Privacy Policy

Who we are

Markerati is operated by [LEGAL ENTITY], [TAX ID], [ADDRESS]. Privacy contact: [DPO EMAIL].

Each program is sold by the person who runs it (the "organizer"), who decides what to do with buyers' data. For that data the organizer is the controller and Markerati is the processor. For organizers' accounts, Markerati is the controller.

What we collect

Buyers: name, email, phone (WhatsApp) when you give it or the program requires it, the country of purchase, what you bought, amounts and dates. Cards are processed by Stripe; we never see the number.

We also keep, when there are any: reviews you write, refund requests and their reason, and your answer about which video brought you.

Waitlist: name, email and an optional phone.

Videos: the videos an organizer uploads, the clips made from them and their transcripts. Session recordings can include the image and voice of participants who consented.

Organizers: name, email, password (stored only as a hash) and the mailing address shown in the invite footer.

Clicks on tracked links: time, the referring page and a code that changes every day (a keyed hash of IP and browser). We don't store IPs or the browser itself.

Why we use it

To deliver the program you bought (contract): confirmation, reminders, room and group links.

To show the organizer which links brought in sales (legitimate interest). You can turn the attribution cookie off below.

To tell you about future programs, only if you checked that option or confirmed the waitlist (consent). Every invite has an unsubscribe link.

To show your first name and last initial (like Ana S.) on the program page, only if you checked that option (consent). Otherwise the page shows numbers only.

To use your image and voice in promo videos for the program, only if you checked that option at checkout (consent). You can withdraw it in "My data": recordings of sessions with you stop being used, videos made from them come off Markerati pages and the organizer is emailed. Videos already posted elsewhere stay up until the organizer removes them.

Pix: the payment goes straight to the organizer's account; we keep only the order reference so they can check it in their bank.

Cookies

They're all first-party cookies: none is shared with ad platforms.

Needed to log in: mk_session (keeps organizers logged in to the dashboard), mk_editor (keeps editors logged in), mk_claim (up to 48 h, ties the email confirmation to the browser that set the password), mk_oauth (10 minutes, while you log in with Google or Facebook) and mk_oauth_pending (30 minutes, while the account waits for an email address).

Preferences: mk_locale and mk_theme remember language and theme.

Attribution (for 30 days): mk_src remembers which tracked link brought you, to credit the sale to the right post; mk_bio remembers which video the bio link featured when you clicked (an estimate that never gets the sale's credit); mk_utm remembers the link's campaign tags (utm_).

mk_noattr: remembers that you turned attribution off. With it, the three attribution cookies aren't set.

Who we share it with

These services receive personal data to do the work described, and only for that (sub-processors):

Resend: name, email address and the content of each email, to send confirmations, reminders and updates.

Vercel: every visit and form (IP address included), to host the site.

Supabase: the database holding all the data in this policy, to store it; uploaded images (program cover, photo), to store and show them.

Cloudflare (R2): uploaded videos and clips, session recordings included, to store and play them.

The program's organizer sees the name, email and phone of buyers and waitlist sign-ups. We don't sell data.

Ad measurement (optional)

No organizer uses ad measurement today: we send no data to ad platforms (Meta, TikTok, Google).

The organizer (the controller) does this on the basis of your consent, which you can withdraw at any time from "My data". We treat your browser's Global Privacy Control (GPC) signal as a refusal, and turning off the attribution cookie also turns measurement off.

We don't sell personal data. Under California law (CCPA/CPRA), sending data for ad measurement is "sharing" and only happens with your consent; GPC counts as a request not to share. Records of these sends are deleted after 90 days.

How long we keep it

Unfinished checkouts: personal data deleted after 30 days.

Clicks: individual records become daily totals after 90 days.

Copies of sent emails: content deleted after 30 days.

Waitlist: 12 months after sign-up or the last confirmation.

Paid orders: financial records (amount, date, program) are kept as long as tax law requires [PERIOD, e.g. 5 years]; personal data can be deleted on request.

Your rights

Under the LGPD (art. 18), GDPR and CCPA you can access, correct, port and delete your data, and withdraw consent.

To view, download or delete your data now, use the "My data" page: we email you an access link. For other requests, write to [DPO EMAIL]. You can also complain to your data protection authority.

International transfers

Some sub-processors are outside your country (for example in the US). We rely on the safeguards the law provides, such as standard contractual clauses [CONFIRM WITH COUNSEL].

Security

Encrypted connections, hashed passwords, access links that expire and a log of who exports data. No system is perfect: if an incident affects you, we'll tell you.