Privacy Policy

This Privacy Policy explains how IQ Mermaid — a service operated by Bogdan Sokolov, individual entrepreneur (autónomo) registered in Spain, with fiscal address at Calle Boca Del Rio 2, 1A, Oviedo, 33010, Asturias, Spain (Tax ID: ESZ1894474S) ("IQ Mermaid", "we", "us") — handles personal data when you use the diagram editor at iq-mermaid.com.

The short version: an account is optional and nothing here is paid. Without one you can draw, edit and export as much as you like, and the single diagram you are working on stays in your browser. If you sign in with an email address, the diagrams you save are stored on our server so that they follow you to another device. We run no third-party analytics and no advertising trackers — the only usage measurement is our own, cookieless one, described below.

We comply with the General Data Protection Regulation (GDPR), the Spanish Organic Law on Data Protection and Guarantee of Digital Rights (LOPDGDD), and the ePrivacy Directive.

1. Data Controller

Bogdan Sokolov, individual entrepreneur (autónomo) registered in Spain.

Fiscal address: Calle Boca Del Rio 2, 1A, Oviedo, 33010, Asturias, Spain. Tax ID: ESZ1894474S.

Contact for any privacy matter: support@iq-mermaid.com.

2. What we process

Server logs. Like any web server, ours records the request it answers: your IP address, the time, the page requested, the HTTP status, your browser's user-agent string and the referring page. These entries are what makes it possible to diagnose an outage and to detect abusive traffic.

Usage measurement — our own, cookieless. For each visit we store which pages were opened and which actions were taken (an event is a page, an action and a short English label such as "Home / Click / Header open editor"), the interface language, the device type and operating system, the browser's language header, the approximate location (country, region, city) derived from the IP address, and where the visit came from (a "?from=" campaign tag or the search engine that referred it). This is handled by a separate analytics service we also operate in the European Union, which your browser talks to directly rather than through this site's own server. The visit itself is identified by a salted hash of your IP address, browser user agent and language header, computed by that service. The raw IP address and the raw user agent are never stored, and the salt is replaced every day and the old one destroyed — which makes visits from different days impossible to link back together. The measurement is kept deliberately apart from accounts: an event never carries an email address or an account identifier, so a visit is never linked to the person behind it.

Your account, if you create one. Signing in asks for an email address and nothing else — no name, no password, no profile. We store that address, the one-time sign-in code we email you (hashed, never in plain text, and expiring minutes after it is sent) and a session token that keeps you signed in. If you save diagrams while signed in, their content is stored on our server under your account: that storage is the feature, and it is what makes the diagrams available on your other devices.

Correspondence. If you write to us, we hold your message and your email address for as long as it takes to answer you and to keep a record of the exchange.

That is the complete list. Using the editor without an account asks for nothing at all: we do not ask for your name or any identifier, and the only thing kept is the single diagram in your own browser.

3. What we do not collect

Your diagrams, unless you ask us to keep them. Without an account, everything you draw or type is rendered by JavaScript in your own browser: it is never uploaded, never transmitted to us and never stored on our servers. If you sign in and save a diagram, that diagram is stored on our server under your account for one reason only — to give it back to you on your next visit or your next device. We do not read it, mine it, analyse it or share it, and it is never used to train anything.

We do not use Google Analytics, PostHog, Facebook Pixel, Hotjar, session recording, retargeting pixels, or any other third-party analytics or advertising tracker. No advertising network is told anything about you.

We hold no passwords — sign-in is by a one-time code — and no payment data of any kind, because nothing on this site is paid.

4. Storage on your device

Without an account, the editor saves your one diagram in your browser's local storage so that it is still there when you come back. This is technical storage strictly necessary to provide the feature you asked for, it stays on your device, and it is never sent to us — which is why no cookie banner is shown. That entry holds a single diagram and nothing else: no identifier, no history and no profile.

Diagrams you save while signed in live in your account on our server, not in your browser. Keeping you signed in uses one cookie, iqm_session: it contains a random token rather than any personal data, it is set only after you sign in, it is not readable by scripts on the page, and it is strictly necessary for the account you asked for — so it too needs no consent.

