Privacy Policy
Effective date: 2026-08-27
This Privacy Policy explains how Myrvold Marketing ("we", "us") processes personal data when you use Marketing Panel (the "Service"). We comply with applicable privacy laws, including the GDPR.
2. Data We Process
- Account and contact data: name, email, configurations and preferences.
- Usage data: sign‑in events, basic error logs and UI selections such as which business you have selected.
- Integration data: KPIs and insights from connected sources (e.g., Google Analytics 4/Search Console/YouTube, Meta/Facebook/Instagram, WooCommerce). Content is limited to what’s needed to compute and display statistics.
- Authentication and access tokens: OAuth tokens stored encrypted. We request minimal scopes and you can disconnect at any time.
- Generation/AI data: text and uploaded images/files you ask us to process to generate content or insights.
- Payment data: when you subscribe, Stripe processes your payment details, billing address and VAT number. We never see or store your card number.
- Integrations you may add later: further ad, email/SMS and CRM providers. Data will be processed the same way when you choose to connect them.
3. Purposes and Legal Bases
- Provide the Service: fetch and display insights, generate content, store setups. Legal basis: performance of a contract (GDPR art. 6(1)(b)).
- Improvement and security: troubleshooting, aggregated analytics, abuse prevention. Legal basis: legitimate interests (art. 6(1)(f)).
- Communication/marketing: only with your consent. Legal basis: consent (art. 6(1)(a)); you may withdraw at any time.
- Legal compliance: to meet legal obligations. Legal basis: legal obligation (art. 6(1)(c)).
4. Sharing and Recipients
We do not share personal data with third parties beyond what is necessary to provide the Service.
- Processors: Railway (hosting and database), Vercel (frontend hosting), Sentry (error monitoring), Resend (email delivery) and Stripe (payments and invoicing). We have data processing agreements and require appropriate safeguards.
- Third‑party APIs: Google (Analytics 4, Search Console, YouTube, Google Ads, Business Profile), Meta (Facebook/Instagram), TikTok and WooCommerce. We only share necessary metadata and fetch reports per the access you grant.
- AI providers: When you ask us to generate content, text/images may be processed by a third party (e.g., OpenAI). Such data are used only to fulfill the request and not retained longer than necessary.
5. Transfers outside the EEA
Some providers may be located outside the EEA. Where applicable, we rely on valid transfer mechanisms such as the EU Standard Contractual Clauses (SCCs) with supplementary safeguards.
6. Security
- Encryption of access tokens and sensitive keys at rest.
- TLS in transit for API calls.
- Least‑privilege principles, access controls, and integration audits.
- Rate limiting and monitoring to detect abuse.
7. Storage and Deletion
- We retain personal data as long as needed for the purposes above or as required by law.
- Integration tokens are kept until you disconnect or the account is closed; generated content files can be deleted by you and will otherwise be removed after a reasonable period.
- Aggregated/anonymized statistics may be kept without time limit.
- You may request deletion via data deletion or by contacting us.
8. Your Rights
- Access, rectification, erasure, restriction, data portability, and the right to object.
- Withdrawal of consent where processing is based on consent.
- Right to lodge a complaint with your data protection authority.
9. Cookies and Local Storage
- Strictly necessary cookies for sign‑in and security.
- Functional local storage for your own preferences: language, selected business, and which accounts you picked for each integration.
- Any analytics/tracking only with your consent and in line with applicable law.
- You can manage cookies via your browser and in‑app settings.
10. Children’s Privacy
The Service is not intended for children under 16. We do not knowingly collect data about children. Contact us if you believe we hold such information and we will delete it.
11. Changes
We may update this Policy as needed. Material changes will be announced in‑app or via email. Continued use after the effective date constitutes acceptance.