Comprehensive Privacy Notice
Mexico-based notice describing MarketMigo personal-data processing, with additional information for international use. The Spanish version controls for data subjects in Mexico. This English version is provided for convenience.
1. Controller identity and address
Juan Pablo Padrón Elenes, an individual with address at Prolongación Vista Hermosa 32, is the controller for the personal-data processing in this Notice. MarketMigo is only the unregistered name of the product the Controller operates; it is not a separate company or entity.
Privacy contact: the Controller through support@marketmigo.com and +525527602358. Website: https://www.marketmigo.com.
2. Scope and roles
This Notice covers the MarketMigo website, accounts, workspaces, support, billing, AI tools, and integrations. The Controller determines purposes and means for administration, account, security, usage, and billing data.
When a business customer uploads other people’s data and decides its use, that customer is the controller and must provide its own lawful notice and instructions; MarketMigo acts as processor to provide the Service. This Notice does not replace the customer’s notice.
3. Personal data we process
- Identity and contact: name, email, account identifiers, profile photo, organization, country, language, and communications.
- Authentication and security: session identifiers, login provider, events, IP or pseudonymous buckets, device, browser, timestamps, diagnostics, and alerts. We do not receive your password in readable text.
- Workspace and brand: business, industry, markets, products, audiences, voice, strategy, members, roles, preferences, and limits.
- Content: prompts, drafts, calendars, approvals, images, files, screenshots, analytics, generated output, and publishing metadata.
- Connected platforms: identifiers, pages or channels, profile, permissions, encrypted tokens, content, status, receipts, and authorized metrics.
- Usage and API: requests, consumption, quotas, spend reservations, functions, states, errors, and operating evidence.
- Billing: Stripe customer and subscription, plan, amounts, currency, tax, invoices, status, and dates; we do not store the full card number.
- Support, privacy, and compliance: messages, ARCO, export or deletion requests, acceptance records, and evidence needed to resolve them.
- Web Push: device endpoint, public subscription keys, user agent, expiration, and delivery result when enabled.
4. Sensitive data and children
The Service is not directed to anyone under 18 and is not intended to collect sensitive data. Do not upload health, identifiable biometrics, race or ethnicity, religion, political opinions, sexual orientation, secrets, or similar information unless strictly necessary, lawful, authorized, and covered by a specific agreement.
If we identify unauthorized child or sensitive data, we may isolate or delete it and request information to address the incident. An age statement does not replace legal duties if we gain actual knowledge.
5. Sources
We collect data directly from you; workspace owners, admins, or members; services you connect, including login and social platforms; payment processors; and automatically from technical use. We do not buy personal-data lists from data brokers.
6. Primary and necessary purposes
- Create, authenticate, administer, and protect accounts and isolated workspaces.
- Provide requested brand, content, AI, image, asset, calendar, approval, publishing, analytics, and support functions.
- Connect authorized services, maintain tokens, synchronize information, and preserve receipts or status.
- Administer plans, limits, charges, invoices, cancellations, expressly activated trials, and prevention of unauthorized spend.
- Detect fraud, abuse, incidents, failures, improper access, and violations; maintain continuity, backups, and audits.
- Handle rights, exports, deletion, complaints, support, tax, contractual, regulatory, and valid legal obligations.
- Send necessary security, service, billing, and legal-change communications.
7. Secondary or optional purposes
We currently do not sell data, share it for cross-context behavioral advertising, or use private content to create advertising profiles. If we offer marketing email, optional research, non-essential cookies, or another secondary purpose, we will provide a separate choice you may decline without losing the basic Service.
To limit non-essential communications, send “Limit use” to support@marketmigo.com or use the applicable unsubscribe link. Necessary transaction and security messages continue.
8. Artificial-intelligence processing
When you request an AI feature, we send the applicable provider the prompt and only the context, file, reference, or screenshot needed for the response. Output may be stored in your workspace when you choose or when the feature requires a record.
We do not authorize a provider to use private content for advertising. Provider retention and training must follow the applicable contract. You must have a lawful basis for third-party data in prompts or files.
