Marketing AIgency
Menu

Privacy Policy

Last updated: September 13, 2026

Marketing AIgency ("we", "us") is a service operated by CBX Media LLC, Shams Business Center, Sharjah Media City Free Zone, Sharjah, United Arab Emirates. This policy explains what data we process when you visit marketing-aigency.com, use the application at app.marketing-aigency.com, or when a business that uses our service has placed our pixel or survey on its website.

1. Two roles: our own data, and data we process for our customers

For your account, your trial and subscription, and this website we are the controller. For everything our customers run through the service (their advertising accounts, their pixel, their surveys, their revenue data) we act as a processor on their instructions under a data processing agreement. If you are a visitor of a customer's website, that customer is your controller and its privacy policy applies; we describe below what our technology does there.

2. Data we collect as controller

  • Account data: name, e-mail address, company, role in the workspace, login events.
  • Trial and subscription: plan, trial dates, subscription status and the Stripe customer and subscription identifiers. Card data is entered on Stripe's pages and never reaches our servers.
  • Support and billing: e-mails you send us, plan, invoices and payment status. Card data is handled by Stripe and never reaches our servers.
  • Technical logs: timestamps, actions taken in the application, error logs, for security, audit and support.

3. Data we process for our customers

  • Advertising accounts: campaign, ad set and ad structures, budgets, performance metrics (spend, impressions, clicks, conversions, revenue as reported by the platform) and creative metadata from Meta, Google and TikTok, only for the accounts the customer connected. Access tokens are stored encrypted (AES-256-GCM); we never see platform passwords.
  • First-party pixel (True CPA): when a visitor submits a form on a customer's website, the e-mail address is hashed (SHA-256) on our server immediately and only the hash is stored, together with the page, campaign parameters (UTM, click IDs), referrer domain, time and consent status. Without consent no cookie is set. With consent a first-party cookie (_boz_attr, 90 days) remembers the first marketing touch.
  • Post-purchase survey (BOZ Source): answers to the customer's questions, order value, country, device, and a hashed e-mail if the customer passes one. Without consent no cookie is set.
  • Conversion feedback (CAPI): only if the customer switched it on and confirmed its privacy policy covers it, lead events with the hashed e-mail and click ID are sent to Meta for leads that were submitted with consent.
  • Business data: revenue per day (and optionally per channel) the customer uploads or links from a spreadsheet, or that we read from the customer's shop or CRM (Shopify, HubSpot, Pipedrive) with an access token the customer provides; tokens are stored encrypted and deleted when the source is removed.
  • Analytics uploads: tables the customer uploads to ask questions about them (CSV, up to ten files per workspace); kept until the customer deletes them.
  • Co-Pilot conversations: the messages a customer's users write to the assistant, the assistant's answers, and standing instructions they give. Visible to all members of that customer's workspace.

4. How we use it

To provide the service: read the connected accounts, calculate proposals, carry out changes the customer approved, set to autonomous within its own limits, or instructed through the Co-Pilot; attribute leads and revenue to channels; build reports; answer questions in the Co-Pilot; send account e-mails (invitations, alerts). We do not sell data and we do not use customer data to build profiles for third parties.

5. Artificial intelligence

Proposals, reports and Co-Pilot answers are generated with large language models provided by Anthropic (USA) through its API. The models receive campaign structures, metrics, the customer's calibration and the text of Co-Pilot messages; they never receive plaintext e-mail addresses, passwords or access tokens. Under our agreement Anthropic does not use this data to train models. Voice input in the Co-Pilot is transcribed by ElevenLabs; audio is processed for transcription only and not stored by us.

6. Where data is stored

Database and application functions run in Frankfurt, Germany (Supabase, Vercel). Our team accesses the systems from the United Arab Emirates. For transfers outside the EU we rely on the EU Standard Contractual Clauses and a transfer impact assessment, available in our data processing agreement. All traffic is encrypted in transit. Daily backups are kept for seven days.

7. Sub-processors

  • Supabase Inc. (database, authentication, file storage; EU region Frankfurt)
  • Vercel Inc. (application and website hosting; functions in Frankfurt)
  • Anthropic PBC (language models for proposals, reports and the Co-Pilot; USA)
  • ElevenLabs Inc. (speech-to-text for voice input; USA/EU)
  • GitHub Inc. (scheduled jobs that run the nightly agents; USA)
  • Google LLC (e-mail delivery for account e-mails; Google Workspace)
  • Stripe Payments Europe Ltd. (payments and invoices)
  • Meta Platforms Ireland, Google Ireland, TikTok Technology Ltd. (advertising platforms, at the customer's direction)

8. Retention

Account and workspace data are kept while the account exists. Platform tokens are deleted when a connection is removed. Pixel leads, survey answers and business data are kept while the customer's workspace exists and for 30 days after termination for export, then deleted. Audit logs are kept for 12 months.

9. Your rights

You can ask for access, correction, deletion, restriction or portability of your data and object to processing based on legitimate interests. Write to privacy@marketing-aigency.com. If you are a visitor of a customer's website, please contact that customer; we support them in answering you. You can also complain to a data protection authority. Removing the Marketing AIgency app inside a connected platform (for example Meta) sends us a deletion signal, see our data deletion page.

10. Cookies on this website

marketing-aigency.com uses no analytics or advertising cookies. The application at app.marketing-aigency.com uses strictly necessary cookies for login, language and workspace selection.

11. Changes and contact

We may update this policy; material changes are announced on this page and, for customers, by e-mail. Contact: privacy@marketing-aigency.com · CBX Media LLC, Shams Business Center, Sharjah Media City Free Zone, Sharjah, United Arab Emirates. See also our legal notice.