Privacy policy

Data controller

The data controller for personal data is: HelloMarkus.ai — [registered name to be filled], with its registered office located at [address to be filled]. For any questions: privacy@hellomarkus.ai.

Data collected

Purposes of processing

Provide the service

Generate your diagnostic, your strategy, your content. Allow you to manage your account, publish on your channels, track your performance.

Transactional communication

Send you your strategy by email, payment confirmations, important product notifications (incident, maintenance). You cannot unsubscribe from these emails — they're necessary to the service.

B2B nurture (legitimate interest, free opt-out)

After your free diagnostic, we may send you 1 to 2 emails max to suggest trying HelloMarkus. You can refuse these communications in one click from any received email. This practice follows French CNIL doctrine on B2B prospects.

Marketing nurture (explicit consent)

If you checked the "receive Markus marketing tips" box when capturing your email, we send you a maximum of 1 email per month with marketing tips. One-click unsubscribe always available.

Analytics

Measure site usage (page views, time spent, conversions). Aggregated data, no individual profiling.

Legal basis (GDPR, Art. 6)

• Contract performance — for your subscription to function.
• Legitimate interest — for the 1-2 B2B nurture emails post-diagnostic.
• Consent — for monthly marketing emails (explicit checkbox).
• Legal obligation — for invoice retention (accounting, 10 years).

Retention period

• Anonymous diagnostic without email: 90 days, then automatic deletion.
• Diagnostic with email, no account: 2 years (standard CNIL timeframe for prospects).
• Active account: as long as your account exists + 3 years after closure.
• Invoices: 10 years (legal accounting obligation).
• Marketing opt-out: email kept only in a suppression list (to respect your choice).

Recipients of your data

Your data is shared only with the following technical providers, strictly for service operation:

• Supabase Inc. (AWS EU infrastructure) — database hosting and authentication
• Netlify, Inc. — landing site hosting
• Anthropic PBC — Claude AI model for strategy and content generation
• Stripe, Inc. — payment processing (no banking data transits through our servers)
• Google Fonts / Analytics — fonts and audience analytics
• LinkedIn Corporation — only if you connect your LinkedIn account

Your rights

Under the GDPR and the French Data Protection Act, you have the following rights:

• Right of access — obtain a copy of the data we hold on you
• Right to rectification — correct inaccurate information
• Right to erasure — delete your data (except legal obligations)
• Right to portability — retrieve your data in a usable format
• Right to object — refuse processing, notably marketing
• Right to restriction — temporarily freeze a contested processing
• Right to withdraw consent at any time (monthly marketing)

Cookies

We use a minimal number of cookies, all essential for site operation:

• Session cookie (app.hellomarkus.ai) — to keep you logged in
• Stripe cookies — to secure payments

Security

We implement appropriate technical and organizational measures to protect your data: encrypted exchanges (HTTPS/TLS), encrypted database at rest, strict access policy, regular audits. No system is infallible; in case of breach, you'll be notified within 72 hours as required by GDPR.