Privacy notice

Tellmark is provided by Digital Elevation.

What we hold

• Account: the account name and the slug used in your verify page's URL.
• Sign-in: the email address you sign in with, used only to send a one-time sign-in link and, if you cross a usage threshold, a quota email.
• Session: one cookie, described below.
• API keys: a one-way hash of each key. The key itself is shown once, when you create it, and never stored in a form we can read back.
• Marking log: for each mark, a hash of the file or text you marked (never the file or text itself), the model and app name you gave it, the time it was marked, and, for images, the C2PA manifest store and a short fingerprint made of hashes of the marked image (metadata describing the mark; no pixels and no thumbnail).
• Verify page settings: whatever accent colour, intro text and logo image you choose to add.
• Billing: your plan, and the Paddle customer and subscription identifiers that link your account to your Paddle purchase, with the subscription's status and dates. We never see or store card details.
• Request logs: our hosting provider, Cloudflare, keeps a log of requests to the site and the API for a few days, which can include your IP address, to run the service and stop abuse.

The session cookie

Tellmark sets exactly one cookie: a session cookie that keeps you signed in to the dashboard. It is not readable by page scripts, is sent only over HTTPS, and carries no tracking data. Nothing else in Tellmark, including the verify page, the checker and the disclosure snippet, sets a cookie of any kind.

Page analytics

On the home page, pricing, the docs, the guides and these legal pages, Cloudflare Web Analytics counts visits and measures how quickly pages load. A small script from Cloudflare reports the page's address, the site that linked to it and how long the page took to load; Cloudflare adds the visitor's country and browser and device type. It sets no cookie, stores nothing in your browser and does not identify or follow individual visitors. It does not run on the checker, the verify pages, sign-in or the dashboard.

Who receives data

• Paddle.com ("Paddle"), our payment processor and merchant of record, receives what it needs to process a purchase: your billing email and payment details, handled directly between you and Paddle during checkout. Tellmark passes Paddle only an account identifier, never your marking log. See Paddle's own Privacy Notice (https://www.paddle.com/legal/privacy).
• Cloudflare sends the sign-in link and quota emails on our behalf, through Cloudflare Email Sending. It receives your email address and the text of those emails.
• Cloudflare hosts the database and file storage described above, as our infrastructure provider, and runs the page analytics described above.

Data about your own end users

Tellmark never receives the files your product marks or the text it logs: the SDK marks and hashes locally, in your own infrastructure, and sends only metadata and hashes (including the image fingerprint described above), never pixels. Nothing about your end users reaches Tellmark unless you choose to put it into your own account's settings, such as a verify page's intro text.

Your rights

You can ask us to see, correct or delete the data described above by contacting us at hello@tellmark.si.