Privacy policy
Last updated: 25 October 2026.
Who is responsible
The data controller is the developer of Invisible Watermark, a sole trader (entrepreneur individuel) registered in France. Contact: the contact form.
Your pictures
Pictures you upload to mark or to check are processed in memory and deleted as soon as the result is sent back to you. They are never saved, logged or shared. When an AI assistant marks a picture for you and asks for a download link, the marked copy waits in memory until the assistant downloads it, for 10 minutes at most, and is deleted at that moment.
What we keep, why, and for how long
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| For each marked copy: a random code, the date, your note (encrypted) | To tell you later which copy a picture came from | Performance of the service you asked for | Account copies: until you delete them or your account. Copies made without an account: 5 years after they are made |
| Account: email, password (stored as a one-way hash), credits, list of your copies | To run your account | Contract | Until you delete your account |
| Email confirmation and password reset links (stored as a one-way hash) | To check that the email address is yours, and to let you choose a new password | Contract | Confirmation link: 15 minutes. Password link: 1 hour |
| Keys for AI assistants: the name you give each key, when it was made and last used, the key itself (stored as a one-way hash) | To let your assistant mark and check pictures with your account | Contract | Until you remove the key or delete your account |
| Purchases: date, pack, amount, payment reference | Accounting | Legal obligation | 10 years |
| Messages sent through the contact form: your email and message | To answer you | Legitimate interest: answering your request | 1 year after our last reply |
| Short-term usage counters (your IP address and network, a random device code) | To give 3 free pictures per person and stop abuse by bots | Legitimate interest: protecting the free service | Daily counters: 7 days. Device counter: as long as the cookie (13 months) |
Cookies
We use two cookies, both needed for the site to work: one keeps you logged in, the other counts your free pictures on this device. There is no advertising, no analytics and no tracker, so there is nothing to accept or refuse.
Who else handles data
Our hosting provider stores the data above on servers in the European Union. Payments go through Stripe Payments Europe, Ltd., which receives your email and payment details to process the payment; see Stripe's own privacy policy. Account emails (the confirmation link and, if you ask for one, the password link) are sent through Mailjet, part of the Sinch group, which receives your email address and the content of those emails to deliver them. We send no newsletters or advertising. We do not sell or share your data with anyone else.
Your rights
You can access, correct, delete or export your data, object to its use, or ask us to limit it. Most of this you can do yourself in your account (list of copies, deletion of a copy, deletion of the account). For anything else, use the contact form. If you think your rights are not respected, you can complain to the CNIL (www.cnil.fr), the French data protection authority.