Who we are
PreviewFly (previewfly.com, app.previewfly.com, the Figma plugin “Mockup Magic” and the PreviewFly MCP server) is run by İsmail Yağcı, Istanbul, Türkiye. He is the data controller for the personal data described here under the Turkish Personal Data Protection Law No. 6698 (“KVKK”), and under the EU General Data Protection Regulation and the UK GDPR (together “GDPR”), which apply because PreviewFly is offered to people in the EU and the UK. Contact for everything in this policy: hello@previewfly.com.
The short version
- You can use PreviewFly as a guest. An account is needed to download images and to connect AI tools.
- We collect what the service needs: your email and name if you sign up, the images you upload, your projects, what you send us for support, and short-lived security data such as IP addresses.
- Your images are analysed on our own server in Istanbul. No outside AI service sees them, and we don’t use them to train AI models.
- No advertising, no tracking cookies, no selling or renting of personal data. We count how PreviewFly is used with our own cookieless statistics, kept on our side and shared with no one. You can switch them off with “Don’t count my visits” in the footer, and we honour your browser’s Global Privacy Control.
- Unused guest projects and unused uploads are deleted automatically after 30 days. You can delete your account at any time.
- Payments are handled by Creem; we never see your card details.
- Some providers we rely on (Cloudflare, MongoDB Atlas, Google, Creem) process data outside Türkiye. Details below.
What we collect and why
When you visit the website or the app
Like any website, our servers and our network provider receive your IP address, browser user agent, the pages and files you request and the time of the request. We use them to deliver the site, keep it secure and investigate errors and abuse. The marketing site’s “try it” tool processes your logo inside your browser; the logo is not uploaded. Fonts for the text tool are fetched by our server, so your browser does not contact Google for them.
To understand how PreviewFly is used and where visitors come from, the website, the app and the Figma plugin send our own server short notes of what happens: the page or screen you open; steps such as opening a product, searching (what you searched for), adding a design or photo, previewing, downloading, placing a mockup in Figma, signing up or starting Pro; errors you were shown; the page you came from and any campaign tags in the link; your browser and device type; and your country, which our network provider reads from your IP address. To tell visits apart without cookies, our server combines your IP address and browser identifier with a random value that changes every day and keeps only the result: the IP address itself is not stored, and once the day’s value is deleted (after two days) the result can no longer be tied to you. If you are signed in, these notes are linked to your account, so we can see how people use the product and where they first heard of us. They are not shared with anyone, not used for advertising and not combined with data from other sites.
Don’t count my visits. The link in the footer of the website and the app sets a preference cookie
(pf_notrack); from then on your browser sends none of these notes and our server keeps none that
arrive. Browsers that send the Global Privacy Control signal get the same without doing anything. We don’t respond
to the older “Do Not Track” setting separately, because we don’t track you across sites in the first place.
When something goes wrong
When our server or your browser runs into an error, we record what failed, where (the page, the step, the request), your browser and device type and, when you were signed in, your account, linked to the statistics visit above. We use this only to find and fix faults. These records are deleted after 90 days; when you delete your account they no longer name it.
When you use the app as a guest
The first time you create a project or keep a photo, we set a random guest identifier in a cookie (see Cookies). We store only a one-way hash of it, next to your projects, so that your browser can find them again and nobody else can list them. We don’t ask for your name or email as a guest.
Images, designs and projects
- Product photos you upload: the photo (resized to at most 2048 px; camera metadata such as GPS location is not kept), its file name, and the data our analysis derives from it (cut-out masks, depth, surface and lighting maps, detected objects and materials).
- Designs (logos, artwork and text you type) you place, and the projects you create: the design file, a preview thumbnail and the project’s settings (product, print area, technique, position).
- Rendered images made when you preview or download a mockup, kept briefly as a cache.
- Answers you give the app, for example what a product is made of. We keep the answer with the photo to show your mockup correctly and to check how accurate our material detection is.
We process these to provide the service you asked for: showing your design on the product, saving your work and giving you the image. If a photo shows people, see Your images.
Your account
- Email address and name, to identify you, sign you in and send you service emails.
- Password, stored only as a salted scrypt hash (we cannot read it), if you choose one.
- One-time sign-in codes, stored as a hash for 10 minutes, and emailed to you.
- Sessions: a hash of your session token, with the IP address and browser user agent of the sign-in, so you stay signed in and we can detect misuse.
- Sign-in attempts (email address and IP address), to limit password guessing and code abuse.
- Your API key, stored only as a hash with its last four characters and when it was created and last used.