10. Processors, recipients, and transfers
We use processors for hosting, database, storage, authentication, AI, payments, security, monitoring, and support, currently including Vercel, Supabase, OpenAI, and Stripe as relevant. They must process under instructions and applicable contractual safeguards.
- We transmit data to a connected platform when you direct authentication, synchronization, or publication.
- We may disclose information to authorities or others when law, a valid order, safety, or rights defense requires.
- A genuine reorganization or Service transfer may include data with notice, confidentiality, and continued rights.
We will not make a transfer requiring consent without a separate request explaining recipient, purpose, and choice. Acknowledging this Notice is not consent to a non-exempt transfer.
11. International processing and transfers
The Controller operates from Mexico, and some processors operate in the United States or elsewhere. We use minimization, contracts, security, and required transfer mechanisms. Mexico does not currently have a general EU adequacy decision.
Before receiving EEA or UK regulated data from a customer where safeguards are required, the parties must execute a data-processing agreement and applicable SCC, UK Addendum or IDTA and assessment. Do not start that regulated transfer until those safeguards are complete.
12. Retention, blocking, and deletion
- Account, workspace, and content: while active, then only as needed for export, deletion, disputes, security, and obligations.
- Connected credentials: until disconnect, revocation, or deletion; we seek to invalidate or remove them when a verified request is processed.
- Verified deletion: operational target no later than 30 days, subject to identity, backups, obligations, and third-party systems.
- Acceptance and contract evidence: up to ten years after the commercial relationship ends, or longer for an active dispute or duty; pseudonymized where appropriate.
- Billing, tax, fraud, and security: for applicable legal or limitation periods.
- Backups: until they leave the provider’s protected cycle; restored data remains subject to completed requests.
13. Security and breaches
We use reasonable controls such as workspace and role access, row-level security, private files, expiring links, encrypted credentials, server-only keys, limits, audit, and incident response. No control guarantees absolute security.
If a breach significantly affects your economic or moral rights, we will notify you immediately as required with the nature, affected data, recommendations, corrective actions, and information channels.
14. ARCO rights, withdrawal, and limits
You may request Access, Rectification, Cancellation, or Objection (ARCO), withdraw consent where it is the basis, or limit use and disclosure. Send “MarketMigo ARCO request” to support@marketmigo.com with name, response method, identity or representative evidence, requested right, clear data description, and locating details.
We will decide within 20 days after a complete request and, if granted, implement within the next 15 days; each may be extended once where allowed. Access is provided electronically unless another feasible method is requested. We will explain denials and available remedies.
You may also use https://www.marketmigo.com/account/deletion while signed in. If we process for a customer, we may direct you to that controller. You may complain to Mexico’s Secretaría Anticorrupción y Buen Gobierno or another competent authority under current law.
15. Rights outside Mexico
When EU or UK GDPR applies because we target an offering or monitor behavior there, legal bases may include contract, legal duty, assessed legitimate interests, and consent. Rights may include access, correction, erasure, restriction, portability, objection, consent withdrawal, and regulator complaint. If local representation is required, we will not target that activity until a representative is appointed and published.
Where California law applies, rights may include know, access, correction, deletion, portability, non-discrimination, and opt out of sale or sharing. We currently do not sell or share data for cross-context behavioral advertising. We may voluntarily extend comparable rights even below a statutory threshold.
16. Automated decisions
MarketMigo uses automation for security, limits, quality, and generation, but does not intend to make solely automated decisions producing significant legal effects about individuals. If that changes, we will disclose logic, consequences, and rights before processing.
17. Changes to this Notice
We will post version, date, and summary at https://www.marketmigo.com/privacy and may notify by email or in the Service. A new incompatible purpose or processing requiring consent is not authorized merely by posting a change; we will request the necessary choice.
18. Privacy contact
Controller: Juan Pablo Padrón Elenes · Address: Prolongación Vista Hermosa 32 · Phone: +525527602358 · Email: support@marketmigo.com · Website: https://www.marketmigo.com. General support is also available at support@marketmigo.com.