Privacy Policy

02What We Collect

Who you are, what you upload, what you pay with, and how the product is used.

We do not collect special-category data — health, biometrics, political opinions and the like — and we ask that you do not upload it. We do not knowingly collect data from anyone under 16.

03Embed Visitors

Someone clicking a hotspot on your site isn't being profiled. We count the click and forget the person.

When a visitor loads a page containing a Markspot embed, our embed script requests the image and hotspot configuration from our servers. That request necessarily carries the visitor's IP address and browser user-agent, which we use to serve the content, apply rate limits and detect abuse.

We record aggregate counts — impressions, hotspot opens and outbound product clicks — so you can see how your marks perform. Those counts are stored against your embed, never against an identified visitor, and the requests that carry them are sent without credentials.

Where you have heatmaps switched on, cursor traces are keyed to a random identifier minted in the visitor's own browser for that page view. It is not a cookie, it is not reused across pages or sites, and it is not linked to anything else we hold.

If you run an A/B test, the embed writes one local-storage entry on your domain recording which variant that browser was shown, so a returning visitor keeps seeing the same one. It never leaves your domain and it is not sent to us as an identifier. The embed does not currently act on Do‑Not‑Track or Global Privacy Control signals.

If you embed Markspot on a site subject to consent requirements, you remain responsible for the consent notice your own jurisdiction requires — including for the local-storage entry described above.

04How We Use Data

To run the product, bill for it, keep it up, and tell you when something changes. Nothing else.

• To provide the Service: rendering your editor, storing your marks, and serving published embeds.
• To authenticate you and enforce organisation roles, plan limits and rate limits.
• To process payments and to handle failed-payment and pause states.
• To send service email — receipts, security notices, plan changes, organisation lifecycle notices, and material updates to these policies.
• To investigate abuse, fraud and violations of the Terms, including verifying that Free-tier watermarks are being displayed.
• To improve the product through aggregated usage analysis.
• We do not run a marketing list. Everything we send is service email tied to your account, and it continues for as long as the account exists.

We do not use your content or your visitors' behaviour to train machine-learning models, and we do not licence either to third parties.

05Legal Bases

For users in the UK and EEA: which lawful basis covers which activity.

06Sharing & Processors

A short list of vendors that run parts of the product. No advertisers, no brokers.

We share personal data with the service providers below, each under a data processing agreement limiting them to our instructions:

Inside your organisation, every member — including the lowest-privilege viewer role — can see the other members' names and email addresses in the members list, alongside project names, image metadata and publish status. Billing details are visible only to the Owner.

Published embeds are public by design. Once you publish an image, anyone holding the embed ID can request the hotspot data needed to render the widget.

We may also disclose data where required by law, court order, or to protect the rights, property or safety of Markspot, our users or the public — or as part of a merger or acquisition, in which case we will notify you before your data becomes subject to a materially different privacy policy.

07Cookies

Essential cookies keep you signed in, analytics load with the app, and the embed sets nothing at all.

08Retention & Deletion

Delete your account and it's gone at once — no grace period. Unpaid organisations follow the pause schedule below.

We keep personal data only as long as it is needed for the purpose it was collected for, or as long as the law requires. The specific periods are in What We Collect.

Deleting an image moves it to trash. It stops being served immediately and its published embed begins returning a not-found response; a scheduled job then removes the database row and the stored file 30 days later. Within those 30 days you can restore it.

Deleting your account is immediate and irreversible. Your account, your live images, their stored files and their analytics are removed straight away — there is no grace period and nothing to restore afterwards. One exception, and we would rather state it than round it off: images you had already moved to trash are not swept with the rest. They are removed by the scheduled trash job on their own 30-day clock, so they can outlive the account by up to 30 days. You confirm with your password, or by typing DELETE if you only ever signed in with a third-party identity provider. If you own an organisation with other members you must transfer ownership first; if it carries a paid subscription you must cancel that first. A member who is not the owner can choose to hand their images to another member rather than delete them.

Unpaid organisations follow a fixed schedule. Deletion at the end of it is irreversible.

09Your Rights

Ask and we act — within 30 days, free, and without penalising you for asking.

Access, portability and erasure are self-service from your profile page, under Your data. For anything else, use the contact page. We respond within 30 days and will not charge you or degrade your service for making a request. If you are in the UK or EEA and are unhappy with our response, you may complain to your local supervisory authority.

10Security & Transfers

Encrypted in transit and at rest, access limited to the people who need it, and standard safeguards for data leaving the EEA.

All traffic to markspot.app and our embed endpoints is encrypted with TLS, and data at rest — database records and stored image files alike — is encrypted by our infrastructure provider. We store no passwords of any kind: authentication is delegated entirely to Supabase Auth, and two-factor authentication with recovery codes is available on every account. Access is enforced twice over, by row-level rules at the database and ownership checks on every mutation endpoint, and administrative credentials never reach the browser. Security-relevant actions are written to an audit log.

No system is perfectly secure. If a breach affecting your personal data occurs, we will notify affected users and the relevant supervisory authority without undue delay, and within 72 hours where that is required. If you discover a potential vulnerability, please report it responsibly via our contact page before public disclosure.

Our servers and our database and storage provider operate in both EU and US regions; product analytics are sent to an EU region. Where personal data is transferred outside the UK or EEA, we rely on Standard Contractual Clauses or an equivalent approved transfer mechanism, and you can request details of the safeguards we use by contacting us.

11Changes & Contact

Material changes get 14 days' notice. Questions go through the contact page.

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date above and notify active account holders in-app or by email at least 14 days before the changes take effect. Continued use of Markspot after that date constitutes acceptance of the updated policy.

Questions, requests or complaints about this policy? Reach us via the contact page and mark the subject "Privacy" — data-rights requests are routed to whoever can action them.