Privacy Policy for MarkTRAQ

1. Information We Collect

To build your campaigns, we collect several types of information:

• Account Data: Name and email address when you register.
• Campaign Briefs: Goals, target audience description, marketing tone, and content pillars you provide.
• Brand Assets: Logos, brand colors, images, and other creative files you upload for AI processing.
• Connected Social Accounts: if you connect a Facebook Page, Instagram account or Threads account, we receive the account name, handle, profile picture and account ID, the permissions you granted, and access tokens that let us publish on your behalf. We also store the posts we publish for you and the performance data Meta returns for them.
• Technical Data: IP address, browser and device type, and usage patterns. On this website, usage analytics are collected through Google Analytics (via Firebase) and are only enabled if you accept analytics cookies. The MarkTRAQ app also uses Google Analytics (via Firebase) to measure how the app is used.
• Billing Data: your plan, billing cycle and subscription status, and a record of your payments and credit purchases. Card details are collected and processed directly by Flutterwave, our payment processor. We never receive or store your full card number or security code. From Flutterwave we receive the status of your transactions and subscription, the reference numbers Flutterwave assigns to them, and your card brand and last four digits so you can recognise the card you paid with.

2. How We Use Your Information

We use your data to power the MarkTRAQ experience:

• AI Generation: To create blueprints, flyers, social posts, video scripts, and email copy.
• Service Maintenance: To manage your account, save your projects, and provide customer support.
• Personalization: To tailor marketing recommendations to your industry and brand voice.
• Analytics: To monitor system performance and improve our AI models' output quality.

3. Data Processing and AI

MarkTRAQ utilizes advanced AI models to process your inputs. By using our service, you acknowledge that:

• Your prompts, campaign briefs and uploaded images are processed by our systems and sent to third party AI model providers to generate the outputs you request.
• We do not sell your brand assets or briefing data to third parties.
• Aggregated, non-identifiable data may be used to refine our internal processes and user experience.

4. Connected Social Accounts

You can connect Facebook Pages, Instagram accounts and Threads accounts so MarkTRAQ can publish and schedule posts for you. When you connect an account, Meta gives us access tokens. We store them encrypted and use them only to publish the content you schedule and to read performance data for your connected accounts.

You can disconnect an account at any time from your channel settings. Disconnecting deletes the connection and its access tokens from our systems. To also remove MarkTRAQ from your Meta account, you can do so in your Facebook, Instagram or Threads settings.

5. Security, Abuse and Fraud Prevention

To protect accounts and stop abuse, such as automated sign-ups or password guessing, we use your IP address to limit how often sign-up, sign-in, two-step verification and password reset requests can be made. These limits are stored briefly and expire on their own within an hour.

We keep the payment and transaction records described in Section 1 so we can investigate billing problems and respond to payment disputes.

Our app and website send error and diagnostic data to our error monitoring provider. This can include your IP address, browser and device details, and, for a sample of sessions and sessions where an error occurs, a replay of how the page was used.

6. Legal Bases for Processing

Where the GDPR or UK GDPR applies to you, we rely on the following legal bases:

• Performance of a contract: to create and run your account, generate the content you request, and provide support.
• Legal obligation: to meet tax, accounting, and regulatory requirements relating to your purchases.
• Consent: for analytics cookies and for marketing emails. You can withdraw consent at any time without affecting processing carried out beforehand.
• Legitimate interests: to secure our systems, prevent fraud and abuse, and improve service quality, where those interests are not overridden by your rights.

7. Your Data Rights

Depending on where you live, you may have some or all of the rights below. We honour these consistent with applicable law, including Nigeria's Data Protection Act (NDPA), the EU/UK GDPR, and the California Consumer Privacy Act (CCPA).

• Access and Export: You can request a copy of the data we hold about you.
• Correction: You can update your account information at any time.
• Deletion: You can request that we delete your account and associated campaign data.
• Objection and Restriction: You can object to, or ask us to restrict, certain processing.
• Opt-Out: You can change your analytics cookie choice at any time using the "Cookie preferences" link in the site footer, and unsubscribe from marketing emails using the link in any such email.

To make a request, email [email protected]. We may need to verify your identity first. We aim to respond within 30 days.

8. Cookies and Similar Technologies

We use two categories of cookies on this website:

• Essential cookies, needed to operate the site and, in the MarkTRAQ app, to keep you signed in. These are always active. We also store your cookie choice itself in your browser's local storage so we can honour it.
• Analytics cookies (non-essential), set by Google Analytics via Firebase (measurement ID G-MGEG7E908B) to measure page views and general usage patterns. These are only set after you accept them, and are never loaded if you choose "Essential only".

You can change or withdraw your choice at any time via the "Cookie preferences" link in the site footer, and you can clear cookies through your browser settings.

Inside the MarkTRAQ app, we also use Google Analytics via Firebase to measure page views and how features are used.

9. Data Sharing

We only share data when necessary to provide our service:

• Flutterwave Technology Solutions Limited: our payment processor, which collects your card details and processes payments. See Flutterwave's privacy notice.
• Meta Platforms (Facebook, Instagram and Threads): when you connect a social account, to publish your posts and read their performance data.
• DigitalOcean: hosting for the MarkTRAQ app and storage for files you upload and generate.
• Neon and Redis: database hosting and background processing for the MarkTRAQ app.
• Google: hosting for this website through Firebase, website analytics where you have consented, app analytics, sign in with Google if you choose it, and management of the encryption keys that protect stored tokens.
• Sentry: error monitoring and diagnostics for our app and website.
• Plunk: delivery of waitlist, newsletter, and service emails.
• AI model providers: third party providers that receive your prompts, briefs and uploaded images to generate the outputs you request.
• Legal Compliance: If required by law or to protect our rights.
• Business transfer: a successor entity in a merger, acquisition, or sale of assets, subject to this Policy or a comparable one.

We do not sell personal data, and we do not share it with third parties for their own marketing purposes.

10. International Data Transfers

We are based in Nigeria and our service providers operate in several countries, including the United States and the European Union. This means your personal data may be transferred to, and processed in, a country other than your own. Where we transfer personal data out of the European Economic Area or the United Kingdom, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, or on another transfer mechanism permitted by applicable law.

11. Security and Retention

We apply reasonable technical and organisational measures to protect your brand assets and account data against unauthorised access, loss, or misuse, though no system is completely secure. We retain personal data as follows:

• Account and campaign data: for as long as your account is active. When you delete your account, we delete it from our live systems straight away. Copies may remain in our database provider's backups until those backups expire.
• Billing and transaction records: for up to 7 years, to meet Nigerian and international tax and accounting obligations.
• Waitlist and marketing contacts: until you unsubscribe or ask us to delete your record.
• Analytics data: retained according to our Google Analytics configuration. On this website, it is only collected where you have consented.

12. Contact Us

If you have questions about our privacy practices, please reach out to us:

• Email: [email protected]
• Entity: IOXFORGE TECHNOLOGIES LIMITED (RC 9271810), Nigeria. See our company contact details.

If you are in the EEA or UK and believe we have not handled your data properly, you also have the right to lodge a complaint with your local data protection authority.