MarketMigo Privacy Policy (International)
This version is published in English for every language. A Spanish convenience translation is not included.
1. Who we are and how to contact us
This Privacy Policy explains how Juan Pablo Padrón Elenes, an individual (sole proprietor) based in Mexico who operates the online service known as "MarketMigo" ("MarketMigo," "we," "us," or "our"), collects, uses, discloses, and protects personal information. MarketMigo is a trade name, not a separate company. We are the controller (the party responsible) for the personal information described here, except as explained in Section 2. We operate MarketMigo from Mexico and provide it online only to business customers in many countries, other than the restricted territories described in Section 2; sales, onboarding, and support are remote, and we have no office, employees, or other physical presence outside Mexico.
Contact for all privacy matters: support@marketmigo.com · https://www.marketmigo.com. Section 21 adds details required in some countries.
2. Scope
This Policy covers our website (marketmigo.com), accounts and workspaces, the invite-only beta, support, billing, AI features, and integrations. MarketMigo is a business service for adults (18+). The people whose information we process are mainly business owners, their staff and invited workspace members, and business contacts.
Where we offer the Service. The Service is not offered to, and accounts may not be created by, customers located or established in the European Union, the European Economic Area (EEA), the United Kingdom, or Switzerland. We do not target, market, or direct the Service to people in those places, and we may refuse or close accounts of customers located or established there, as described in Section 3 of our Terms of Service.
Customer data. When a business customer uploads information about other people (for example, customer photos or testimonials) and decides how it is used, that business is responsible for it. We process it on the business's behalf, as a "processor" or "service provider," to provide the Service, under the data-protection terms in Section 24 of our Terms of Service. Questions about that data should go to the business; we will help it respond.
3. Information we collect
- 3.1 Identity and contact: name, email, account identifiers, profile photo, business name, country, state or city, language, and communications with us.
- 3.2 Authentication and security: session identifiers, login method, IP address, device and browser data, timestamps, security events, and diagnostics. Passwords are stored only in hashed form by our authentication provider.
- 3.3 Workspace and brand: business type, business phone number (requested before publishing is turned on), markets, products, prices, promotions, audiences, brand voice, strategy, calendars, members, roles, preferences (including your marketing-email and publicity-permission choices and when you made them), and plan limits.
- 3.4 Content: prompts, drafts, posts and Stories, images, media-library files (which may show people), uploaded documents, screenshots, generated output, approvals, and publishing metadata.
- 3.5 Connected platforms (Meta): account and Page identifiers, profile information, granted permissions, encrypted access tokens, published content, publishing status and receipts, insights and metrics you authorize, and scheduled profile changes, including a copy of the prior state so it can be restored.
- 3.6 Usage: feature use, requests, quotas, consumption, errors, and performance data.
- 3.7 Billing: the full billing address, billing name, and email collected at checkout; any business tax ID you provide; Stripe customer and subscription identifiers; plan, amounts (including any taxes included in the price), currency, invoices, status, and dates. We do not receive or store full card numbers.
- 3.8 Email and notifications: recipient address, message type and content, and delivery status; and, if you turn on browser notifications, Web Push subscription data (endpoint, keys, browser, and delivery result). You can turn browser notifications off at any time in MarketMigo or in your browser settings.
- 3.9 Support, privacy, and records: support requests and notes; privacy, export, and deletion requests; acceptance records (including the 18+ declaration and the recurring-charge authorization); and your marketing-email and publicity-permission choices, with where you made them, the wording shown, and the date and time.
- 3.10 Sales-assisted setup: before a business has an account, we may record, remotely, business information needed to prepare a proposal or account. We do this online, from public sources and what the business sends us; we do not visit businesses in person. This includes the business name; its public website and social pages; contact channels published as the business's own; the contact name and email the business gives us; its logo and photos (we discard photos that appear to show identifiable people); internal notes; a record that our first-contact privacy notice was sent or shown online; and sample posts and images. If the business opens an account, this information becomes account data. If it does not, it is deleted as described in Section 11.
We do not intend to collect sensitive personal information (for example, health data, precise geolocation, biometrics, racial or ethnic origin, religion, sexual orientation, government ID numbers, or financial account credentials). Please do not upload it.
