VAT, invoicing) | Buyer name, email, billing address, payment method | US | SCCs / DPF (per provider) |
| Backblaze B2 | Temporary design-file staging so print providers can fetch by URL (uses your own B2 bucket where configured) | Design image files (no customer PII); 36-hour auto-delete | US | SCCs (per Backblaze DPA) |
| SendGrid | Transactional email (license delivery, support) | Recipient email address | US | SCCs / DPF (per provider) |
| Hetzner | Hosting for the marketing site, licensing endpoint, and the self-hosted trademark blacklist | No customer PII (request logs) | EU (Germany) | Within EEA |
| Provider | Purpose | Data sent | Training on inputs? |
|---|---|---|---|
| OpenRouter | Routes text-AI (SEO, listing copy) | Product/design/SEO text only — never customer PII | Configurable; we offer a Zero-Data-Retention option |
| OpenAI | GPT text + GPT Image generation | Product/design prompts only | No (API inputs not used for training by default) |
| Google (Gemini) via OpenRouter | Text generation | Product/design/SEO text only | Paid tier: no. Free tier may — use a paid key for marketplace data |
| Replicate | Image models (Flux, Recraft, upscaling) | Design prompts only | No; inputs auto-deleted ~1 hour |
| Ideogram | Image generation & layerize | Design prompts only | No (per its API terms) |
| Black Forest Labs | Optional direct FLUX provider | Design prompts only | Per BFL terms — send design prompts only |
| Local (mflux / Ollama) | On-device AI | Nothing leaves your device | N/A — runs locally |
We do not use marketplace data, customer data, or anything derived from the Etsy/Shopify APIs to train our own AI models. Customer personal data is never sent to an AI provider.
We may update this list as our providers change. Material changes will be reflected here with a new "Last updated" date. Questions about a specific transfer? Email info@mockupflow.ai.
DRAFT — verify each provider's current DPA/DPF status before relying on this for a Public-App review; some regions/safeguards should be confirmed with counsel.