Overview
This policy explains what personal data Vawick Consulting UG ("Penmarka," "we," "us," "our") collects, why, and what choices you have, across three places: this website, the Penmarka desktop app for Windows, and the checkout process when you buy a license.
We try to collect as little as we can get away with. Most of what Penmarka actually does — drawing over your screen — happens entirely on your own device.
Who We Are
Penmarka is a product of Vawick Consulting UG, a German company (UG-form entity) and the data controller for the personal data described in this policy.
Registered address: Vawick Consulting UG (haftungsbeschränkt), Liesenfelderstr. 7, 56281 Emmelshausen, Germany. Registered at Amtsgericht Koblenz, HRB 30621 — see our Imprint for the full legal notice.
Contact: support@penmarka.com.
Scope of This Policy
This policy covers:
- The Penmarka marketing website (the pages you're browsing now)
- The Penmarka desktop app for Windows, once installed
- The license purchase process, handled for us by our merchant of record, LemonSqueezy
It doesn't cover third-party sites we link to (for example LemonSqueezy's own checkout and customer portal), which have their own privacy policies.
Information We Collect
When you visit our website. We store a single small preference in your browser's local storage to remember your cookie choice (see "Cookies & Similar Technologies" below). Our hosting provider, Vercel Inc., automatically logs standard technical information common to any website — IP address, browser type, pages requested, and timestamps — for security and reliability purposes, per Vercel's own privacy policy.
When you download Penmarka. The installer behind penmarka.com/download is served by GitHub (GitHub, Inc., a Microsoft company). GitHub processes your IP address, browser data and the time of the download, in line with GitHub’s privacy statement. If you download Penmarka from the Microsoft Store, Microsoft’s privacy statement applies; Microsoft only gives us aggregated statistics, no personal data.
When you buy a license. Checkout is handled entirely by LemonSqueezy, our merchant of record — we never see or store your full card number. LemonSqueezy collects your name, email address, billing address, and payment details directly, and shares with us what we need to fulfill your order and support you: your email address, order ID, purchased plan, and license key.
When you use the Penmarka app. To validate that a Pro or Team license is active, the app sends your license key and basic activation information (a device label made of your computer’s name and operating system, plus the activation ID LemonSqueezy assigns, so a single license can be tied to your allowed number of devices) to our license validation service. This happens when you activate or remove a key. About once a day while the app is running with an activated key, it also re-checks the license, sending only your license key and that activation ID. The free 14-day Pro trial runs entirely on your device and sends nothing. Everything you actually draw, capture, or present with Penmarka — your annotations, screenshots, and on-screen content — is processed and stored entirely locally on your device and never leaves it. None of it is sent to us or to any third party; that data stays solely with you, the license holder. The app sends no telemetry, crash reports, or usage analytics.
Microphone and mouse clicks. The Recorder (Pro) uses your computer’s default microphone, and only while a recording you started is running. The audio is written straight into the video file on your own device (by default in Documents\Penmarka Recordings) and is never sent to us or anyone else. You control microphone access at any time in Windows Settings → Privacy & security → Microphone. When Mouse Click Highlight is switched on, the app listens for mouse clicks system-wide so it can draw a ring where you click; it uses only the click position, and doesn’t record or store it. Keyboard input is watched only for Penmarka’s own shortcut combinations, and is never recorded or stored.
When you withdraw from a contract. Through our Withdraw from contract function, we collect only your name, the details identifying your contract (order number or order email address) and the email address for the confirmation of receipt. We use them to process your withdrawal and to confirm its receipt, as § 356a BGB requires. The confirmation is sent through ZeptoMail, Zoho’s transactional email service, from its EU data centre; a copy goes to our support inbox.
When you contact us. If you email our support address, we keep that correspondence (and whatever you choose to include in it) to respond to you and to keep a support history.
Cookies & Similar Technologies
Our cookie banner and the "Cookie Settings" link in the footer of every page let you choose between three categories. Technically, your choice itself is remembered using your browser's local storage, not a tracking cookie — nothing about that choice is ever sent to our servers.
| Category | What it's for | Can you turn it off? |
|---|---|---|
| Strictly Necessary | Remembering your cookie choice and basic site functionality. | No — required for the site to work. |
| Analytics | Would help us understand how the site is used (page views, traffic sources). Not currently wired up to any analytics tool — the option exists so you can opt in ahead of any tool we might add later. | Yes — off by default, opt-in only. |
| Marketing | Would help measure how well campaigns work and show more relevant content elsewhere. Not currently wired up to any tool. | Yes — off by default, opt-in only. |
In short: right now, choosing "Allow All" doesn't turn on anything beyond what "Reject Non-Essential" already gives you — we're just asking up front, the way we'll need consent set up the day we do add analytics or marketing tooling.
