Privacy Policy

Etchv is operated by Iuchar LLC, a Delaware limited liability company (“Etchv”, “we”, “us”). This policy explains how we handle personal information when you visit etchv.com, benchmarks.etchv.com or our documentation, create an account, use the dashboard, call the API, use our SDKs or MCP server, or email us.

We act in two roles. For account, billing, website and support information, we decide how it is used, so we are the controller (or “business”). For the files, metadata and delivery references our customers send through the service, we process them on the customer’s behalf and follow their instructions, so we are a processor (or “service provider”).

If an image, document or video that involves you was watermarked by one of our customers, that customer decides why it was processed and what records connect it to you. Please contact them first. We’ll help them respond.

Things we deliberately don’t collect: payment card numbers, the JSON you send to create a watermark ID, IP addresses in our API logs, precise location, and special categories of personal information. Our infrastructure providers see IP addresses while delivering traffic, and our demo and contact form use a keyed hash of your IP address to limit abuse; the address itself isn’t stored.

We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects. A detection result is a signal about a file, not a decision about a person.

We process your files only to embed watermarks, verify them, detect them and deliver the results. Our watermarking model is fixed: its weights ship with our software and are never trained or tuned on customer files. We don’t use your content, metadata or detection results to train any model, and we don’t send them to third-party AI providers.

People at Etchv don’t look at your files, except when you ask us to help with a specific problem, when it’s needed to investigate abuse or a security incident, or when the law requires it.

Detection recovers a watermark ID. It never reveals who received a file on its own. That connection lives in your records, and you decide how to use it.

We use a small number of service providers to run Etchv. They process information only on our instructions and only for the purposes below.

We also share information:

• with the destinations you configure, such as your own storage buckets and webhook endpoints;
• with other members of your organization, according to their roles;
• when the law requires it, or to protect the rights, property or safety of our users, the public or Etchv;
• with a buyer or successor if Etchv is involved in a merger, acquisition or sale of assets, under a privacy commitment at least as protective as this one;
• with anyone else when you ask us to.

We don’t sell personal information, and we don’t share it for cross-context behavioral advertising.

Change your choice at any time in Privacy settings, linked in the footer of every page. If your browser sends a Global Privacy Control signal, we treat it as a request to turn off optional analytics.

When you delete your account or a workspace, we delete its files, assets, jobs, API keys, webhooks and storage destinations within 30 days. We keep billing records and the PDF token registry as described above.

• Traffic to our website and API is encrypted with TLS 1.2 or later.
• Stored files are encrypted at rest, and our storage refuses unencrypted connections and public access.
• Our database is reached over a private network connection and requires TLS.
• Credentials for your storage destinations are encrypted with keys held in a managed key service, bound to your organization.
• API keys are stored as SHA-256 digests, can be revoked at any time and expire.
• Every request is scoped to one organization, and roles control who can manage keys, billing and settings.
• Our runtime secrets are stored encrypted, never in our code.

No system is perfectly secure. If a breach affects your personal information, we’ll notify you and the relevant authorities without undue delay, as the law requires. Report a security concern to security@etchv.com.

Etchv is based in the United States and processes information there. If you use Etchv from another country, your information is transferred to and processed in the United States, where data protection laws may differ from those in your country. Where the law requires safeguards for these transfers, we rely on the mechanisms our providers offer, such as Standard Contractual Clauses.

You can update your name and email in the dashboard, and delete API keys, webhooks, storage destinations and files at any time. To delete your account or a workspace, email privacy@etchv.com from your account address, or use your profile settings where they offer it. Every product email has an unsubscribe link, and Privacy settings controls optional analytics.

Depending on where you live, you may also have the right to:

• know what personal information we hold about you and get a copy of it;
• correct information that is wrong;
• delete your information;
• receive your information in a portable format;
• object to or restrict certain processing, including direct marketing;
• withdraw consent you’ve given;
• opt out of the sale or sharing of personal information, or of targeted advertising (we do neither);
• appeal our decision on your request, and complain to your data protection authority.

To make a request, email privacy@etchv.com from the address on your account, or tell us enough to find your information. We may need to confirm your identity first. We respond within 30 days, or within the time your law allows, and we won’t treat you differently for exercising your rights. An authorized agent can make a request for you with your signed permission.

If you are a customer’s end user and your request concerns content that customer processed, we’ll pass it to them, because they control that content.

In the last 12 months we collected the categories of personal information listed under Information we collect: identifiers such as name, email and account IDs; commercial information such as plan and purchase history; internet activity such as website and service usage; and the content you choose to process. We collected them from the sources and for the purposes described above, and disclosed them to the service providers listed under Who we share information with for business purposes.

We have not sold personal information or shared it for cross-context behavioral advertising, and we don’t use or disclose sensitive personal information for purposes that would allow you to limit it.

Account emails are part of the service: a welcome email when you sign up, a reminder two days before your trial ends, a notice when a subscription ends and your stored files are due to be deleted, sign-in codes from Clerk and receipts from Stripe. Product emails, such as an email after your trial ends, can be switched off with the unsubscribe link in each one. We don’t track whether you open our emails or click their links.

Etchv is a service for businesses and developers. It isn’t directed at children, and you must be at least 18 to create an account. If we learn we’ve collected personal information from a child, we’ll delete it. Contact privacy@etchv.com if you believe we have.

Our website links to other sites and uses third-party services such as Cal.com for booking. Their own privacy policies apply to information you give them directly.

When we change this policy, we update the date at the top. If a change materially affects how we use information we already hold, we’ll tell account holders by email or in the dashboard at least 30 days before it takes effect.

Iuchar LLC, which operates Etchv. Email privacy@etchv.com for privacy questions and requests, or hello@etchv.com for anything else.