Privacy

How we look after your information

This notice describes how The Pop Street (“we”, “us”) handles personal information when you use our website, start a brief, subscribe to our software, or use Pop Dispatch hosted services. It applies worldwide.

Last updated: November 4, 2026

Who is responsible

The Pop Street is the data controller for the processing described here. For Pop Dispatch hosted services where we process personal information on your behalf, our Data Processing Agreement describes the roles.

What we collect

Brief and portal: your contact details, your answers about your business, files you upload, and messages in your client portal.
Trials and checkout: name, email address, country, and for some products your state or province, business name, address, phone, fleet or business details you choose to give, and the consent choices you tick on the form.
Billing: Stripe collects your card details. We receive tokens, the last four digits, receipts, and any business tax identifier you enter at checkout.
Licenses and devices: license keys, product and plan, device identifiers from activations, domain names you register against a key, and the results of license checks (activate, check-in, updates, revocations) from installed copies.
Pop Vault: encrypted backup files, sizes and timestamps, and metadata needed to match a backup to your license. We store the sealed files only; your apps hold the keys.
Hosted shop (Pop Commerce): identifiers that tie a paid Commerce subscription to the hosted shop we open for your key.
Announcements: whether you opted in to product news, when you opted in or out, and delivery records for service messages about your license, trial or Pop Vault account.
Support: what you send through the Support form and related correspondence.
Security and delivery: IP address, browser type, and similar technical data for fraud prevention, rate limits, and keeping the service running. Cloudflare Turnstile may run on some forms.

Cookies and device storage

We use one essential session cookie so you can stay signed in to the client portal, Studio, or your member account.

With your permission (Accept on our cookie banner, or Cookie settings in the footer), your browser may keep a small note on your device for our “next step” card: first and latest visit dates and whether you closed the card. The note stays on your device; we only receive anonymous daily counts when the card is shown or clicked. You can clear it in your browser’s site data.

If you turn on browser notifications in your account, we store a push subscription for that browser. Offer-style push messages follow the same marketing consent as email; service notices about your license can still be sent.

Your choice is stored in a first-party cookie named consent for twelve months. Decline leaves optional storage off until you Accept.

How we use information

To design website concepts, run your project, and deliver software you subscribe to.
To issue license keys, enforce plan limits, provide downloads and updates, run Pop Vault, and operate the license server and hosted shop.
To bill through Stripe, send receipts, and handle tax where Stripe Tax applies.
To send service messages about your subscription, trial, or Pop Vault account, and product news when you have opted in.
To keep the site and APIs secure and to improve how pages perform for everyone.

Personal information stays with us and our processors for the uses above; we never sell it. This site runs without advertising trackers.

Processors

We use service providers that process information only on our instructions:

Our hosting provider stores the site, briefs, license data, Pop Vault files, and backups of application data.
Our email provider delivers messages to you.
Stripe processes card payments and tax collection at checkout.
Cloudflare may provide network protection and Turnstile checks.

We share information with others only when the law requires it or when you ask us to (for example, registering a domain in your name).

International transfers

We are based in the United States. If you use our services from another country, your information may be processed in the United States and in the countries where our processors operate. Where European data protection law applies, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses for transfers that need them.

How long we keep it

While a website project is active, we keep what you have shared. After a project closes, uploaded files are deleted ninety days later. Concept previews come down after 30 days unless you go ahead with a design.

Trial sign-ups we never verify are removed after 30 days. After a free trial ends, trial personal details are deleted 12 months later unless you become a paying customer.

Member download logs keep IP and browser details for 90 days, then those fields are cleared while the row remains for limits and support.

When a Pop Vault plan ends, new backups stop; you can still download existing copies for sixty days, then they are deleted.

A brief you never finish may be archived after 30 days of inactivity and deleted after 60. A submitted brief is never deleted by that clean-up.

Your rights

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, to object to or restrict some processing, and to withdraw marketing consent at any time. You may also have the right to complain to your local supervisory authority.

GDPR and UK GDPR (European Economic Area and United Kingdom): these rights apply to processing covered by those laws, including our cookie banner choices and marketing opt-in.
CCPA/CPRA (California): you may ask what categories we collect and why, request deletion subject to legal exceptions, and opt out of “sale” or “sharing”; we sell and share personal information only as described in this notice (service delivery with processors).
LGPD (Brazil): you may confirm whether we process your data, access and correct it, anonymize or delete it where applicable, and withdraw consent for optional uses.
DPDP (India): you may access and correct personal data we hold about you and withdraw consent for processing that relies on consent, subject to legal retention needs.

To exercise any of these rights, use our Support form and describe your request. We respond within the time the law gives us, usually within thirty days.

Refunds and terms

Subscription billing and refunds are described in our Terms of Service and Refund policy.

Please do not send

Please do not share passwords, full payment card numbers, or anyone’s health or financial records through the brief, portal, or Support form. If we need access to an existing account, we arrange it with you securely.

The Pop Street.