Privacy Policy

MarketingRoutine is operated by SIA Digital Publisher, a Latvian limited liability company headquartered in Riga, Latvia (the "Company", "we", "us"). We act as the data controller for personal data collected through the Services and are committed to protecting your privacy in line with the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Latvian data protection law.

This Privacy Policy explains what data we collect, why we collect it, how we use and protect it, and what rights you have over it.

When you register, subscribe, or interact with the Services we may collect identifiable details including your name, email address, work address, billing information (when paid tiers are introduced), Meta user ID, and the names of the Meta ad accounts and Pages you choose to connect. The legal basis for processing this information is the performance of our contract with you and our legitimate interest in operating, securing, and improving the Services.

We collect technical data such as browser type, operating system, IP address (truncated where possible), device identifiers, language preference, and basic usage telemetry to improve performance and reliability. The legal basis for this processing is our legitimate interest in maintaining a secure and functional service.

MarketingRoutine uses strictly necessary cookies to keep you signed in and to secure the dashboard. We also use limited product analytics and page-view measurement to understand aggregate usage, reliability, and onboarding completion. These tools are configured to avoid raw ad copy, prompts, tokens, and Meta payloads. Disabling strictly necessary cookies will prevent the Services from functioning correctly.

We use the information we collect to:

• Provide, operate, and maintain the Services.
• Authenticate your access and secure your account against unauthorised use.
• Mirror your connected Meta Ads data into our database so your AI chat client can answer questions and prepare actions efficiently.
• Communicate operational updates, security notifications, and product changes that materially affect you.
• Diagnose technical problems, audit security events, and improve the reliability of the Services.
• Comply with legal, accounting, and tax obligations applicable to SIA Digital Publisher.

We do not sell your personal data. We do not use your personal data, your Meta account data, or the contents of your campaigns for advertising, marketing to third parties, or training third-party AI models.

When you connect a Meta Ads account, the Services access data through Meta's official OAuth flow with the scopes you explicitly approve, such as managing campaigns, ads, ad sets, audiences, and creatives associated with the accounts you select.

• Your Meta OAuth access tokens are encrypted at rest using AES-256-GCM and are used solely to call the Meta Marketing and Graph APIs on your behalf.
• We mirror campaign, ad set, ad, creative, audience, and performance data from your connected Meta accounts into our database so the Services and your AI chat client can read this data efficiently and stay within Meta's rate limits.
• We do not sell, share, or transfer your Meta user data to third parties for their own purposes.
• We do not use your Meta user data for advertising, ad targeting on our behalf, or for training AI models.
• You may revoke MarketingRoutine's access at any time through Meta Business Settings or your MarketingRoutine dashboard. On revocation, we delete the encrypted tokens immediately and remove the mirrored Meta data within 30 days, except where retention is required by law.

When you connect MarketingRoutine to Claude, ChatGPT, or another MCP client, your AI chat client communicates with our MCP endpoint over authenticated HTTPS. The contents of your prompts and the responses produced by your AI client are subject to the privacy policies of Anthropic, OpenAI, or whichever provider you have chosen. We do not share your Meta access token with your AI client; the AI client asks MarketingRoutine to perform actions, and MarketingRoutine performs them on your behalf.

We use the following sub-processors to operate the Services. Each is bound by a written data processing agreement and provides appropriate safeguards for international transfers where applicable:

• Convex — database and serverless backend (data stored in EU region).
• Clerk — authentication and user identity.
• Render — application hosting and infrastructure.
• PostHog — product analytics for activation, reliability, and usage reporting.
• Resend — transactional and lifecycle email delivery.
• Meta Platforms, Inc. — Meta Marketing and Graph APIs (only when you connect a Meta Ads account).

An updated list is maintained as our infrastructure evolves; material additions will be communicated before they take effect.

We retain your personal data for as long as your account is active and for a limited period afterwards as required to comply with our legal obligations, resolve disputes, and enforce our agreements. Encrypted Meta access tokens are deleted on revocation or account closure; mirrored Meta Ads data is removed within 30 days of revocation. Audit logs and security events are retained for up to 12 months. Billing and tax records are retained for the period required by Latvian law.

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with comparable data protection laws, you have the following rights with respect to your personal data:

• Right of access — to obtain a copy of the personal data we hold about you.
• Right to rectification — to have inaccurate or incomplete personal data corrected.
• Right to erasure — to have your personal data deleted, subject to retention obligations.
• Right to restriction of processing — to limit how we process your personal data in defined circumstances.
• Right to data portability — to receive your personal data in a structured, commonly used, machine-readable format.
• Right to object — to processing based on legitimate interests.
• Right to withdraw consent — where processing is based on your consent.
• Right to lodge a complaint — with the Latvian Data State Inspectorate (Datu valsts inspekcija) or your local data protection authority.

To exercise any of these rights, email privacy@marketingroutine.ai with the subject "Data Subject Request". We respond within 30 days.

You can request deletion of your personal data at any time by emailing privacy@marketingroutine.ai with the subject "Request Data Deletion". If you revoke MarketingRoutine's Meta access through Meta Business Settings or from your dashboard, we automatically delete the associated encrypted tokens and the mirrored Meta data from our systems within 30 days.

Where personal data is transferred outside the European Economic Area, we rely on adequacy decisions, the European Commission's Standard Contractual Clauses, or other lawful transfer mechanisms to ensure an equivalent level of data protection.

We employ encryption in transit (TLS), encryption at rest (AES-256-GCM for Meta access tokens), strict authentication controls, rate limiting, and audit logging to safeguard your data. No security method is completely risk-free; we cannot guarantee absolute protection but we continuously work to reduce risk.

The Services are not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have collected such data in error, please contact us so we can delete it.

We may update this Privacy Policy from time to time. Material changes will be communicated through the Services or by email at least 14 days before they take effect, where reasonably practicable. The "Last updated" date at the top of this page indicates when the most recent revision occurred.

SIA Digital Publisher
Riga, Latvia
Email: privacy@marketingroutine.ai