4. Sources
We collect information from you; from workspace owners, admins, and members; from public web pages whose links you give us, and from public web searches our AI features run when researching a business; from information we gather online during sales-assisted setup; from services you connect (Meta and login providers); from Stripe; and automatically from your use of the Service. We do not buy personal information from data brokers.
5. How we use information
- Create, authenticate, operate, and secure accounts and isolated workspaces.
- Provide the features you request: brand setup, AI content and images, calendars, approvals, publishing to Instagram and Facebook, analytics, and support.
- Keep our no-invented-metrics commitment: we show and use statistics only from your own facts, official platform APIs, or screenshots you confirm.
- Prepare sales-assisted accounts and proposals, and run the invite-only beta, including collecting feedback.
- Process trials, subscriptions, charges, invoices, cancellations, and refunds; use your billing address for billing and tax compliance (for example, to determine and record any taxes included in the price); and prevent fraud and unauthorized spending.
- Monitor reliability and performance, debug, back up, and audit the Service.
- Send transactional messages (security, billing, trial and renewal reminders, and changes to terms) and, only if you opted in, marketing email (Section 9).
- Under the Terms permission, review and feature posts from businesses you own, unless you disable both in Settings or Account (Section 10). Existing declines and withdrawals remain in force.
- Comply with law, enforce our Terms, and protect rights and safety.
We do not use your private content or Meta data to build advertising profiles, and we do not sell personal information.
Legal grounds. Depending on the law that applies to you, we rely on the following grounds:
- Performance of our contract with you (or with the business you act for): creating and running accounts and workspaces, providing the features you request, support, trials, subscriptions, billing, and transactional messages.
- Compliance with legal obligations: invoices and tax and accounting records, legally required notices, and responding to lawful requests.
- Legitimate interests in operating a secure, reliable service, preventing fraud and misuse, enforcing one trial per account, improving the Service and collecting beta feedback, offering our Service to businesses without an account (Section 3.10, limited to business information and business contact details; you can object at any time and we will stop), and proving and defending our rights.
- Your consent, which is always optional and which you can withdraw at any time, for: (a) marketing email (Section 9); (b) featuring your business name, logo, and posts in our marketing (Section 10); (c) any case study that uses your performance numbers, which needs a separate "yes" for each case study; (d) browser (Web Push) notifications (Section 3.8); and (e) service usage analytics with PostHog (Section 14). These choices are separate from accepting the Terms or acknowledging this Policy, and refusing optional analytics does not prevent use of the Service. Withdrawing consent does not affect processing that took place before you withdrew it.
6. AI processing
When you use an AI feature, we send our AI provider (currently OpenAI, through its API) your prompt and only the context, files, references, or screenshots needed for the response. Under OpenAI's API terms, data sent through the API is not used to train OpenAI's models by default. We configure our requests so that OpenAI does not store them as application state (we do not use OpenAI's stored-conversation features). OpenAI may keep API inputs and outputs in abuse-monitoring logs for up to 30 days, or longer where required by law or reasonably necessary to protect its services or others from harm, and then deletes them. OpenAI processes this data in the United States. When a feature researches a business, it reads the public pages you provide and may run public web searches. For businesses without an account, it proposes only contact channels the business publishes as its own, includes no personal details of owners, staff, or customers, and discards photos that appear to show people. AI output is stored in your workspace when you keep it or when a feature needs a record.
7. How we disclose information
We disclose personal information only as described below.
- Service providers (processors) that act on our instructions under contract: Supabase (database, file storage, and authentication; our project is hosted in the United States, AWS us-east-1, Northern Virginia), Vercel (hosting, server functions, and content delivery; our server functions run in the United States, Washington, D.C. region, and static content is delivered from Vercel's global network), OpenAI (AI text and image generation), Stripe (payments), Resend (transactional email delivery), Grafana Labs (server-side monitoring, logs, and metrics), and PostHog (optional product usage analytics and technical reliability metrics, hosted in the United States).
- Stripe as an independent controller: for fraud prevention, anti-money-laundering, and identity verification, under Stripe's own privacy policy.
- Meta Platforms: when you connect Instagram or Facebook and direct us to publish, schedule, or sync, we send Meta the content and the data needed to carry out your instruction. Meta processes it under its own terms and privacy policy.
- Your workspace: members you invite can see workspace content, according to their role.
- Legal and safety: to comply with law, valid legal process, or government requests, or to protect rights, safety, and the Service.
