The short version
Watermark composition runs in your browser. To deliver a signed result, the watermarked file and its original (so existing Content Credentials are preserved in the provenance chain) are sent to our server, processed in memory and returned. The Verifier works the same way. We store nothing, we have no accounts, and we run no analytics.
Controller
Deep Blue Coding Company Limited (Công ty TNHH Lập Trình Xanh), tax code 0317925692, 71/44/3 Đường Phú Thọ Hòa, Phường Phú Thọ Hòa, Ho Chi Minh City, Vietnam — juanma@deepbluecoding.com. Where we offer these tools to users in the EU, the GDPR applies to that processing.
What we process, and why
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Files processed for watermark signing or verification (may contain personal data such as faces) | Adding a C2PA manifest / producing a provenance report | Your request (Art. 6(1)(b) GDPR) | Processed in memory, never written to disk, discarded when the response is sent |
| Standard server logs (IP address, timestamp, request path) | Security and abuse prevention | Legitimate interest (Art. 6(1)(f) GDPR) | Rotated with the host system |
Where processing happens
Files submitted for signing or verification are processed on our server in a Google Cloud region in the EU (europe-west1, Belgium), in memory and never written to disk. The signing key is held in Google Cloud KMS in the same EU region. Deep Blue Coding Company Limited, the controller, is established in Vietnam; it accesses only the aggregate, anonymous usage counters described below — never your files.
Your rights
You can exercise your GDPR rights (access, rectification, erasure, objection, portability) by writing to the address above — though note there is normally nothing to act on, since we keep no copies of your files. You may also complain to your local EU data protection authority.
Analytics
We measure usage in a privacy-preserving, cookieless way, so no consent banner is needed:
Traffic (page views, country, referrer, device) is measured with Cloudflare Web Analytics, which does not use cookies and does not fingerprint or track individuals across sites. Product usage (how many files are watermarked, signed, verified or downloaded, and whether content is Fully AI or AI-modified) is counted by our own service on our EU server. These counters are anonymous: we store an event name, a timestamp and non-identifying properties only — never your IP, never your files, never any personal data.
Cookies
This site sets no cookies.