Data Processing Terms

Most customers only put their own business information into MarketPilot X. If you are an agency or consultant, you may also enter information belonging to your clients. These terms describe how we handle that data on your behalf. They are drafted as a foundation for a data processing agreement — they are not a lawyer-approved DPA.

• You are the controller of the personal data you put into the service about your clients and contacts. You decide what to enter and why.
• We are the processor for that data: we store and process it so we can provide the service to you.
• For your own account data (your email, your billing details) we are the controller — see the Privacy Policy.

• Subject matter: providing marketing planning, content generation and analysis features.
• Duration: for as long as your account is open, plus a short deletion window.
• Types of data: whatever you choose to enter — typically business names, business contact details, website addresses, marketing notes and performance figures.
• Data subjects: your clients and their staff or contacts.

The service is not intended for special-category data (health, biometrics, political opinions and similar) or for payment card data. Please do not enter it.

We process client data only to provide and support the service, and to comply with the law. We do not use it to train our own models, to market to your clients, or for any separate purpose of our own.

Access is limited to the operator and only where necessary to run or support the service. Anyone with access is bound by a duty of confidentiality.

• Encryption in transit for all traffic.
• Server-side authorisation and database-level access rules separating each account.
• Payment data handled entirely by Stripe.
• Least-privilege administrative access.

These are the measures actually in place. We make no certification claim of any kind.

We use a small number of providers to run the service: a hosting, database and authentication provider; Stripe for payments; AI model providers for generation features; and Google where you connect a Google service. By accepting these terms you authorise their use. If we add or replace a subprocessor in a way that affects client data, we will make a reasonable effort to inform account holders in advance.

If one of your clients exercises a data right, you handle the request as the controller. Most of the data is visible and editable directly in your account. Where you need more, email marketpilotai@gmail.com and we will give reasonable assistance.

If we become aware of a security incident affecting your data, we will inform you without undue delay, describe what we know, and tell you what we are doing about it.

You can delete content inside the app at any time. On account closure, or on written request, we delete or anonymise client data within a reasonable period, except where the law requires us to keep records. You can request an export before closing your account.

Providers may process data outside Malta or the EEA, relying on the safeguards those providers have in place.

If your organisation needs a signed data processing agreement with a specific subprocessor list, email us and we will work through it with you.