How We Use Your Information
- To operate and secure this website
- To process your purchase and issue your license
- To validate that your license is active when the app checks in
- To provide customer support and respond to your emails
- To meet our legal, tax, and accounting obligations
- To detect and prevent fraud or abuse of our licensing system
- Only with your consent: to understand aggregate website usage, if and when we add an analytics tool
Legal Bases for Processing (EEA/UK Users)
- Contract — processing needed to sell you a license and let the app validate it (Art. 6(1)(b) GDPR)
- Consent — Analytics/Marketing cookies, only once you opt in (Art. 6(1)(a) GDPR)
- Legitimate interests — keeping the site and licensing system secure and working correctly (Art. 6(1)(f) GDPR)
- Legal obligation — keeping the invoicing and accounting records German law requires, and processing and confirming withdrawals (§ 356a BGB) (Art. 6(1)(c) GDPR)
Who We Share Your Information With
| Who | Role | What they process |
|---|---|---|
| LemonSqueezy | Merchant of record / payment processor | Name, email, billing address, payment details, order history |
| Vercel Inc. | Website hosting | Standard server/access logs (IP address, browser type, pages requested) |
| GitHub, Inc. (a Microsoft company) | Serving the installer (download via penmarka.com/download) | IP address, browser data, time of download |
| Zoho Corporation | Sending/receiving support email (Zoho Mail); sending withdrawal receipt confirmations (ZeptoMail) | Your support correspondence; details from the withdrawal form |
We do not sell your personal data, and we do not share it with advertisers beyond what's described in this policy.
International Data Transfers
LemonSqueezy Inc., Vercel Inc. and GitHub, Inc. are based in the United States. Using them may involve transferring your data outside the EEA/UK; each is responsible for its own safeguards for that transfer (such as Standard Contractual Clauses) — see LemonSqueezy’s, Vercel’s and GitHub’s privacy policies for details.
Our support email is provided by Zoho Mail from Zoho's EU data centre (zoho.eu), and withdrawal receipt confirmations are sent by ZeptoMail, also from Zoho's EU data centre, so this data stays within the EU.
How Long We Keep Your Data
- Purchase, license, and invoicing records — accounting vouchers, including invoices, are kept for 8 years (§ 147(3) AO, § 14b UStG); account books and annual financial statements for 10 years; business letters for 6 years (§ 257 HGB, § 147 AO). Records are deleted once these statutory periods expire, unless we're required to keep them longer for an active legal matter.
- Withdrawals — kept as long as needed to process them and while claims under the contract can still be brought (usually three years from the end of the year the withdrawal was received; §§ 195, 199 BGB).
- Support emails — kept as long as needed to help you and for a reasonable time after, then deleted or anonymized.
- Your cookie preference — stays only in your own browser's local storage until you clear it or change your choice; we don't have server-side access to it.
Your Rights
If you're in the EEA, UK, or another jurisdiction with similar protections, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request erasure ("right to be forgotten")
- Restrict or object to certain processing
- Receive your data in a portable format
- Withdraw consent at any time, without affecting processing that already happened
- Lodge a complaint with a data protection supervisory authority — for us, that's the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (LfDI RLP), since Vawick Consulting UG is registered in Rhineland-Palatinate
To exercise any of these, email support@penmarka.com.
Children's Privacy
Penmarka isn't directed at children, and we don't knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we'll delete it.
Automated Decision-Making
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.
Security
We use reasonable technical and organizational measures to protect your data — for example, this site and our checkout flow are served over HTTPS, and access to purchase/license data is limited to what's needed to run the business. No method of transmission or storage is ever 100% secure, so we can't guarantee absolute security.
Changes to This Policy
We may update this policy from time to time. The "Last updated" date at the top reflects the latest revision — if a change is significant, we'll make that clear on this page.
Language Versions
This policy is available in German and English. If the versions differ, the German version prevails.
Contact Us
Questions about this policy or your data? Email support@penmarka.com, or see our Contact page.
Data controller: Vawick Consulting UG (haftungsbeschränkt), Liesenfelderstr. 7, 56281 Emmelshausen, Germany.