You can erase the local diagram at any time by clearing your browser's site data for iq-mermaid.com; we hold no copy of it and it cannot be recovered. Documents saved in your account are deleted from the editor's own document list, or on request to support@iq-mermaid.com, which also removes the account itself. Signing out — or clearing site data — ends the session cookie.

We set no advertising cookies and no analytics cookies. The usage measurement described in section 2 deliberately sets none either: it stores nothing on your device at all, not a cookie, not a local-storage entry, not a device identifier — a visit is recognised entirely from the request itself, on our server.

5. Legal bases

Server logs are processed on the basis of our legitimate interest (Article 6(1)(f) GDPR) in keeping the service available and secure. The interest is narrow, the data is kept briefly, and it is not used to build a profile of anyone.

Usage measurement is processed on the same legitimate-interest basis: it tells us which parts of the editor people actually use, without building a cross-visit or cross-site profile of anyone. You can object at any time by emailing support@iq-mermaid.com, and we will delete the visits concerned.

Correspondence is processed on the basis of our legitimate interest in answering the messages sent to us.

Your account — the email address, the sign-in codes and the diagrams you choose to save — is processed to perform the service you asked for by signing in (Article 6(1)(b) GDPR). We could not keep your diagrams for you, or return them on another device, without storing them.

The local diagram kept without an account, and the session cookie that keeps you signed in, are strictly necessary for the functioning of the service you have explicitly requested, and therefore do not require consent under the ePrivacy Directive. The session cookie is set only in response to signing in.

6. Who processes data on our behalf

Hetzner Online GmbH, Nuremberg, Germany — hosting for the server that serves this website, and for the separate analytics service described in section 2, both inside the European Union.

Cloudflare — DNS for the domain.

We do not sell, rent or trade personal data, and we share none of it for advertising purposes.

7. How long we keep it

Server logs are rotated and deleted within 30 days, except for individual entries retained longer where they document an ongoing security incident.

Usage measurement (visits and events) is kept for 12 months, then deleted. The daily salt that produced a visit's hash is destroyed after a day, so older visits cannot be traced back to a device even by us.

Correspondence is kept for as long as needed to handle your request and, where relevant, to comply with a legal obligation.

Sign-in codes expire minutes after they are sent. Session tokens stop working when you sign out and are deleted once they are no longer valid.

Diagrams saved without an account never reach us and have no retention period on our side. Diagrams saved in an account are kept until you delete them, and deleting the account removes them with it. Backups, where they exist, are rotated within 30 days.

8. International transfers

Our server is located in the European Union and the data described above is processed there. We do not transfer personal data outside the European Economic Area.

9. Your rights

Under the GDPR you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable form. To exercise any of these rights, write to support@iq-mermaid.com.

In practice, an access request here can concern your account (the email address on it and the diagrams saved under it), server logs, usage measurement or correspondence. Because logs and usage measurement are keyed by IP address and a rotating hash, not by identity, we may need additional information from you to locate the entries that relate to you — and we will not collect extra data purely in order to identify you.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or with the supervisory authority of your country of residence.

10. Children

The service is not directed at children under 14 and we do not knowingly collect personal data from them. Using the editor asks for no personal data at all, and an account — which is optional and asks only for an email address — should not be created by a child under that age. If you believe a child's data has reached us, write to support@iq-mermaid.com and we will delete it.

11. Security

The site is served exclusively over HTTPS. Access to the server is restricted to the operator through key-based authentication.

The strongest protection is structural for anyone who stays signed out: those diagrams are not on our server at all, so no breach of it can expose them. The documents saved in an account are held under that account and reachable only through it, so one account's data is never served to another.

12. Changes to this policy

We may update this policy to reflect changes to the service or to the law. The revision date at the top of this page always shows when it last changed. Continued use after an update constitutes acceptance of the revised policy.

13. Contact

For any question about this policy or about your personal data: support@iq-mermaid.com.

Bogdan Sokolov, Calle Boca Del Rio 2, 1A, Oviedo, 33010, Asturias, Spain.