- Business transfers: in a reorganization (for example, forming a company to operate MarketMigo), merger, or sale, subject to this Policy or an equally protective one, with notice to you.
- With your consent in any other case.
No sale, no targeted advertising. We do not sell personal information, and we do not share it for cross-context behavioral advertising or targeted advertising. We have not done so in the past 12 months. We treat Global Privacy Control (GPC) browser signals as a valid request to opt out of any sale or targeted advertising.
8. Meta platform data
"Meta Platform Data" means data we receive through Meta's APIs when you connect Instagram or Facebook.
- 8.1 Use. We use Meta Platform Data only to provide the features you request: publishing, scheduling, showing your account's posts and insights, and restoring scheduled profile changes. We also use it to secure the Service and to comply with the Meta Platform Terms and Developer Policies.
- 8.2 Restrictions. We do not sell, license, or buy Meta Platform Data. We do not use it for advertising, for surveillance, or to make eligibility decisions (such as credit, housing, employment, or insurance), and we do not transfer it to data brokers. We share it only with the service providers listed in Section 7 that are needed to provide the Service.
- 8.3 Metrics. Performance statistics come only from Meta's official APIs, your own facts, or screenshots you confirm. We do not invent or estimate metrics and present them as measured.
- 8.4 Disconnecting and deletion. You can disconnect an account in MarketMigo or remove our app in your Meta settings (Settings & Privacy > Business Integrations or Apps and Websites). To delete your Meta Platform Data, you can (a) request deletion at https://www.marketmigo.com/account/deletion or by emailing support@marketmigo.com with the subject "Meta data deletion," or (b) remove MarketMigo in your Facebook or Instagram settings and choose to request data deletion there. When Meta sends us your request, we verify Meta's signature, immediately remove the access tokens and advertising authorizations for that Meta user, and give Meta a confirmation code and a status link (https://www.marketmigo.com/data-deletion/status) where you can check progress with that code. We complete the deletion within 30 days, except for records we must keep by law (Section 11).
9. Marketing email
We send promotional email about MarketMigo only to users who ask for it. On the sign-up page (including sign-up through Google) there is a separate, optional checkbox: "Send me product news and marketing tips by email. (optional)" ("Envíame novedades del producto y consejos de marketing por correo. (opcional)" in Spanish), with a link to this Policy. It is unticked by default, and leaving it unticked does not affect your account. Accounts created for you by a workspace invitation or by our team are not opted in. You can also turn marketing email on or off later in your account's email notification settings. When you opt in or out, we record your choice, where you made it (sign-up, settings, or unsubscribe link), the wording shown, and the date and time, and we use your email address to send you marketing email, as allowed by the anti-spam and e-privacy laws that apply to you (for example, the US CAN-SPAM Act, and Canada's Anti-Spam Legislation). Each promotional email identifies us, uses accurate subject lines, includes a valid physical postal address for the sender, and includes a working one-click unsubscribe link in every marketing email that works without signing in. You can withdraw your consent at any time with that link or in your settings. We honor opt-outs within 10 business days, and usually immediately. You can also opt out by emailing support@marketmigo.com. Opting out does not stop transactional messages about your account, security, or billing.
10. Featuring and staff review
Your Terms acceptance authorizes staff review and featuring for businesses you own as described in Section 10 of the Terms. Turn off Feature posts and allow staff review in Settings or Account to block both across devices. We preserve earlier declines or withdrawals. Disabling it blocks staff access through the product, including Calendar support and prepared-account images, and removes retained provider diagnostic envelopes. Automated processing needed for generation, quality checks, storage, and your publishing instructions continues. This permission does not authorize AI model training, disclosure of account details or performance numbers, or use of Meta Platform Data for marketing. Contact support@marketmigo.com to request removal of an existing feature and exercise applicable rights.
11. Data retention
- Account, workspace, and content: kept while your account is active, then deleted after account deletion (operational target: within 30 days after a verified request). You can cancel a deletion request within its first 24 hours.
- Meta tokens and connected-account data: kept until you disconnect, revoke access, or delete your account; tokens are invalidated or removed on disconnection.
- Sales-assisted records with no account: deleted automatically 12 months after the last activity, or immediately on objection or request. We then keep only a one-way cryptographic hash on an opt-out list so we do not contact the business again.
- Free-trial fingerprint: a keyed one-way hash of each connected social account's identifier, kept only to enforce one trial per account.
