Privacy policy
Last updated: November 9, 2026 · version 2026-11-09
This English version is a translation provided for convenience. In case of any discrepancy, the French version prevails.
This policy explains what data Marketiq processes, why, for how long, who it is shared with and how to exercise your rights, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.
1. Data controller
The data controller is Yanis Makhlouf EI, a sole proprietorship (French micro-enterprise) trading as SERENIA, located at 4 rue des Maquisards, 68120 Pfastatt, France, registered in the French national business register (RNE), SIREN 882 104 524, SIRET 882 104 524 00021. Contact for any question about your data: yanismakhlouf@gmail.com.
When you use Marketiq to manage your own clients' campaigns (agencies), you remain the controller of your clients' data and Yanis Makhlouf EI acts as a processor within the meaning of Article 28 GDPR, under the conditions set out in the Terms of use.
2. Data we process
| Category | Examples | Source |
|---|---|---|
| Account | Name, email address, password (stored hashed), Google ID if you sign in with Google | You |
| Workspace and brand | Brand name, website, brand tone, target audience, market, language, monthly budget, goal | You |
| Products | URL, name, price, description, benefits, images, reviews and FAQ published on the product page | You and public web pages you ask us to analyze |
| Generated content | Analyses, strategies, ad copy, scripts, visual concepts, scores, campaign versions | AI agents, based on your data |
| Ad accounts | OAuth access tokens (encrypted), account ID and name, currency, time zone, Pages, pixels, custom audiences (name and size), conversion actions, identities, payment status | Meta, Google Ads, TikTok, with your authorization |
| Campaigns and performance | Campaign structure, budgets, spend, impressions, clicks, conversions, revenue | You and the advertising platforms |
| Audit trail | Action log (approvals, launches, budget changes), AI generation history, IP address during sensitive actions | Generated by the service |
| Technical data | Session cookie, technical and security logs | Your browser |
We do not process sensitive data within the meaning of Article 9 GDPR and do not access the individual personal data of the people who see your ads: the platforms only send us aggregated statistics and the names of your audiences, never their members.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Create and manage your account, provide the service (analysis, generation, publishing, reporting) | Performance of the contract |
| Publish, pause and manage your campaigns on the platforms, only after your explicit approval | Performance of the contract |
| Keep proof of approvals, launches and budget changes | Legitimate interest (security, evidence) and legal obligations |
| Secure the service (abuse prevention, rate limiting, incident detection) | Legitimate interest |
| Billing and accounting | Legal obligation |
| Send you service emails (security, password reset, alerts) | Performance of the contract |
We do not sell or rent your data, and we do not use it for advertising purposes on our own behalf or on behalf of third parties.
4. Artificial intelligence
Content is generated by AI models provided by Anthropic (Claude). The data needed for each generation (brand and product information, strategy, aggregated statistics) is sent to the provider to produce the response. Under Anthropic's commercial API terms, this data is not used to train its models. Every generation is logged in your history (agent, model, cost, status).
Generated content is a proposal: no campaign is published and no budget is changed without your explicit approval.
5. Data from advertising platforms
When you connect a Meta, Google Ads or TikTok account, you authorize us, through the platform's OAuth protocol, to access that account with the strictly necessary permissions: creating and managing campaigns, reading statistics and, for Meta, creating an ad account in your Business Manager if you ask us to. Access tokens are encrypted (AES-256-GCM), never exposed in your browser and deleted when you disconnect the account or delete your Marketiq account. You can also revoke access at any time from the platform's settings.
Google data
Marketiq's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google Ads data is only used to provide the features you see in Marketiq; it is not used for advertising, not sold and not read by any human except with your consent, for security reasons or to comply with the law.
Meta data
Data obtained through Meta's APIs is processed in accordance with the Meta Platform Terms. You can request its deletion at any time: see Data deletion.
6. Recipients and subprocessors
Your data is only accessible to the members of your workspace, according to their role, and to authorized staff of Yanis Makhlouf EI when needed for support or security. It is hosted and processed by the subprocessors listed on the Subprocessors page. The advertising platforms receive the campaigns you approve.
7. Transfers outside the European Union
Some subprocessors are based in the United States. Transfers are covered by the EU–US Data Privacy Framework when the recipient is certified under it or, failing that, by the European Commission's standard contractual clauses, supplemented by security measures (encryption in transit and at rest).
8. Retention periods
- Account and content: for as long as you use the service, then deleted when the account is deleted.
- Platform tokens: until the ad account is disconnected or your account is deleted.
- Approval and launch log: until the workspace concerned is deleted.
- Billing data: 10 years (accounting obligation).
- Technical and security logs: 12 months maximum.
- Backups: deleted data disappears from backups within 30 days at most.
9. Your rights
You have the right to access, rectify, erase, restrict, object to and port your data, as well as the right to set instructions regarding its use after your death.
- Portability: download all your data in JSON format from Settings → Account and data.
- Erasure: delete your account from Settings → Account and data. Your active campaigns are paused on the platforms before deletion.
- Other requests: write to yanismakhlouf@gmail.com. We reply within one month.
If you believe your rights are not being respected, you can lodge a complaint with the French data protection authority, Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, 75007 Paris — www.cnil.fr.
10. Cookies
Marketiq only uses cookies that are strictly necessary for the service to work (authentication session cookie and your language preference). They are exempt from consent. We use neither advertising cookies nor third-party audience measurement tools. If this were to change, your consent would be requested beforehand.
11. Security
Measures in place: encrypted communications (HTTPS), encryption of platform tokens, hashed passwords, strict data isolation per workspace, role-based access control, rate limiting, logging of sensitive actions, and protection against requests to internal addresses when analyzing web pages. In the event of a data breach that poses a risk to your rights, we will inform you as required by the GDPR.
12. Changes
We may update this policy. In the event of a significant change, we will inform you in the app or by email and, if necessary, ask you to accept it again.