Privacy Policy

1. Who we are and what this policy covers

MarketMind AI is an AI-assisted marketing platform for Egyptian small and medium businesses. This policy explains what personal data the platform collects, why it is collected, where it flows, how long it is kept, and the choices you have.

MarketMind AI is operated by the MarketMind project team. Formal operator legal identity and registration details: to be completed following legal review. [LEGAL REVIEW]

2. What data we collect

We collect only the data the product needs to work. This includes:

• Account data: your email address (used for login and verification), your name (optional), a bcrypt-hashed password (we never store your password in readable form), your preferred language, and your role on the platform.
• Sign-in and session data: records of active sessions, including IP address, browser user-agent, and last login time. If you sign in with Google, the email, display name, and profile picture returned by your Google account.
• Business profile data: business name, industry, city, area, address, location coordinates, and social page links you enter during discovery.
• Discovery data: your interview answers, AI conversation history within discovery sessions, and research observations gathered from public web sources.
• Voice notes: if you use voice input, short audio recordings (WAV, currently limited to 5 MB / 45 seconds) that are transcribed to text and are not saved as audio files by the application.
• Strategy and content data: your confirmed strategy decisions, weekly context, promotion details you approve, AI-generated drafts, and their review/approval history.
• Media files: images you upload to the media library (JPEG, PNG, or WebP, currently limited to 10 MB per file).
• Facebook connection data: when you connect a Facebook Page, an access token stored in encrypted form (AES-256-GCM), plus page performance metrics retrieved for the performance workspace.
• Billing data: your points balance and usage ledger, and payment transaction records (amount, currency, status, provider transaction reference). The hosted demo currently uses a clearly labelled simulated payment provider. Card numbers are never stored by MarketMind.

3. Why we use your data

We do not sell your personal data, and we do not run advertising or analytics trackers on the website.

• To create and secure your account, verify your email, and manage sessions.
• To run the product journey you asked for: discovery, strategy generation, weekly content generation, publishing assistance, and performance insights.
• To send transactional emails (verification, password reset, connection expiry notices).
• To operate prepaid points billing when enabled.
• To protect the service and its users against abuse (for example, login and request rate limits).

4. How AI processing works

MarketMind uses third-party large language model (LLM) providers (OpenAI, Google Gemini, or OpenRouter, depending on configuration) to generate strategy plans, content drafts, and images, and to transcribe voice notes.

What this means for your data:

• Discovery and strategy: your business profile and interview answers are included in prompts sent to the AI provider so the output matches your business.
• Content generation: prompts are automatically scrubbed of contact details (phone numbers and email addresses) before being sent; approved call-to-action destinations are preserved.
• Knowledge retrieval (RAG): the retrieval knowledge base is a curated, human-reviewed marketing corpus owned by the project — it is not built from your documents. Retrieval queries are scrubbed of email/phone patterns before search.
• Output controls: strategy and content outputs pass deterministic validation (claim grounding, prohibited claims, schema, and language checks) before they are stored or shown. Invalid outputs are repaired within a bounded number of attempts or rejected.
• Human control: AI never publishes on its own. Real publishing always requires your explicit approval.

5. Where your data flows (third parties)

Depending on the features you use, your data is processed by these third parties under their own privacy terms:

• Google: account sign-in (OAuth) and Gemini AI models for generation/transcription.
• OpenAI / OpenRouter: AI text and image generation via the configured provider.
• Meta (Facebook): page connection, publishing, and page performance insights when you connect a page.
• Paymob: payment processing when real payments are enabled (not active on the hosted demo, which uses a simulated provider). Paymob receives the name and email on your account for checkout. Card details are handled by Paymob and are not stored by MarketMind.
• SerpAPI and Apify: public web and public Facebook page research during discovery, when those integrations are enabled.
• Cloudflare R2: storage of generated content images, when that storage backend is enabled.
• An SMTP email provider: delivery of transactional emails.
• Cloud hosting (currently an AWS EC2 instance for the hosted demo), with TLS encryption in transit.

6. Cookies

The website uses only strictly necessary cookies and local storage: a session refresh cookie (HttpOnly), short-lived OAuth state cookies during sign-in/connection flows, and a language-preference cookie. There are no advertising, profiling, or third-party analytics cookies.

7. How we protect your data

No system can guarantee perfect security. If you believe your data was affected by an incident, contact us at the email below.

• Passwords are stored only as bcrypt hashes; sensitive tokens (such as Facebook page tokens) are encrypted at rest with AES-256-GCM and key-version rotation support.
• Role-based access control separates owner and platform-admin capabilities, and owner-facing business requests are scoped to the relevant business data.
• Payment webhooks are verified with HMAC signatures before anything is accepted.
• Login, registration, and forgot-password request initiation have dedicated rate limits. Reset-password links are high-entropy, single-use, and time-limited; the final password submission relies on those token protections rather than the custom request limiter. AI workflows have per-owner request limits.
• Uploaded and generated files are validated by type, size, and content signature before storage.
• Errors returned to users are stable, coded messages; internal details stay in server logs.

8. How long we keep data

Account and product data is kept while your account exists. We currently do not run automated retention or deletion jobs, and there is no self-service account deletion yet — this is a known gap tracked in the project roadmap. To request deletion of your account and data, contact us at the email below and the team will handle it manually.

9. Your rights

You can see and correct your profile information inside the product at any time. For anything else — accessing a copy of your data, correcting it, deleting it, objecting to or restricting processing — contact us at the email below and the project team will handle your request manually. Self-service export and deletion tooling is not implemented yet; this is a known limitation documented in the project roadmap.

10. International transfers

Some providers listed above (for example OpenAI and Cloudflare) may process data outside Egypt. Transfers depend on those providers' terms and the configuration in use.

11. GDPR readiness (not a compliance claim)

MarketMind AI is a graduation project. GDPR readiness is currently partial: transparency, purpose limitation, data minimization, and security measures are implemented as described above, while automated retention, self-service deletion/export, and formal records of processing are not yet in place. This policy has not been reviewed by a lawyer, and nothing here should be read as a claim of formal GDPR compliance. [LEGAL REVIEW]

12. Children

The platform is intended for adults who own or manage a business. It is not directed at children.

13. Changes to this policy

If we change this policy, we will update the date at the top and, for significant changes, notify you inside the product.

14. Contact

Questions or requests about your data: hello@marketmind.ai