Privacy Policy

General

This policy explains how rmwatermark.net (“we”, “us”) handles personal data when providing the website, online tools and API. We process data in accordance with applicable data protection laws and only when we have a lawful basis, such as performing a contract, complying with a legal obligation, protecting legitimate interests or obtaining your consent.

This policy applies to data submitted to or generated by the service. Third-party websites and services are governed by their own privacy policies. We do not make automated decisions or build profiles that produce legal or similarly significant effects based solely on personal data.

Information we process

Depending on the features you use, we may process:

• Account information: the account identifier, email address, name and avatar provided through a third-party sign-in such as Google and authenticated by Supabase.
• Content you submit: uploaded images, masks, editing instructions, prompts and related job parameters.
• Job information: job status, results, error messages and processing time.
• Credit and transaction information: credit balance, earned and spent records, payment amounts, subscription status and transaction details returned by the payment provider. We do not store full card numbers or security codes; Stripe processes them directly.
• Communications: enquiries, feedback and attachments you send through support channels.
• Technical logs: IP address, access time, request URL, status code, traffic volume, browser and operating system identifiers, and referring page.

Purposes and legal bases

We use the information to: provide image processing and related features; create and manage accounts; settle credits and handle billing and subscriptions; keep the service secure, diagnose faults and prevent abuse and fraud; respond to enquiries and handle complaints and disputes; comply with legal obligations; and analyse usage on an aggregated or de-identified basis to improve the service.

The legal bases are performance of our contract with you, compliance with legal obligations, our legitimate interests such as security and improvement, and consent where required by your local law. You may withdraw consent at any time; withdrawal does not affect the lawfulness of processing before withdrawal.

How uploaded images are handled

Uploaded images and editing instructions are used only to carry out the processing you request and generate results. Data is encrypted in transit using HTTPS, stored in private storage and accessed through time-limited signed links. We do not publish or sell your images, and we do not use them for purposes unrelated to your request. We disclose them to third parties only as necessary to run the service (see “Service providers and international transfers”) or where required by law.

Images are scheduled for deletion after about one hour, although outages may delay cleanup; signed links expire. Do not upload content you are not authorised to share or highly sensitive personal information.

Service providers and international transfers

To operate the service, we share necessary data with the following categories of providers: Supabase for authentication, database and image storage; Matina for image processing; AI providers called depending on the selected mode, including DashScope for detection and Seedream for generative image editing; Stripe for payment processing; and providers of hosting, network and security services.

We provide only the information needed for the relevant purpose and require providers to apply appropriate safeguards. These providers may process data outside your country or region. Where required by applicable law, we rely on lawful transfer mechanisms such as standard contractual clauses.

Cookies and local storage

Cookies are used for sign-in and session management. The browser uses sessionStorage and IndexedDB to keep the image you selected, job context, editing recovery information and preferences. This storage is generally necessary to provide the service and is not used for advertising. We currently do not use third-party advertising trackers.

If we introduce analytics tools in the future, we will describe them in this policy and provide choices or obtain consent as required by law. You can clear cookies and site data through your browser settings, but this may sign you out or make job recovery information unavailable.

Retention

Uploaded images and generated results are cleaned up after about one hour. Server logs are normally retained for no more than three months, unless a security investigation or the law requires longer retention. Account, job, credit and transaction records are kept while the account is active and afterwards for as long as needed for reconciliation, dispute handling, fraud prevention and legal obligations. Support communications are kept for a reasonable period after the issue is resolved.

When a retention period ends, we delete or anonymise the data. Records required by law, or needed to establish, exercise or defend legal claims, may be kept longer.

Your rights

Subject to applicable law, you have the right to access, correct and delete your personal data, restrict or object to processing, receive a copy of your data, withdraw consent and ask for information about our processing. You can make a request through the support channel published on the website. To protect data security, we may need to verify your identity, and we will respond within the period required by law.

A deletion request may not be fully satisfiable because of legal retention obligations or the rights of others; we will explain why. If you believe our processing infringes your rights, you may lodge a complaint with your local data protection authority.

Security

We protect data with access controls, server-side credentials, private storage, time-limited signed links and authenticated callbacks. No transmission or storage over the internet is completely secure, and we cannot guarantee protection against every unauthorised access. If a data security incident is likely to affect your rights, we will notify you and the relevant authorities as required by applicable law.

Keep your account credentials and API keys secure, and avoid staying signed in on shared devices.

Children

The service is not directed at children under 14 or a higher age set by your local law, and we do not knowingly collect their personal data. If you are not old enough to consent to processing yourself, use the service only with the consent and guidance of a parent or guardian. If we learn that we have collected children's data unintentionally, we will take steps to delete it.

Changes to this policy

We may update this policy to reflect changes in the service, technology or law. An updated version will be published on this page with its date. If a change materially affects the purposes of processing, the types of data or how data is shared, we will provide reasonable notice.

Continuing to use the service means you accept the updated policy; if you do not agree, please stop using the service and you may request account deletion.

Contact

If you have questions about this policy, wish to exercise your rights or make a complaint, contact us through the support channel published on rmwatermark.net. We will respond within a reasonable time.