Privacy Policy

Who is responsible

Dimitrije Pavlovic, trading as Pavlovic Media, a Swiss sole proprietorship at Fischerweg 4, 4222 Zwingen, Switzerland, operates marketingapp.io. Contact support@marketingapp.io for privacy questions and requests.

We are responsible for our website, business relationships, account administration, security, billing and support. For personal data in content processed on a customer's instructions, the customer is the controller or acts for its own controller, and we act as processor under our Data Processing Addendum. Our role for public-source collection depends on the particular activity.

• Data Processing Addendum

Information we process

• Account and authentication: email, profile and account details, Clerk identifiers, session status and access information supplied by you or your chosen login provider.
• Business and workspace: your website, Instagram handle, brand context, marketing goals, onboarding answers, research links and notes, tests, measurements, scripts, captions, planning information, business results and external file links supplied by you or your authorised integrations.
• Public sources: business pages you ask us to import, and public Instagram handles, post links, captions, publication dates, thumbnail links and available engagement counts obtained through Apify for the requested research or observation.
• Billing: business and billing details, selected plan, subscription status and payment references. Stripe receives the payment information you enter at checkout; we do not receive full payment card numbers.
• Support and operations: your correspondence, information you send to support, and request/device, security and error information processed by our hosting infrastructure to deliver and protect the service.

Purposes and legal grounds

We use necessary information to authenticate users, provide and personalise the requested workspace, return marketing results, manage subscriptions, answer enquiries, prevent abuse and meet applicable legal obligations.

Where the GDPR applies, the relevant grounds are contract necessity where the individual is a party, legitimate interests for proportionate business-contact and security administration, legal obligations for required records, and consent for optional analytics. The customer's legal basis governs content we process on its instructions. Consent to analytics is not a condition of buying or using the service.

Information needed for authentication, requested functions or billing must be supplied for those functions to work. Accepting service terms or reading this notice is not blanket consent to unrelated processing.

AI and your connected tools

An enabled AI-assisted function sends the input and business context needed for the request to OpenRouter and the approved inference provider. Provider information describes the services involved. An unavailable function does not authorise a substitute provider or a different use of your content.

We do not use customer content for our own model training, shared customer benchmarks, public examples or unrelated commercial purposes. We do not manually enter customer content into additional AI services. Restrictions on downstream provider training and retention depend on the approved endpoint and its applicable terms and controls; we do not describe the whole service as having zero retention.

Your own AI client or agent can access authorised workspace functions through a token you create. Its handling of data is governed by your relationship with that provider. You can revoke the token. External file and video links remain at the provider selected by you. Loading an Instagram thumbnail sends a network request to the permitted Meta image host; we do not store a local media copy for that preview.

Do not submit sensitive personal information, data about minors, credentials or information you lack authority to process. Agencies must have authority and an appropriate legal basis for their clients' data.

• Provider information

Optional analytics

Vercel Web Analytics measures aggregate traffic on the public home and pricing pages when you permit it. The integration removes query strings and fragments and excludes private app URLs. Vercel describes this service as cookie-free; request and device information is still processed.

Datafast is an optional service for website and app usage and purchase attribution. When available and permitted in Privacy settings, it can process visitor/session identifiers, safe page categories and events, traffic-source information, approximate country and device information, live visit activity and attributed subscription payments. These identifiers can link visits and purchases and are not necessarily anonymous.

Optional services stay off until an affirmative choice and remain off when unavailable. You can refuse them separately or withdraw through Privacy settings. This does not remove access to the app. We exclude credentials, form contents, customer content and unfiltered private URLs. Subscription revenue attribution does not include your own business turnover.

Withdrawal stops future optional collection and attribution. It does not retrospectively erase all data already lawfully processed; contact us to request deletion. We do not use a hidden server-side or cookieless fallback to override a refusal.

• Cookie Policy

Recipients and international processing

Our hosting, database, authentication, payment, support and API providers process the information needed for their functions. Authorised administrative access is available to the operator in Switzerland and a business partner in Germany. Access must be limited to appropriate purposes and governed by the relevant confidentiality and data protection duties.

Our Neon database is in North Virginia, United States. Other providers can process information in the United States and additional countries described in their terms. We do not claim EU-only hosting. Applicable transfer safeguards depend on the actual recipient and agreement. Contact us for information about the safeguards relevant to your information.

We disclose information where required by law or necessary to establish, exercise or defend legal claims. We do not sell customer content or make it available for third-party advertising. Payment providers and customer-selected connections also have their own legal responsibilities and notices.

• Providers and their data information

Retention and deletion

Workspace and marketing content remains available for export or reactivation for 30 days after a verified subscription service end. It is then scheduled for deletion. Active complimentary access is not treated as an expired subscription. Provider cleanup can require retries; a pending or failed cleanup is not represented as completed erasure.

Billing and records required for legal obligations or claims are handled separately from deletable marketing content. Backup and provider copies follow their applicable retention and cleanup cycle. Deletion is not a promise that every physical backup is erased immediately; erased information must not be silently returned to active use by a restore.

Support correspondence is kept for handling the request and related necessary legal purposes. Never-subscribed accounts and other operational records have no fixed calendar deletion deadline stated here. Contact us for an assessment or deletion request. We must not keep personal data for unrelated purposes merely because a fixed period is absent.

Deleting a Clerk login does not by itself cancel a subscription or establish that all workspace and provider copies have been erased. Use the app's privacy/export controls or contact support to request the relevant action. Some imported accounts retain a local Argon2id password hash from the previous login system; it is not a plaintext password.

Your choices and rights

Depending on applicable law, you can request access, correction, deletion, restriction, portability or objection to processing, and withdraw optional consent. Contact support@marketingapp.io. We may need proportionate evidence of identity or authority and will respond within applicable legal deadlines. For customer-controlled content, we assist the relevant controller rather than deciding independently how its data should be used.

If public Instagram information about you appears in research, send the relevant profile or post link and your concern so we can assess it. Public availability does not remove privacy rights. Any exception to individual notification must be assessed for the collection, rather than assumed from public visibility.

You may complain to the Swiss Federal Data Protection and Information Commissioner or another competent supervisory authority available under applicable law. App accounts are for adult business users. We do not offer accounts to minors or permit customers to target minors' data.

• Swiss data protection authority

Security and changes

We use HTTPS, server-side authentication, workspace access checks, revocable credentials and provider security controls. The service is not end-to-end encrypted: authorised providers and administrators can process information to provide and operate it. No security measure removes every risk.

We keep this notice aligned with the service and provide appropriate information about material changes. A revised notice does not replace new consent where it is needed. Document versions remain available so you can identify the text relevant to your acceptance or request.