- Your plan: whether you used your free download; if you start Pro or buy a pack, the customer, subscription and order identifiers Creem gives us, your plan (monthly or yearly), its status (trial, active, cancelled, payment problem), its renewal date and how many pack mockups you have left. We also keep the identifiers of the payment events Creem sends us for 30 days, so none is applied twice.
Pro and packs are paid through Creem (Armitage Labs OÜ, Tallinn, Estonia), which sells them as merchant of record. When you start a checkout we send Creem your email address and your PreviewFly account identifier, so the payment is tied to your account. You enter your card, name and billing address on Creem’s checkout, and Creem processes them as a controller under its own privacy notice, to charge you, collect taxes, issue invoices and prevent fraud. We don’t receive your card number.
The emails we send are service messages only: sign-in codes, a welcome note when you create an account, security notices (a password change, a new API key, account deletion), messages about your plan and payments, and answers to your support requests. We don’t send marketing emails. If we ever want to, we will ask for your consent first and every such email will let you unsubscribe.
“Continue with Google”
If you sign in with Google, Google sends us your Google account ID, your email address (and whether Google has
verified it) and your name. We ask only for the basic openid, email and
profile permissions, use this data only to create and sign in to your PreviewFly account, and do not
store your profile picture. We never share or sell data received from Google, and we do not use it for advertising.
You can remove PreviewFly’s access at any time at
myaccount.google.com/connections; deleting your
PreviewFly account deletes the data we received from Google. Our use of information received from Google APIs
adheres to the Google API
Services User Data Policy.
AI tools (MCP server) and the Figma plugin
When you connect an AI tool with your API key, the tool sends us what you ask it to: product choices, techniques, the logo or photo files you point it at, and project names. We treat these exactly like uploads made in the app. Your AI tool’s own provider processes your conversation under its own terms; we only receive the requests that reach our API.
The Figma plugin sends us the layer you choose to use as a design and any photo you pick, and keeps its window settings and which release notes you have seen in Figma’s own storage on your computer. A mockup placed in a Figma file carries a link to its project, so people who can edit that Figma file can open their own copy of the mockup’s project (its design, photo and settings) to change it. Remove the mockup from the file if you don’t want that.
Support requests, feedback and emails
When you ask for help in the app, we keep your name and email, your message, the files you attach and some context to understand the problem: the page and project you came from, your plan, your browser, operating system, screen size, language and time zone. We use them to answer you, and keep the request and its files for 2 years after its last message, then delete them automatically. Please don’t send passwords or card numbers.
The feedback form collects your message, its type, the page you came from, your browser user agent, your IP address (to limit abuse) and, only if you give it, your email address so we can reply. Emails you send to hello@previewfly.com are kept in our mailbox so we can answer and follow up.
Legal bases
We process personal data on these grounds under KVKK Article 5(2) and GDPR Article 6(1):
| Activity | KVKK | GDPR |
|---|---|---|
| Account, sign-in, service emails, API key, Pro and packs, projects, uploads and rendering | Art. 5(2)(c): necessary for the contract (our Terms) | Art. 6(1)(b): contract |
| Guest identifier and guest projects | Art. 5(2)(c), and (f) our legitimate interest in letting you work without an account | Art. 6(1)(b) and (f) |
| Support requests and their files | Art. 5(2)(c) for paid plans; (f) legitimate interest in helping the people who use PreviewFly | Art. 6(1)(b) and (f) |
| Our own usage statistics (pages, steps, where visits come from), with “Don’t count my visits” | Art. 5(2)(f): legitimate interest in understanding how the service is used and found, and improving it | Art. 6(1)(f) |
| Error records | Art. 5(2)(f): legitimate interest in a service that works; (ç) where security rules require it | Art. 6(1)(f) |
| Security logs, rate limits, abuse prevention | Art. 5(2)(f): legitimate interest in a secure service; (ç) where a law requires us to keep logs | Art. 6(1)(f), and (c) where a law requires it |
| Feedback, replying to your emails, checking our material detection | Art. 5(2)(f): legitimate interest in improving and supporting the service | Art. 6(1)(f) |
| Records of what was deleted and when (no content, no names) | Art. 5(2)(ç): legal obligation (the KVKK regulation on deletion) | Art. 6(1)(c) and (f) |
| Establishing or defending legal claims | Art. 5(2)(e) | Art. 6(1)(f) |
Your email address and the data needed to run your account are needed for the contract: without them we cannot give you an account. Everything else is optional. We don’t rely on your consent for any of the above, and we never make consent a condition of using PreviewFly. If we ever want to do something that needs consent, we will ask for it separately and you can refuse or withdraw it. Data is collected by automated means (through the website, the app, the Figma plugin, the API and the MCP server) and, for emails you send us, by non-automated means.
