Data controller

The data controller is Neuron4 Tech SL, tax ID B67284083, registered at C/ Rosa 28, 08737 Plana de les Torres, Barcelona, Spain. Contact: info@invisible-marks.com.

Local processing and verification links

Trace normally processes files, identifiers and marking passwords inside your browser; original and marked files are not uploaded when you insert or directly verify a mark. Pro and Studio users may optionally create a shareable verification link after a positive verification. For that feature, the evidence file, identifier, reported source URL and related metadata are encrypted in the browser before upload. We store only the encrypted package for up to 7 days. To show the creator whether a link has been opened, we store a counter and the most recent opening time, not the recipient’s identity or IP address for this feature. The decryption key forms part of the complete link, is not sent to our server and must be shared only with intended recipients. Anyone who receives the complete link can decrypt and inspect the evidence in their browser.

Account data

When you create an account, we store your name, email address, a secure password hash, plan, account dates and the metrics required to apply monthly limits. We may also record minimal information about marked copies if history is enabled; never the file or marking password.

Contract acceptance records

To prove which terms were accepted, we store the document version and cryptographic hash, acceptance time and context, account identifier where applicable, and pseudonymous hashes of the anonymous cookie, IP address and browser user-agent. We do not store the IP address in clear text for this purpose. The legal basis is performance of the contract and our legitimate interest in demonstrating compliance and resolving disputes. Records are retained for the life of the account and afterwards for the applicable limitation periods.

Purposes and legal basis

We process data to provide the service, protect accounts, enforce quotas, respond to requests and comply with legal obligations. The legal bases are performance of the contract, pre-contractual measures, our legitimate interest in protecting the service and applicable legal obligations.

Payments

Paddle acts as Merchant of Record and processes the data needed to collect payments, issue invoices, manage taxes and refunds, and prevent fraud under its own terms and privacy notice. Invisible Marks receives the information needed to identify the subscription and activate the plan, but never full card numbers.

Cookies, local storage and analytics

We use an essential session cookie to keep you signed in and local browser storage to remember your language. If you use Trace without an account, we set an essential 30-day random identifier cookie and retain pseudonymous hashes of that identifier and your IP address to enforce the three-image allowance and prevent abuse. We never store the IP address in clear text for this purpose.

Only with your consent, our first-party analytics records a random visitor identifier for up to 180 days and a session identifier until you close the browser. We record pages visited, time, referring domain, selected interface actions and purchase-funnel events, together with pseudonymous IP and browser hashes. We do not record files, marking identifiers, passwords, form contents or full payment details, and we do not use advertising or third-party analytics. The legal basis is consent. Analytics events are retained for up to 13 months. You can withdraw or change consent at any time using the “Cookies” button.

Paddle Checkout is only loaded when an authenticated user starts a purchase and may use strictly necessary technical storage to process the payment and prevent fraud.

Retention and your rights

We retain data while your account remains active and for any legally required period. You may request access, correction, deletion, restriction, portability or objection by emailing info@invisible-marks.com. You may also lodge a complaint with the Spanish Data Protection Agency.