Privacy policy

1. Privacy at a glance

imgmarker adds a visible label and machine-readable metadata to images. To do that, your images are transmitted to our server, processed and offered back to you for download. They are then deleted automatically after 60 minutes.

There are no user accounts. Image content is never analysed automatically and never passed on to third parties. We use Google Analytics to measure how the site is used, described in section 8.

2. Controller

The controller responsible for data processing on this website is:

MOVA Empire UG (haftungsbeschränkt)
Bonnstr. 5
45470 Mülheim an der Ruhr, Germany
Represented by: Marc Wegerhoff (Managing Director)

Phone: +49 (0)208 – 385 510 54
Email: info@imgmarker.net

3. Hosting

This website is hosted on a server located in Germany, operated by:

Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen, Germany

A data processing agreement pursuant to Art. 28 GDPR is in place with the hosting provider. Your images do not leave Germany at any point during processing.

Legal basis: Art. 6(1)(b) GDPR (performance of the requested service) and Art. 6(1)(f) GDPR (legitimate interest in a secure and efficient provision of our service).

4. Processing of uploaded images

Images you upload are used exclusively to label them. A visible badge is drawn into the image and IPTC/XMP metadata is written, in particular the value DigitalSourceType, which marks the image as AI-generated or AI-edited in a machine-readable way.

Deletion: source files, results and the associated database record are deleted completely and automatically no later than 60 minutes after processing. There is no permanent storage and no backup of your images.

Images may contain personal data, for example if people are depicted or if the file carries embedded metadata such as location or camera details. We do not evaluate this data. Any metadata already present in the file is preserved as far as technically possible.

If you enter optional details (creator, description, credit), these are embedded into the image file you download. They are stored on our server only for the duration of processing.

Legal basis: Art. 6(1)(b) GDPR – the processing is necessary to deliver the service you requested.

5. Abuse prevention

To keep illegal material off this service, uploaded images can be reviewed by us while they exist, meaning within the 60 minutes before they are deleted. This review is manual and serves no other purpose: image content is not analysed automatically, not profiled and never passed to third parties.

If we find illegal content we can block further uploads from the same origin. The block is stored as a hash, never as a plain IP address. Where the law requires it, we report illegal content to the competent authorities.

Evidence: in a concrete suspected case we can exempt an individual upload from automatic deletion so that it can be handed to the authorities. Such an image is kept together with its upload time and IP address, because it proves little without them. This applies only to specific cases, never to uploads in general, and the data is deleted as soon as the matter is closed.

Legal basis: Art. 6(1)(f) GDPR - our legitimate interest in operating the service lawfully and protecting it from misuse.

6. Content Credentials (C2PA)

If an uploaded image carries C2PA Content Credentials, labelling invalidates them: adding the badge re-encodes the image, so the signature issued for the original pixels no longer matches. We point this out before processing and ask for your explicit consent. With that consent the invalidated credentials are removed rather than left behind in a broken state, because verification tools report a broken signature as tampering.

Legal basis: Art. 6(1)(a) GDPR (consent).

7. IP address and usage quota

To limit free usage, we store a cryptographic hash (HMAC-SHA256) of your IP address together with a counter for at most 24 hours. Blocks after a confirmed abuse case are stored the same way, as a hash rather than an address.

Your IP address itself is stored alongside an upload for as long as the upload exists, meaning at most 60 minutes. It serves a single purpose: enabling us to report illegal content to the authorities, who cannot act on a hash. It is deleted together with the images and is not used for anything else - no profiling, no analysis, no transfer to third parties beyond a report required by law.

Legal basis: Art. 6(1)(f) GDPR – legitimate interest in protecting the service against automated misuse and in being able to meet legal obligations when illegal content is found.

8. Server log files

The web server automatically records information that your browser transmits: browser type and version, operating system, referrer URL, host name, time of the request and IP address. This data is not merged with other sources and is used solely to operate the service securely and to diagnose faults.

Legal basis: Art. 6(1)(f) GDPR.

8. Google Analytics

We use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to understand how this site is used. It records events such as page views and the approximate region a visit comes from. IP addresses are shortened before any evaluation.

Data may be transferred to Google LLC in the United States. Google is certified under the EU-US Data Privacy Framework; transfers are additionally covered by the standard contractual clauses of the EU Commission. We have no influence over processing carried out by Google itself. Details: policies.google.com/privacy.

You can object at any time by using the browser add-on Google provides at tools.google.com/dlpage/gaoptout, or by blocking the corresponding cookies in your browser.

Legal basis: your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG, revocable at any time with effect for the future.

9. Cookies

A single, technically necessary session cookie enables protection against cross-site request forgery (CSRF) and is deleted when you close your browser. Beyond that, only the cookies of the services named above are set, and only once you have consented to them.

Legal basis for the necessary cookie: § 25(2) No. 2 TDDDG - strictly necessary for providing the service you requested.

10. Contacting us

If you contact us by email or phone, your enquiry and all personal data it contains is stored and processed in order to handle your request. We do not pass this data on without your consent. It is deleted once your request has been dealt with, unless statutory retention periods apply.

Legal basis: Art. 6(1)(b) or (f) GDPR.

11. TLS encryption

This site uses TLS encryption for all transfers. You can recognise an encrypted connection by the address bar showing “https://” and the lock symbol in your browser. While encryption is active, the data you send us cannot be read by third parties.

12. Your rights

You have the right to obtain information about your stored personal data, its origin, recipients and the purpose of processing, free of charge, as well as the right to rectification, erasure, restriction of processing and data portability. You may withdraw consent you have given at any time with effect for the future.

You also have the right to object to processing based on Art. 6(1)(e) or (f) GDPR on grounds relating to your particular situation (Art. 21 GDPR).

Please note that because uploaded images are deleted automatically after 60 minutes, we are usually unable to provide information about a specific past upload – by then no data relating to it exists any more.

13. Right to lodge a complaint

In the event of breaches of the GDPR you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work or the place of the alleged breach.

The competent authority for the controller is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestr. 2–4, 40213 Düsseldorf, Germany.

14. Objection to promotional emails

We hereby object to the use of contact data published under our legal notice obligation for sending unsolicited advertising and information material. We expressly reserve the right to take legal action in the event of unsolicited advertising being sent to us.