Last updated: 2026-08-16
This Privacy Policy explains how market4.me (the "Service"), operated by Bleart Emini, a sole proprietor ("we," "us," "our"), collects, uses, and protects information when you use the Service. It should be read alongside our Terms of Service.
We use this information to operate the Service: generating ad copy and creative tailored to your business, running the ad-policy guardrail check, showing you your campaigns/leads/inventory/ analytics, processing billing through Stripe, and communicating with you about your account. If you opt in to Live Ad Management, we also use your campaign's real Meta performance data to decide whether and how to adjust its budget/targeting, within the limits you've set — see the Terms of Service for how that feature works. We do not use your business or campaign data to train AI models beyond what's necessary to generate your own drafts, and we do not sell your data to third parties.
Delivering the Service involves the following subprocessors, each of which processes a subset of your data under their own privacy terms: Anthropic (ad copy/targeting generation, ad-policy and media-quality guardrail checks on generated copy and images, Meta ad-spec conversion, website-scan/brand analysis, spokesperson-ad script generation and claim checks, and, if enabled, Business Autopilot lead classification, Live Ad Management budget/targeting decisions, Supercharged trend research, and AI inventory-capture item classification — receives your business context, chat messages, and, for the relevant features, generated images, an uploaded real presenter's photo (for automated framing/quality feedback), campaign performance data, and cropped regions of stock photos you take with inventory capture), fal.ai (image, video — including spokesperson/ talking-head video — AI voiceover, and background-music generation, plus speech-to-text transcription of your ad's narration audio as part of our automated media-quality check and object detection on AI inventory-capture photos — receives prompts, any inspiration images/video you upload, an uploaded real presenter's photo/video and voiceover audio (to animate that likeness, if you use that option), the shelf/stock photos you take for inventory capture, and, for narration, your voiceover script text and the raw narration audio itself), Meta (if you connect your own Meta advertising account — receives your business/ad account info, targeting, ad creative, and, if you enable Live Ad Management, ongoing budget/targeting changes; if you enable conversion tracking, also receives a one-way cryptographic hash of a lead's email/phone number plus the sale amount, via Meta's Conversions API, for ad-performance measurement; if you enable Business Autopilot, also sends lead/contact data from your Meta Lead Ads/Messenger back to us; if you connect Instagram for organic posting, receives each post you approve — caption, hashtags, and media, which Instagram's servers fetch from us via short-lived signed links), Resend (transactional email — receives your account's contact email address, and, for Commercial-tier team invites, an invited team member's email address, to deliver signup verification, two-factor, and password-reset codes, along with other transactional mail: the welcome email, trial reminders, team invites, and — unless you turn it off — a monthly digest whose body includes your business's campaign, lead, and revenue summary), Stripe (billing — receives your payment details directly, not through us), OpenCage (geocoding — receives your business's service-area text to convert it to approximate coordinates), the U.S. National Weather Service (if you use weather-triggered Live Ad Management — receives your business's approximate service-area coordinates to check for active weather alerts; a U.S. government API, no account or API key involved), MongoDB Atlas (database hosting — stores everything listed in Section 1), Upstash (rate limiting), Fly.io and Cloudflare (application hosting), and Sentry (error monitoring — may capture technical error details, not intentionally your business content). Keep this list in sync with the Terms of Service and the Infra & Integrations table in CLAUDE.md if the stack changes.
If you use the Leads or Inventory & Sales features to track your own customers, you are the one collecting and controlling that data — we're processing it on your behalf, as a tool you use, not as an independent party with our own relationship to your customers. You're responsible for having a lawful basis to collect and store your customers' information and for your own privacy disclosures to them.
If you use the spokesperson ad feature with your own uploaded photo or video of a real person, that person may be neither you nor your customer — for example, an employee or hired talent. As with your customers' data, we're processing this on your behalf as a tool you use, not independently reaching out to that person ourselves. You're responsible for obtaining that person's written consent before uploading their likeness, and for your own disclosures to them about how it will be used. We store your confirmation that you've done so (see Section 1) but do not independently verify the underlying release.
We use up to four first-party cookies, all functional (no third-party advertising or tracking cookies on the Service itself): a session cookie that keeps you logged in; if you enable two-factor authentication, a short-lived cookie that tracks a pending 2FA verification during login (expires with the verification code, typically minutes); if you choose "remember this device," a trusted-device cookie (expires after 30 days) so you're not asked for a 2FA code on every login from that browser; and, if you're accepting a Commercial-tier team invite, a similar short-lived cookie that tracks a pending team-invite verification during that signup. If you install the optional website tracking snippet (Website Building product) on your own site, it sets a `localStorage` entry (not a cookie) on your visitors' browsers to generate an anonymous, randomly-assigned visitor ID for pageview counting.
If you cancel your subscription, your account data is retained for 90 days (to allow easy reactivation) and then permanently deleted, except where we're required to retain records by law. This applies to everything described in Section 1, including uploaded spokesperson photos/video and their consent records, and Commercial-tier team member and location data. This matches the retention policy stated in our Terms of Service.
Depending on where you're located, you may have rights to access, correct, or delete your personal information, or to object to certain processing. To request deletion of your data, see our Data Deletion Instructions page. For any other request — access, correction, or objection — contact us (below); there is currently no self-serve way to export or manage this data from within the Service, so we handle these requests manually.
The Service is intended for business use and is not directed at children. You must be at least 18 years old to create an account, per our Terms of Service.
We take reasonable technical measures to protect your information, including password hashing (argon2id), httpOnly session cookies, and encrypted connections. Every account must verify its email address, and you can additionally enable optional two-factor authentication (an emailed one-time code at login) in Settings for extra protection. If you connect your own Meta advertising account, the access token we store for it is additionally encrypted at rest (AES-256-GCM) — a stronger protection than the rest of your account data receives, because unlike most of what we store, a live token is directly usable against a third-party API if exposed. No method of transmission or storage is 100% secure, and we can't guarantee absolute security.
A small number of our own operators can access account data (including data listed in Section 1) through an internal tool, to provide customer support, resolve billing issues, or set up an account on your behalf when you ask us to. This access is not available to the public and is separate from any account-level login.
We may update this Privacy Policy from time to time. We'll notify you by email at least 30 days before material changes take effect, matching our Terms of Service.
Questions about this Privacy Policy, or requests to access/correct/delete your data: art@market4.me.