- Transactional email records: kept while the account exists. Records of messages sent to addresses without an account are deleted after 12 months.
- Temporary files: unfinished uploads are deleted within hours; unused onboarding images within about 7 days; photos from an onboarding that was never completed after 30 days.
- Publicity materials: materials featuring your business that we published while your permission was active may stay where they were published after you withdraw permission or delete your account. After you withdraw, we stop new uses and delete unpublished drafts featuring your business within 30 days.
- Contract, acceptance, consent, and billing records: kept while the account exists and for 10 years after account deletion, to preserve contractual and commercial evidence under Articles 46 and 49 of Mexico's Commercial Code and meet applicable tax duties, with access restricted to proving the contract, handling taxes, or defending claims. They are then deleted, unless a dispute or legal duty requires keeping them longer.
- PostHog telemetry: limited event data is retained for product-use measurement and reliability under the project's configured rolling retention and applicable provider limits, and reviewed for deletion when no longer needed for those purposes. It is not part of the ten-year contractual-evidence archive. Your browser choice remains locally until you change or clear it; browser event identifiers are kept in memory rather than across page reloads. Withdrawing analytics stops future browser events, not already delivered records. Requests concerning existing data follow Section 13 and the legal exceptions there.
- Security logs and backups: kept for limited periods; backups expire on our providers' rotation cycle, and restored data remains subject to completed deletion requests.
12. Security and breach notification
We use reasonable administrative, technical, and physical safeguards. These include role-based access, row-level security, private file storage, expiring links, encrypted credentials, server-only keys, rate limits, audit logs, and breached-password screening (only an anonymous fragment of the password hash is checked). No system is perfectly secure. If a breach affects your personal information, we will notify you and the competent authorities within the time limits required by applicable law (see Section 21 for examples).
13. Your privacy rights
Wherever you live, you can ask us to:
- access the personal information we hold about you and receive a copy in a portable format (in-product data export is available);
- correct inaccurate or incomplete information;
- delete your personal information, subject to legal exceptions (account deletion is available in the product);
- object to or restrict certain uses, including marketing;
- withdraw consent at any time, where we rely on consent, without affecting earlier processing; and
- appeal our decision if we refuse a request, by replying to our decision or emailing support@marketmigo.com with the subject "Privacy appeal."
Exercising a right will not change your price or service. How to make a request: use the in-product export or deletion tools, or email support@marketmigo.com with the subject "Privacy request." We will verify your identity, normally by confirming control of your account email, and respond within one month, or sooner if your local law requires it (Section 21). Where the law allows, we may extend this period once and will tell you why. You may use an authorized agent with signed permission. For data a business customer controls, we may refer you to that business. You may also complain to the data-protection authority in your country.
15. Children's privacy
MarketMigo is a business service for adults 18 and older. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from a child, we will delete it promptly and close the account. Parents or guardians can contact support@marketmigo.com. Customers must not upload children's personal information unless they have the legally required parental consent, and they should avoid doing so in marketing content.
16. International transfers
MarketMigo is operated from Mexico, and our service providers store and process data mainly in the United States (our database and files with Supabase in Northern Virginia, our server functions with Vercel in the Washington, D.C. region, and AI processing with OpenAI). Some providers or subprocessors may process data in other countries. As a result, your information may be transferred to, stored in, and accessed from the United States and Mexico (by the operator and any authorized contractors, to provide support and run the Service), which may have data-protection laws different from those in your country. We protect transferred data with contracts, access controls, encryption in transit, and data minimization. Where the law of your country requires a specific transfer safeguard, we use one, such as contractual clauses with our providers.
17. Automated decisions
We use automation for security, usage limits, quality checks, and content generation. We do not make solely automated decisions that produce legal or similarly significant effects about individuals.
18. Language
This Policy is published in English. If we publish a translation, the English version controls, unless applicable law requires otherwise.
19. Changes to this Policy
We will post each new version with its date and a summary of changes. For material changes, we will notify you by email or in the Service before they take effect. We will not use personal information for a materially different purpose without notice and, where required, your consent.
Summary of version 2026-11-09-v2: aligns this Policy with the updated Terms and their Spanish translation; identifies optional browser analytics as a separate consent purpose; clarifies PostHog's receipt of IP and network metadata, internal account-linked records versus content-limited telemetry, text/image attempts, retries, failures and estimated costs, and measurement limits; and corrects contractual-evidence retention to ten years after account deletion under Mexican commercial record-keeping rules. This version does not enable additional tracking or turn on optional analytics. The effective date remains November 9, 2026.