Your right to object
Where we rely on our legitimate interests (the rows marked “(f)” above), you can object at any time, for reasons relating to your situation, by writing to hello@previewfly.com. We then stop unless we have compelling legitimate grounds or need the data for legal claims. For our usage statistics you don’t need to give a reason: use “Don’t count my visits”.
What we don’t do
- We don’t sell, rent or trade personal data, and we don’t share it for cross-context behavioural advertising.
- We don’t show ads, use advertising or cross-site tracking cookies, or build marketing profiles.
- We don’t use your uploads, designs or projects to train AI models, and we don’t send them to outside AI services.
- We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects.
- We don’t show your photos or projects to other users, except the Figma case above. Images are delivered through links that contain a random identifier; anyone you share such a link with can open it.
Your images and automated analysis
To place your design realistically, our server analyses each product photo automatically: it finds the products in it, separates them from the background, and estimates their shape, surface, lighting and material. This runs entirely on our own server in Istanbul; no image is sent to an outside AI service. The analysis describes the product. It does not identify people, and we do not use it to make decisions about anyone.
Please upload only photos you are allowed to use. If a photo shows other people, you are responsible for having their permission (see our Terms). Anyone shown in a photo uploaded to PreviewFly can ask us to delete it at hello@previewfly.com.
The blank product photos in our mockup library are AI-generated and labelled as such; see What is AI here.
Service providers and transfers abroad
We use a small number of providers to run PreviewFly. Except Creem, which is a controller for the payment data it collects, they process personal data on our behalf and under our instructions, and are not allowed to use it for their own purposes:
| Provider | What for | Where |
|---|---|---|
| Data-centre provider in Istanbul | The server that runs the app and stores uploads, projects, renders and support files | Türkiye |
| Cloudflare, Inc. | Network, security and delivery of all our sites (all traffic, including uploads, passes through it), DNS, storage of public site files, sending sign-in emails | Global network; USA |
| MongoDB, Inc. (MongoDB Atlas, on Amazon Web Services) | Database for accounts, sessions, sign-in attempts, kept photos, support requests, error records and our usage statistics | Frankfurt, Germany |
| Google LLC | “Continue with Google” sign-in; our hello@previewfly.com mailbox (Google Workspace) | USA and other countries |
| Creem (Armitage Labs OÜ) | Checkout and payments as merchant of record (as a controller for that data); we send it your email and account identifier and it tells us the state of your plan | Estonia (EU) |
Using these providers means personal data leaves Türkiye. We do this only to provide the service.
- From Türkiye. KVKK Article 9 allows transfers abroad with appropriate safeguards. We use the standard contracts published by the Turkish Personal Data Protection Authority with our providers and notify each signed contract to the Authority within five business days, as the law requires; we are completing this with each provider listed above. You can ask us which safeguard covers a given provider.
- From the EU and the UK. When you use PreviewFly from the EU or the UK, you send your data to us in Türkiye. Türkiye has no adequacy decision from the European Commission or the UK. Our US providers that are certified under the EU–US Data Privacy Framework (and its UK extension) receive data under it, and our providers’ contracts include the European Commission’s Standard Contractual Clauses.
- Authorities. We may disclose data to courts or authorities when the law requires it.
Cookies and local storage
We use only cookies that the service needs to work, and one that remembers a choice you made. None of them tracks you across sites, so there is no cookie banner.
| Name | Purpose | Lifetime |
|---|---|---|
ff_guest | Remembers your guest projects (a random identifier; set when you first create a project or keep a photo) | 90 days, renewed while you keep working; the projects behind it are deleted after 30 days without use, and the cookie is removed when you sign in |
ff_session | Keeps you signed in | 30 days, or until you sign out |
ff_google | Protects “Continue with Google” against forged requests | 10 minutes |
pf_notrack | Remembers that you chose “Don’t count my visits” | 1 year, or until you turn counting back on |
Cloudflare cookies (such as __cf_bm) | Set by our network provider to tell people from bots and protect the service | Up to 30 minutes, or as described by Cloudflare |
Your browser’s local storage keeps a few settings that never leave your device: on the website, whether you turned
its sounds on (previewfly:sound); in the app, the newest release notes you have seen
(previewfly.seenRelease) and, only for testers who turn them on, test features
(previewfly.lab). pf.internal is set only in our own team’s browsers so our visits can be left
out. The Figma plugin keeps its settings in Figma’s own storage. We use no advertising, social-media or third-party
analytics cookies.
