Privacy policy

What Mktly stores and why

Mktly never stores the content of what the assistant reads except the large results you can see on your Activity page, and never your card or bank details: payment happens on Paddle's pages.

Google user data

With your consent on Google's screens, Mktly accesses data of the Google accounts you connect, only in the services you tick and only for the resources you select in the dashboard: in Google Analytics 4 the reports and configuration of the chosen properties (and changes to that configuration, if you allow changes); in Google Tag Manager the chosen containers with their tags, triggers, variables, workspaces and versions; in Google Ads the chosen customer accounts with their campaigns, ads, keywords, assets and reports; in Search Console the chosen sites with their search analytics, sitemaps and URL inspection. Each request is made only when the assistant you connected asks for it in your conversation, and the data goes to that assistant and to you. Mktly does not read your Google accounts on its own, does not keep that data beyond what the table above lists (large results for 7 days, records of executed changes for 30 days), and does not use it for any other purpose.

You can withdraw access at any time: “Disconnect” in the dashboard revokes the token at Google and deletes it here, and Google's third-party access page lets you remove Mktly from the Google side as well.

With whom Google user data is shared, transferred or disclosed

Mktly shares, transfers or discloses Google user data only to these recipients, and to no one else:

• The AI assistant you connected (ChatGPT by OpenAI, Claude by Anthropic, or another assistant you choose): the Google data returned by the requests the assistant makes in your conversation, and nothing beyond those requests.
• You, in the dashboard: large results stored for you, records of executed changes, and the activity journal.
• Render (Render Services, Inc.), which hosts the service and its database in Frankfurt, Germany, as a processor under a data processing agreement; it stores the data only in encrypted form and does not use it.

Google user data is not sold, not transferred to data brokers or advertising networks, not given to Paddle (payment) or to any other third party, not used to develop, improve or train any models, and not disclosed to anyone else unless the law requires it. Human access at Mktly to Google user data is limited to what is strictly needed to resolve a support request you make or to investigate abuse, security incidents or legal obligations.

How Google user data is protected

• Encryption in transit: every connection — browser and assistant to Mktly, Mktly to Google and to its database — uses TLS (HTTPS).
• Encryption at rest: every record Mktly stores, including Google refresh tokens, resource selections, stored results and change records, is encrypted with authenticated symmetric encryption (AES with HMAC) under a key that lives only in the hosting environment, never in the code repository or in logs. The ciphertext is bound to the owning account, so a record copied to another account cannot be decrypted as that account's.
• Tokens: Google access tokens are held in memory only, for at most one hour; refresh tokens are stored encrypted and are revoked at Google and deleted when you disconnect. Assistant tokens are short-lived, rotated on refresh and revocable in one click.
• Access control: only your own dashboard session and the assistants you approved can act on your account; every request is checked against the resources you selected and against the read-only or read-and-change choice you made per service. There are no shared accounts and no access to other users' data by design.
• Least privilege and minimal retention: Mktly requests only the Google scopes you tick, keeps Google data only as the table above states (large results 7 days, change records 30 days, nothing else), and never logs the content of Google responses or any token.
• Operations: the service runs on Render's infrastructure in Frankfurt, Germany; its database is not reachable from the public internet; dependencies are pinned and reviewed for security updates; security reports to support@mktly.ai are answered promptly.

Who receives data

• The assistant you connected (ChatGPT by OpenAI, Claude by Anthropic, or another assistant you choose) receives Google data only in response to its own requests within your session. What the assistant's provider does with the conversation is governed by its own terms; Mktly does not receive your conversations.
• Google receives the API requests the assistant makes through Mktly, under your consent given on Google's own screens.
• Paddle (Paddle.com Market Ltd, London, and Paddle.com Inc., New York, as merchant of record) receives what a purchase needs: name, e-mail, address, VAT number and payment details, which it collects itself. Mktly receives from Paddle the state of the subscription and its identifiers. Paddle's privacy policy.
• Render (Render Services, Inc.) hosts the service and its database in Frankfurt, Germany, under a data processing agreement.

Mktly does not sell data, does not use it for advertising, does not train models on it and does not share it with anyone else, except where the law requires. Mktly's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Cookies

Two first-party cookies, both necessary: your dashboard session and a short-lived cookie that protects the sign-in flow. No analytics, no advertising cookies. The payment page loads Paddle's checkout, which sets its own cookies under Paddle's policy.

Deletion and your rights

“Disconnect” in the dashboard revokes the token at Google and deletes it from Mktly. “Revoke” under Assistants deletes that assistant's tokens. Deleting a business removes its resource bindings. Tables, plans and records expire on the schedule above. To delete the whole account, press “Delete account” on the Billing page: it revokes the Google tokens, disconnects the assistants and deletes every record at once, including the subscription state (an open subscription is cancelled at Paddle, which keeps its invoices as tax law requires). You can also write to support@mktly.ai from the Google address you sign in with; we delete within 30 days and confirm. You also have the right to access, correct and export your data, to object to processing based on legitimate interest, and to complain to the Slovenian Information Commissioner (Informacijski pooblaščenec) or the supervisory authority of your residence.

Agencies that process their clients' data through Mktly can request a data processing agreement at support@mktly.ai.