Last updated: March 24, 2026

Privacy Policy

How we collect, use, and protect your information

Data We Collect

We collect information you provide directly when creating your account, generating brand kits, and using our AI features.

Account information (name, email, password hash)
Brand kit content you create (brand names, descriptions, preferences)
Usage data (features used, generation history, credit consumption)
Payment information (processed securely via Stripe — we never store card numbers)
Device and browser information for service optimization
Where your signup came from: campaign parameters (utm_*), click identifiers from Google or Meta ads (gclid, fbclid), the landing page, the referring site, and the browser identifiers of our analytics and ad tools when present (Google Analytics client id, Meta _fbp/_fbc) — stored on your profile from the first-party cookie described in our Cookie Policy, and deleted with your account

How We Use Your Data

Your data powers your brand experience and helps us improve the platform.

Generate and deliver AI-powered brand kits, logos, and content
Process payments and manage your subscription
Send transactional emails (receipts, delivery notifications)
Improve our AI models and service quality (anonymized data only)
Prevent fraud and ensure platform security

AI & Your Content

Your brand kits and creative content are yours.

We do not train AI models on your individual brand kit content
AI generations are processed by third-party providers (Anthropic, FAL.ai, Ideogram) under strict data processing agreements
You retain full ownership of all generated content
Shared brand kit links are public — only share what you intend to

Data Sharing

We share data with the service providers that run Markuva, and with measurement and advertising services as described below.

Stripe — payment processing
Supabase — database and authentication
Vercel — hosting and deployment, plus Vercel Web Analytics and Speed Insights (page views and performance; load only with your Analytics consent)
Anthropic, FAL.ai, Ideogram, OpenAI — AI generation services
Resend — email delivery
Google Analytics 4 — usage measurement. With your Analytics consent it sets cookies (_ga) to distinguish sessions. Without it, Google still receives a cookieless ping for each page (IP address, browser, page URL without single-use tokens — no cookie and no account identifier), which Google uses to model aggregate traffic; this is the Consent Mode behaviour of the Google tag. Legal basis: consent for cookies, legitimate interest for the cookieless ping. You can revoke consent in Settings
Meta (Facebook/Instagram) — advertising measurement, in two separate ways. (a) The Meta Pixel in your browser, only with your Advertising consent. (b) Our server sends Meta the events "account created", "viewed the brand kit offer", "started checkout" and "purchased" for every account (Conversions API), with your email and account id as SHA-256 hashes, the Meta click identifier when present, your IP address and browser, and the purchase amount and currency. Legal basis for (b): legitimate interest in measuring our advertising; the cookie banner does not switch it off. You can object in Settings at any time, and from then on no event of your account is sent; events already sent cannot be recalled. Nothing is sent to Meta until our Meta integration is activated
Google Ads — conversion measurement in your browser (signup, checkout started, purchase), only with your Advertising consent and only once our Google Ads tag is activated

Security

We take reasonable measures to protect your data.

All data encrypted in transit (TLS 1.3) and at rest
Row-level security on all database tables
OAuth 2.0 authentication with Google and GitHub
Regular security audits and dependency updates

Your Rights

You have control over your personal data.

Access — request a copy of your data at any time
Correction — update your account information in Settings
Deletion — delete your account and the data tied to it; billing records held by our payment processor (Stripe) are kept for tax purposes
Portability — export your brand kits as PDF
Opt-out — unsubscribe from marketing emails
Cookies — change your Analytics and Advertising choice at any time in Settings or in the cookie banner
Objection — stop the server-side sending of your account events to Meta, in Settings
Limit — data already sent to third-party measurement services (Google Analytics, Meta) before you revoke or delete cannot be recalled by us; each of those services is bound by its own retention rules

Contact

Questions about privacy? Reach us at privacy@markuva.com