How long we keep data
| Data | Kept |
|---|---|
| Guest projects | Deleted automatically 30 days after they were last opened or changed |
| Projects in an account | Until you delete them or your account |
| Uploaded photos and everything derived from them | While a project uses them or you keep them in “My mockups”; deleted automatically once no project uses them and they are at least 30 days old |
| Rendered images | A cache: only the 60 most recent renders across all users are kept; older ones are deleted as new ones are made |
| Account (email, name, password hash, API key hash, plan) | Until you delete your account |
| Identifiers of payment events from Creem | 30 days |
| Sessions | 30 days, or until you sign out or change your password |
| Sign-in codes | 10 minutes |
| Sign-in attempts (email, IP address) | 1 hour |
| Server logs with IP addresses | Up to 30 days |
| Our usage statistics (pages, steps, source, country, device type; linked to your account if you were signed in) | 400 days, then deleted automatically. The daily value that lets us count visits is deleted after 2 days. When you delete your account, the link to it is removed at once |
| Error records | 90 days; when you delete your account they no longer name it |
| Support requests and their files | 2 years after the last message, then deleted automatically |
| Feedback (including the IP address sent with it) | 12 months, then deleted automatically; sooner on request |
| Emails you send us | As long as needed to answer you and keep a record of our conversation |
| Records of automatic deletions (date, kind, how many; no content or names) | 3 years, as the KVKK regulation on deletion requires |
When you delete your account, we cancel your subscription and delete your account record, your projects, your kept photos list and your API key at once; Creem keeps the payment records it must keep by law; photos you uploaded follow the rule above. Our database provider may keep encrypted backups for a limited period under its own security practices. Where a law requires us to keep something longer, we keep only that, only as long as required.
Security and breaches
All traffic is encrypted (HTTPS). Passwords are stored as salted scrypt hashes; session tokens, API keys and sign-in codes are stored only as hashes. Sign-in is rate-limited, the app is reachable only through our network provider’s encrypted tunnel, and administrative access is restricted to key-based logins. No system is perfectly secure. If a breach affects personal data, we notify the Turkish Personal Data Protection Board within 72 hours of learning of it, and the supervisory authorities in the EU or the UK where the GDPR requires it, and we tell the people affected as soon as reasonably possible.
Your rights
Under KVKK Article 11 you have the right to:
- learn whether we process your personal data, and request information about it;
- learn the purpose of the processing and whether data is used for that purpose;
- know the third parties in Türkiye or abroad to whom data is transferred;
- ask for incomplete or incorrect data to be corrected, and for data to be deleted or destroyed under KVKK Article 7;
- ask for corrections and deletions to be notified to the third parties the data was transferred to;
- object to a result against you that arises solely from automated analysis;
- claim compensation for damage caused by unlawful processing.
Under the GDPR you also have the rights of access, rectification, erasure, restriction, data portability and objection (see Your right to object). People elsewhere, for example in Brazil, Canada or Switzerland, have similar rights under their own laws, and we answer every request the same way.
How to ask. Email hello@previewfly.com from the address on your account, or send us a signed letter. Please include your name, your email address and your request; if you are a guest, include a link to a project or image so we can find your data. You can write in Turkish or English. We answer free of charge within 30 days; if a request is complex, we may need longer where the law allows (under the GDPR, up to two more months) and we will tell you why. Many things you can also do yourself: your name and API key are on the Account page, and deleting your account there removes your data as described above.
Complaints
Please tell us first at hello@previewfly.com; we confirm every complaint within 30 days and answer it. You can also complain to the Turkish Personal Data Protection Board (kvkk.gov.tr), to the data protection authority of the EU country where you live or work, to the UK Information Commissioner’s Office (ico.org.uk), or to the authority of your own country, such as the Swiss FDPIC or Brazil’s ANPD.
Age limit
PreviewFly is a work tool for people aged 18 or over and is not meant for children. We don’t knowingly collect data from anyone younger; if you believe a minor has given us personal data, tell us and we will delete it.
Changes to this policy
We update this policy when the service or the law changes, and show the date of the last update at the top. If we want to use personal data for a new purpose, we will update this policy before we start, apply it only to data collected after that, and where the law requires, ask for your consent. Significant changes are shown in the app.
Contact
İsmail Yağcı (PreviewFly), Istanbul, Türkiye · hello@previewfly.com
Türkçe: KVKK aydınlatma metni
6698 sayılı Kişisel Verilerin Korunması Kanunu’nun 10. maddesi uyarınca hazırlanan aydınlatma metnimiz Türkçe olarak ayrı bir sayfadadır: KVKK Aydınlatma Metni.