This page is a technical summary for teams and organizations evaluating Penmarka for procurement or vendor-compliance review — for example if you’re rolling out Penmarka Team and need to document our data flows for your own GDPR records of processing (Art. 30 GDPR). It supplements, and does not replace, our full Privacy Policy, which remains the authoritative statement of how we handle personal data.
1. Architecture Summary
Penmarka’s desktop application is local-first by design: drawings, project files, screenshots, screen recordings (including any microphone audio), and settings are stored only on each user’s own device and are never transmitted to us or to any third party. The only outbound network call the application itself makes is a license validation request (see below). There is no telemetry, no usage analytics, and no application-level user account system.
This means the data-processing footprint of running Penmarka day-to-day is minimal — most of what this page covers relates to purchasing and license management, not day-to-day use of the software.
2. Sub-processors
We use a small, fixed set of sub-processors. We’ll update this list and its “last updated” date whenever that changes — we don’t add sub-processors silently.
| Sub-processor | Purpose | Data involved | Location |
|---|---|---|---|
| LemonSqueezy, Inc. (a Stripe company) | Merchant of record: payment processing, license-key issuance, receipts | Name, email, payment details, purchase/license history | United States |
| GitHub, Inc. (a Microsoft company) | Hosting and distribution of the Penmarka installer | Standard web request logs (e.g. IP address) for anyone downloading a release | United States |
| Vercel Inc. | Hosting of the penmarka.com website | Standard web request logs (IP address, browser type, pages requested, timestamps) for visitors to the website | United States |
| Zoho Corporation (Zoho Mail, ZeptoMail) | Sending and receiving support email; sending withdrawal receipt confirmations | Support correspondence (name, email address, message content); withdrawal form details (name, contract identification, email address) | European Union |
We do not operate our own servers that store customer data — license validation is a direct, stateless request from the Penmarka application to LemonSqueezy’s API; we don’t run a backend that logs or retains it.
3. What Data Flows Where
- During a purchase: the buyer’s name, email, and payment details go directly to LemonSqueezy. We receive back only what’s needed to support the license (which plan, whether a key is currently valid) — not payment details.
- During license activation: the Penmarka application sends the license key to LemonSqueezy’s API over HTTPS to confirm it’s valid, together with a label for the device (the computer’s name and operating system, e.g. “DESKTOP-1234 (Windows)”) so the user can tell their activated devices apart. This happens when a key is activated or removed. While the application is running with an activated key, it also re-checks the license about once a day, sending only the license key and the activation ID LemonSqueezy assigned at activation. No other data accompanies these requests. The free Pro trial runs entirely on the device and sends nothing.
- During normal use: nothing leaves the device. Drawings, exports, project files and recordings stay local unless a user deliberately shares them themselves. The Recorder uses the default microphone only while a recording the user started is running, and writes the audio only into the local video file.
- Team plan specifically: seat/license management for a Team account is handled through the same LemonSqueezy license-key mechanism as Personal/Pro — Penmarka does not separately collect or store an organization’s employee list or directory data.
4. International Data Transfers
Zoho Mail and ZeptoMail are used from Zoho’s EU data centre, so support email and withdrawal confirmations stay within the EU. Our other three sub-processors (LemonSqueezy, GitHub, Vercel) are US-based companies. Where personal data is transferred outside the EU/EEA in connection with their services, transfer safeguards (such as Standard Contractual Clauses) are addressed under each provider’s own data processing terms:
- LemonSqueezy: lemonsqueezy.com/dpa
- GitHub: GitHub Data Protection Agreement
- Vercel: vercel.com/legal/dpa
5. Security Practices
- All network communication between the Penmarka application and LemonSqueezy’s license API is encrypted (HTTPS).
- Because the application doesn’t operate its own backend or database of customer data, there is no Penmarka-controlled server holding customer records to secure — the attack surface for customer data is limited to our sub-processors’ own systems and each customer’s local device.
- We do not request or store payment card details ourselves at any point.
6. Data Retention
- Local application data persists only until the end user deletes it from their own device; we have no remote access to it and no ability to delete it on a user’s behalf.
- Purchase and license records are retained by LemonSqueezy per its own retention policy and applicable legal/tax requirements.
7. Data Processing Agreement (DPA)
If your organization requires a signed Data Processing Agreement as part of onboarding Penmarka Team, contact us at support@penmarka.com and we’ll provide one.
8. Data Protection Officer
Vawick Consulting UG has not appointed a Data Protection Officer, as one is not required under Art. 37 GDPR for a business of our size and processing activities. For any data protection inquiry, use the contact details below or in our Privacy Policy.
9. Questions
For security or compliance questions not answered here, contact support@penmarka.com.