# Privacy and data retention

This section says what the Watermark API stores about you and about the files you send, and for how long. It adds to the [watermark.ws Privacy Policy](https://watermark.ws/privacy), which covers your watermark.ws account, the website and its cookies; what it says applies to the API too, except where this section is more specific. Much Media Inc. is responsible for the data described here.

Version `2026-10-15` · Last updated: October 15, 2026

## Two kinds of data

- **Your files.** The sources you send and the results the API makes are yours. We process them only as your requests instruct, as a service provider (a "processor" under laws that use that word). You decide what is in them and whom they are about, and you are responsible for having the right to send them.
- **Your account and usage.** Who you are, your keys, what you spent and the record of each request. We hold this as the party responsible for it, to run the API, to charge for it and to protect it.

## What we store, and for how long

| Data | What it is | Kept |
| --- | --- | --- |
| Source from a URL | A file the API fetches from an address you give | Only while the request runs. Not stored once it has finished. |
| Upload | A file you sent to `POST /v1/uploads` | Until the first request that uses it succeeds, or 24 hours. Its record (id, size, type) for a further 7 days. |
| Result kept by the API | A file the API made for you, with its download link | 7 days after the request finished, or until you delete it. Its record (id, size, type) until the request record goes. |
| Result written to your storage | A file written to your bucket or a presigned URL you gave | Never stored by us. |
| Request record | Endpoint, operations, the source URL or ids, the outputs asked for, file sizes and durations, status, timings, price, your `customer` and `metadata` fields, the webhook URL, the `User-Agent` header the call came with | 60 days. |
| Charge and purchase | Each charge, purchase, refund and adjustment on your balance, with its amount and reference | For as long as the account exists, and after that for as long as accounting and tax law requires. After 60 days the charge no longer points at its request. |
| Daily usage sums | Requests and spending per day, per endpoint | 400 days. |
| Event | A finished request's event, as posted to your webhook or listed by `GET /v1/events` | 30 days. |
| Refused call | A call refused before it became a request (the endpoint, status, error code and `User-Agent` header; not the body) | 30 days. |
| Key | The key's name, prefix, scopes, when it was made, last used and revoked, and the `User-Agent` header it was last used with | While the account exists. The key itself is stored only as a hash and cannot be read back. |
| Webhook settings | The URL and the signing secret | Until you change or remove them. |
| Storage connection | Your bucket, region, prefixes, the role's ARN and the external id | Until you disconnect it. No credentials: the API assumes your role. |
| Account | Name, email address, tier, balance, limits, the versions of the terms accepted and when | While the account exists, and in backups for up to 7 days after it is deleted. |
| Server logs | Technical logs of each call, which can include the IP address it came from and its request id | 7 days. |

Deletion follows the schedule above: a file is removed from storage on its date, a database record is deleted by a nightly job, and backups turn over within 7 days.

## How we use account and usage data

- To run the API: authenticate keys, apply limits, queue and run requests, deliver webhooks.
- To charge for it, show you your usage and balance, and keep accounts.
- To find and fix problems, including looking at a failed request when you ask for help, quoting its request id.
- To protect the API: detect abuse, attacks and leaked keys.
- To see which of our tools (the CLI, the SDKs, the AI connector) or which HTTP clients call the API, so we know what to improve.
- To tell you about your account, your credit and changes to the API, at the account's email address. We do not send marketing to the API account's address unless you opt in on watermark.ws.

We do not sell this data, and we do not use your files or your request data to train machine learning models.

## Who else handles the data

The API runs on Amazon Web Services in the US East (N. Virginia) region, where your files are processed and the results kept for you are stored; a long video is processed in the same region. Payments for credit go through Stripe at watermark.ws, which sees your card details and we do not. Account emails are sent through watermark.ws's email provider, Postmark. These providers process data only to provide their service to us. We may also disclose data when the law requires it, or to protect the rights and safety of our users and of Watermark.

Files are processed in the United States, wherever you send them from. If you need them to stay elsewhere, write your results to your own bucket in that region with a storage connection; the sources still travel to us to be processed.

## Your files and other people

If the files you process contain personal information about other people, such as photos of them, you are the one responsible for having the right to process it and for telling them what the law requires. We process it only on your instructions, keep it only as the table above says, and give you the means to delete it earlier: `DELETE /v1/files/{id}` for a result, and closing the account for everything.

## Your rights and choices

- You can see your account, keys, requests, usage and charges on the dashboard and through `GET /v1/account`, `GET /v1/requests` and `GET /v1/events`.
- You can correct the account's name and email address in its settings.
- You can delete a result early, revoke a key at any time, and close the account by writing to us, which deletes its files on their schedule and keeps only what the table above says we must keep.
- Where the law gives you rights to access, correct, delete or move personal information, or to object to its use, write to [support@watermark.ws](mailto:support@watermark.ws) from the account's email address. We answer within 30 days.

## Security

Every call to the API is encrypted in transit. Keys are random, shown to you once and stored as hashes. Files are stored in private buckets and reached only through signed links that expire with the file. Access to production systems is limited to the people who run the service and is logged. If we learn of a breach that affects your data, we tell you at the account's email address without undue delay.

## Changes

We change this section when the API changes what it stores or for how long. The version at the top changes with it, and a change that reduces your protection is announced to the account email at least 30 days before it takes effect.

Questions about this section go to [support@watermark.ws](mailto:support@watermark.ws).