Privacy Policy

• Full name
• Email address
• Password (stored as a cryptographic hash, never in plain text)
• Company name (optional)
• Language and display preferences

When you connect third-party platforms to MarkFlow via OAuth, we access:

From Google:

• Basic profile information (name, email, profile picture)
• Google Ads campaign data (campaigns, ad groups, ads, keywords, performance metrics)
• Google Analytics 4 data (sessions, users, page views, conversions, traffic sources)
• Google Business Profile information and insights

From Meta (Facebook and Instagram):

• Basic profile information
• Facebook Pages you manage (Page insights, posts, engagement metrics)
• Instagram Business account data (followers, media, insights)
• Meta Ad Account data (campaigns, ad sets, ads, performance metrics: spend, impressions, clicks, conversions, CTR, CPC, CPM, ROAS)
• Business Manager information

From other supported platforms (TikTok, Twitter/X, LinkedIn): analogous analytics and campaign data as authorized by you.

• IP address (anonymized for analytics)
• Browser type and version
• Operating system
• Pages visited within MarkFlow
• Session duration and interaction logs
• Error logs (for debugging)

See section 11 (Cookies) below.

When you connect your Google account to MarkFlow, we request the following OAuth scopes:

• openid, email, profile — to identify you and create your account
• auth/adwords — read-only access to your Google Ads campaigns and performance metrics
• auth/analytics.readonly — read-only access to your Google Analytics 4 properties
• auth/business.manage — read-only access to your Google Business Profile information and insights

All scopes are used strictly for displaying analytics data within the MarkFlow dashboard. We do not create, modify, or delete any data in your Google accounts.

You can disconnect your Google account at any time from Settings → Integrations in your MarkFlow dashboard, or revoke MarkFlow's access directly at myaccount.google.com/permissions.

• public_profile, email — your basic Facebook account information
• pages_show_list, pages_read_engagement — to list and read insights for the Facebook Pages you manage
• instagram_basic, instagram_manage_insights — to read Instagram Business account information and insights
• ads_read, ads_management — to read your Meta Ad Account performance data
• business_management — to access your Business Manager for multi-account organization
• read_insights — to access aggregate analytics data

With your authorization through the Facebook Login for Business consent flow, we use Meta Platform Data to:

• Display your Facebook and Instagram performance data (Pages, posts, audience and ad metrics) in your MarkFlow dashboard — marketing analytics.
• Help you plan, create, and schedule content for your connected Facebook and Instagram accounts — content planning.
• Help you create, manage, and optimize advertising campaigns, ad sets, and ads in your connected Meta Ad Accounts — advertising management.

In doing so, we commit that we:

• Take any content-publishing or ad-management action only on your explicit instruction — never automatically or without your authorization.
• Do not share your Meta Platform Data with third parties.
• Do not use Meta Platform Data for any purpose other than providing the MarkFlow services you requested.
• Comply with Meta's Data Deletion requirements — you can delete your Meta data at any time by removing MarkFlow from your Facebook settings, which automatically triggers deletion (see section 13.5 below).

You can revoke MarkFlow's access to your Meta account at any time:

• From Settings → Integrations in your MarkFlow dashboard
• From Facebook at facebook.com/settings

• Primary hosting: DigitalOcean, Frankfurt datacenter (Germany, European Union)
• Backups: Encrypted snapshots stored in the same EU region
• Email delivery: Twilio SendGrid (USA, under Standard Contractual Clauses)

• Encryption in transit: TLS 1.3 for all connections between your browser and our servers
• Encryption at rest: AES-256 for database volumes and backups
• OAuth token protection: All OAuth access and refresh tokens are encrypted using Fernet symmetric encryption before storage
• Access controls: Multi-factor authentication for MarkFlow staff; principle of least privilege
• Network security: Firewalls, intrusion detection, regular security audits
• Software updates: Regular patching of dependencies and infrastructure

In the event of a personal data breach, we will notify the Latvian Data State Inspectorate within 72 hours and notify affected users without undue delay if the breach poses a high risk to your rights and freedoms, as required by GDPR Article 33-34.

• Strictly necessary cookies — required for authentication, security, and session management. Cannot be disabled.
• Preference cookies — remember your settings (language, theme). Optional.
• Analytics cookies — Google Analytics (GA4), to help us understand how our website is used. Optional: these are only set if you choose "Accept" on the cookie banner, and nothing is loaded or stored if you decline.

You can manage cookies:

• Through the cookie consent banner displayed on first visit
• At any time via the "Cookie preferences" link in the website footer, where you can change or withdraw your choice
• In your browser settings (see your browser's help documentation)
• At any time by revisiting your account privacy preferences

If you withdraw consent, we stop analytics processing and remove the analytics cookies already stored in your browser.

Disabling strictly necessary cookies may impair MarkFlow functionality.

• Email privacy@markflow.eu with your request
• Most requests can be fulfilled through Settings → Account in your dashboard
• We will respond within 30 days (or notify you of any extension as allowed by GDPR)

You can delete your MarkFlow account and associated data at any time:

1. Log in to dashboard.markflow.eu
2. Go to Settings → Account
3. Click "Delete Account"
4. Confirm deletion

Send a deletion request to privacy@markflow.eu from the email address associated with your account. We will verify your identity and delete your data within 30 days.

• All account data (profile, preferences, settings)
• All connected platform data (cached analytics, OAuth tokens)
• All chat/AI interaction history
• All campaign planning data

• Billing records (10 years, Latvian law)
• Anonymized, aggregated analytics logs (24 months)
• Legal compliance records as required

To delete the data MarkFlow obtained from Facebook or Instagram, open your Facebook Settings & privacy → Settings → Apps and Websites, then remove MarkFlow. This automatically notifies MarkFlow, which deletes your Facebook and Instagram data and the associated OAuth tokens, and returns a confirmation code and a status page so you can track the request.

Technically, removing the app sends a signed callback from Facebook to our automated data-deletion endpoint (https://dashboard.markflow.eu/api/data-deletion/meta/), which processes the deletion. You can also email privacy@markflow.eu to request deletion. Verified requests are completed within 30 days.