Privacy Policy

Who we are

Marketing As Art AI LLC ("Marketing As Art", "we", "us") operates the Marketing As Art marketing intelligence platform at marketingasart.art. We are the data controller for the personal data described in this policy. You can reach us at contact@marketingasart.art.

This policy explains what we collect, why, who we share it with, and how to get it deleted. It applies to the web application, our API, and the integrations you choose to connect.

Information we collect

We collect four kinds of information, and no more than we need to run the features you use.

• Account information — your email address and name, and authentication metadata handled by our authentication provider. If you sign in with Google, LinkedIn, Microsoft or Slack, we receive your email address, name and profile picture from that provider; we never receive your password.
• Business and brand information you give us — the brand positioning, audience, competitor and strategy inputs you enter, and any files you upload. This is your content.
• Data from platforms you connect — described in detail in the next two sections. We only receive what the permissions you grant allow, and only for the accounts you select during connection.
• Usage and technical data — pages viewed, features used, approximate location derived from IP address, browser and device type, and error diagnostics. We use Google Analytics 4 for this; see "Analytics on our own site" below.

Google user data — what we access and why

When you connect a Google account, we request only the scopes listed below. Each one maps to a specific feature; we do not request a scope we do not use.

• Google Analytics (analytics.readonly) — read-only. We read the GA4 property you select to show traffic, conversions and channel performance in your dashboard.
• YouTube (youtube.readonly) — read-only. We read your own channel and video metrics for the YouTube section of your reporting.
• Search Console (webmasters.readonly) — read-only. We read search performance for sites you have already verified in Search Console.
• Google Sheets (spreadsheets) — we read a spreadsheet you nominate as a data source, and write campaign or lead exports to a spreadsheet you choose. We do not read or modify any other file in your Drive.
• Google Calendar (calendar.events) — we create content-calendar and campaign-launch events that you schedule inside our product. We deliberately request calendar.events rather than full calendar access, so we cannot delete or share your calendars.

Limited Use disclosure

Marketing As Art's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically: we use Google user data only to provide and improve the features you have enabled; we do not transfer it to others except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition; we do not use it for advertising; and we do not allow humans to read it, except where you have given explicit consent for specific messages, where it is necessary for security purposes or to comply with applicable law, or where the data has been aggregated and de-identified.

We do not use Google user data to train generalised artificial intelligence or machine-learning models.

Meta, and other connected platforms

When you connect Meta (Facebook, Instagram, WhatsApp Business), we access only the assets you select during the connection dialog. Depending on the permissions you grant, this may include: the list of Facebook Pages you manage; Page engagement and post metrics; the Instagram professional account linked to a selected Page, its media and metrics; ad accounts, campaigns and delivery metrics; leads submitted through lead ad forms you own; product catalogs; and WhatsApp Business conversations with people who have messaged your business.

We may also process data from other services you connect, including LinkedIn, TikTok, X, Pinterest, HubSpot, Salesforce, Zoho, Mailchimp, Klaviyo, SEMrush, Shopify and WooCommerce. In every case we access only the accounts you select and only the permissions you grant.

Each platform has its own terms and privacy policy, which continue to govern your relationship with them.

How we use your information

We do not sell your personal data, and we do not sell or share data received from any connected platform. We do not use your data or your connected-platform data to train generalised AI models.

• To provide the features you have enabled — generating strategy, building and reporting on campaigns, publishing content you have approved, and surfacing analytics.
• To operate your account, including authentication, subscriptions and billing.
• To send service communications: security notices, billing notices, and changes to this policy. Marketing emails are separate and you can opt out at any time.
• To keep the service secure and to investigate abuse, fraud or violations of our terms.
• To comply with legal obligations.

Artificial intelligence processing

The product generates strategy, copy and analysis using third-party AI model providers. To do that, the specific content you submit for a given task — for example a brand brief or campaign prompt — is sent to those providers for processing and the result is returned to you.

Our AI providers process this content to serve the request only. We do not permit them to use it to train their models. We do not send connected-platform credentials or access tokens to AI providers.

Who we share it with

We share personal data only with service providers that help us run the platform, each bound by contract to protect it:

• Supabase — database, authentication and file storage.
• Render and Vercel — application hosting.
• NVIDIA, OpenRouter and Anthropic — AI model inference.
• Dodo Payments — subscription billing. Card details are handled by the payment processor; we never see or store full card numbers.
• Resend and SendGrid — transactional email delivery.
• Google Analytics — analytics on our own website.

Where data is stored, and for how long

Data is stored on infrastructure operated by the providers above, which may process it outside your country of residence. Where data leaves the EEA or UK, we rely on the transfer mechanisms offered by those providers, including Standard Contractual Clauses.

We keep your account data for as long as your account is active. When you delete your account, we delete or irreversibly anonymise your personal data within 30 days, except where we must retain records to meet legal, tax or accounting obligations. Backups are purged on their normal rotation.

Data from a connected platform is deleted when you disconnect that platform, as described below.

Isolation between customers

Every record is stored against the account that created it and is subject to row-level access control. One customer's data is never combined with another's, never pooled into a shared dataset, and never exposed to another customer.

Disconnecting and deleting

You can disconnect any platform at any time from the Ecosystem Connect screen. Disconnecting deletes the stored access token and the cached asset data for that platform, and our access is revoked. You can also revoke our access directly from the platform — in your Google Account permissions, or in Meta Business Settings.

To delete your entire account and all associated data, email contact@marketingasart.art from your account address. We will confirm and complete the deletion within 30 days.

Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, restrict or object to how we process it, receive a portable copy, and withdraw consent at any time. You also have the right to complain to your local data protection authority.

To exercise any of these, email contact@marketingasart.art. We will respond within 30 days and will not charge you or degrade your service for asking.

Analytics on our own site

We use Google Analytics 4 to understand how our website and application are used. It sets cookies and collects usage and approximate location data. This is separate from the Google Analytics data you may connect from your own property — that data is yours and we only read it.

You can opt out using the Google Analytics opt-out browser add-on, or by blocking cookies in your browser.

Security

We protect data in transit with TLS, store access tokens encrypted at rest, restrict internal access to those who need it, and never store API keys in plain text — keys entered in the product are stored as a hash with a short display preview only. No system is perfectly secure; if a breach affects your personal data we will notify you and the relevant authority as required by law.

Children's data

The service is for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

Changes to this policy

If we make a material change we will notify you by email or in the product before it takes effect. The effective date at the top of this page always reflects the current version.