20. Contact
Summary of version 2026-11-09-v3: service analytics is included in Terms acceptance, age 18 or older is confirmed by that acceptance, and the account can disable both featuring and staff review. Prior declines and withdrawals remain effective.
Juan Pablo Padrón Elenes, operating MarketMigo (trade name) · support@marketmigo.com · https://www.marketmigo.com
21. Regional information
These short sections add what the law of specific places requires. If they conflict with the rest of this Policy, they control for people in those places.
21.1 United States
- Which state laws apply. State privacy laws such as the California Consumer Privacy Act as amended by the CPRA (CCPA) and the Texas Data Privacy and Security Act (TDPSA) apply only to businesses that meet certain thresholds or definitions. Based on our current size, B2B model, and beta stage, we believe they likely do not yet apply to us in full (for example, we are well below the CCPA's revenue and volume thresholds, and the TDPSA exempts SBA-defined small businesses from most duties and excludes individuals acting in a commercial or employment context). Even so, we offer the rights in Section 13 to all US users, including the rights to know, access, correct, delete, and opt out, and we will update this section if those laws come to apply.
- Response time and appeals. Our one-month response time (Section 13) is within the 45 days that state laws allow; where those laws allow, we may extend it once by 45 days with notice. We decide appeals within 60 days. If you are not satisfied, you may contact your state attorney general; Texas residents can do so at https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint.
- Sale, sharing, sensitive data. We do not sell or share personal information, do not process it for targeted advertising or significant profiling, honor GPC, and do not collect or use sensitive personal information to infer characteristics.
- California notice at collection (if the CCPA applies). The categories we collect are identifiers, commercial information, internet or network activity, audio or visual information (images), professional information, and inferences limited to content preferences. We collect them for the purposes in Section 5, disclose them to the recipients in Section 7, and keep them as described in Section 11.
- Breach notice. We notify affected individuals and regulators as state law requires. For Texas residents, this means notifying affected individuals without unreasonable delay and no later than 60 days, and notifying the Texas Attorney General within 30 days when 250 or more Texans are affected.
- Children. We comply with the Children's Online Privacy Protection Act (COPPA) as described in Section 15.
21.2 Mexico
- Responsible party (responsable): Juan Pablo Padrón Elenes, operating MarketMigo, domicile: Prolongación Vista Hermosa 32, C.P. 05320, Ciudad de México, México, email support@marketmigo.com. This Policy is our comprehensive privacy notice (aviso de privacidad integral) under the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP).
- ARCO rights and consent. You can exercise your rights of access, rectification, cancellation, and opposition (ARCO), revoke your consent, or limit the use or disclosure of your data by emailing support@marketmigo.com with your name, the right you want to exercise, and a copy of an identity document (or proof of your representative's authority). We will respond within 20 days and, if your request is granted, implement it within 15 days after our response.
- Transfers. Transfers to our service providers (encargados) do not require your consent. Transfers to Stripe and Meta as independent recipients are made because they are necessary to perform the contract you entered into with us or to carry out your instructions, which the LFPDPPP allows without consent.
- Authority. If you believe your rights have been violated, you can file a complaint with the competent Mexican data-protection authority (currently the Secretaría Anticorrupción y Buen Gobierno).
21.3 Canada
- We handle personal information in line with PIPEDA and applicable provincial laws, including Quebec's Law 25. The person responsible for the protection of personal information is Juan Pablo Padrón Elenes, at support@marketmigo.com. Your information may be stored and processed outside your province and outside Canada (mainly in the United States and Mexico), where it may be accessible to local authorities. You can access and correct your information and withdraw consent as described in Section 13, and you can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.
21.4 Brazil
- We process personal data under the LGPD on the legal bases of contract performance, legitimate interests, consent, and compliance with legal obligations, as described in Section 5. You have the rights listed in Article 18 of the LGPD, including confirmation of processing, access, correction, anonymization or deletion, portability, information about sharing, and withdrawal of consent. Our contact channel for data-protection matters is support@marketmigo.com. You can complain to the National Data Protection Authority (ANPD). International transfers are protected as described in Section 16.
Effective date: November 9, 2026. Version: 2026-11-09-v3.