This Privacy Policy explains how Pinnacle Partners Alliance Ltd ("we", "us", "our"), the operator of Marketiflo (the "Service", at marketiflo.com), collects, uses, shares, keeps and protects personal data, and the rights you have. It is written to meet the requirements of the Data Protection Act 2017 of Mauritius (the "Act"), in particular section 23.
We act in two capacities, and this Policy says which applies:
| Category | Examples | Required or voluntary |
|---|---|---|
| Account information | Name, email address, password (stored only in scrambled, hashed form), account role | Required to open and secure an account. Without it we cannot provide the Service. |
| Business information | Business name, industry, description, contact details, brand voice, logo and colours you enter | Voluntary, but the AI features work poorly without it. |
| Connected social account data | Facebook Pages, Instagram and TikTok accounts you connect, their profile data, posts, comments and engagement figures, accessed only with your authorisation through the platforms' official APIs | Voluntary. Only needed if you want us to publish or read comments for you. |
| Content | Captions, images, videos, photos and posts you create, upload or generate | Voluntary. |
| Enquiries you log | Details you record about customer enquiries (for example channel, date, value, outcome) | Voluntary. |
| Payment information | Card brand, last four digits and a payment token held by our payment provider. We never see or store full card numbers. | Required for paid plans. |
| Usage and technical data | Log records of actions taken, AI usage, error reports, IP address and device/browser type | Collected automatically; needed to run, secure and bill the Service. |
We do not ask for, and you should not upload, special categories of personal data (for example health, religion or political opinions) unless you have a lawful basis to do so.
| Purpose | Lawful basis |
|---|---|
| Creating and running your account, publishing and managing content at your direction, AI generation from the inputs you give | Performance of our contract with you |
| Taking payments, issuing receipts and keeping accounting records | Contract, and compliance with our legal obligations |
| Security, fraud and abuse prevention, fixing faults | Our legitimate interests in a safe, working service |
| Service messages (security alerts, billing notices, changes to the Service) | Contract and legitimate interests |
| Occasional tips and reminders to account holders, for example if an account has been inactive for several days | Legitimate interests (existing customer relationship). You can object at any time using the unsubscribe link in every such email; we then stop straight away. |
| Anything else we ask your permission for | Your consent, which you can withdraw at any time without affecting processing already done |
Marketiflo uses artificial intelligence to draft marketing content: captions, strategies, plans, images and videos. The inputs you provide (your prompts, business details, and where you ask for it, photos and comments) are sent to our AI providers listed in section 5 to produce that output.
We do not sell personal data. We share it only with the providers needed to run the Service. Processors act only on our instructions under written contracts that require them to keep the data secure (section 31). Independent recipients receive data because you tell us to send it to them, and they handle it under their own terms.
| Provider | Role | What for | Where the data is processed |
|---|---|---|---|
| Supabase | Processor | Database, sign-in and file storage | Ireland (EU) |
| DigitalOcean | Processor | Application server | United Kingdom (London) |
| Cloudflare | Processor | Website delivery and protection | Global network |
| Anthropic (Claude) | Processor | AI text generation | United States |
| Google (Gemini API) | Processor | AI image generation; voiceovers for videos (text to speech) | United States / global |
| Higgsfield | Processor | AI video generation | United States |
| Resend | Processor | Sending emails (receipts, notices, reports) | United States |
| Peach Payments | Processor | Card payments and subscription billing | Mauritius / South Africa |
| Google Workspace | Processor | Our email inboxes (support, legal) | United States / global |
| Google Fonts | Independent recipient | Delivering the typefaces the app uses (your IP address and browser type when fonts load) | United States / global |
| Card networks and the acquiring bank (Visa, Mastercard, American Express) | Independent recipient | Authorising and settling card payments | Global |
| Meta (Facebook, Instagram) | Independent recipient | Publishing and reading engagement on accounts you connect | Ireland / United States |
| TikTok | Independent recipient | Publishing to accounts you connect | Global |
We may also disclose data where the law requires it, for example to a court or regulator. Changes to this list are published here, and business customers receive notice under the Data Processing Agreement.
Most of the providers above process data outside Mauritius, in the countries shown. For each transfer we rely on appropriate safeguards: the provider's data processing agreement, including standard contractual clauses where the provider offers them, and its security commitments. We declare these destinations to the Data Protection Office, as the Act requires, and assess every new provider before any transfer to it. You can ask [email protected] for a description of the safeguards for any specific transfer.
| Data | Kept for | Why |
|---|---|---|
| Account, business information and content | While your account is open; deleted within 30 days after you ask us to close it | Needed to provide the Service |
| Connected social account tokens | Until you disconnect the account or close your account | Needed to act on the account for you |
| Workspace chat history and AI outputs | While your account is open, unless you delete them sooner | So you can see past work |
| Payment records and receipts | 7 years from the transaction | Accounting and tax law |
| Usage and error logs | Up to 24 months | Billing disputes, security and fault-finding |
| Record of marketing email opt-outs | As long as needed to honour your choice | So we never email you again after you object |
| Backups | Overwritten on a rolling basis, within 30 days | Disaster recovery |
When a retention period ends, we delete or irreversibly anonymise the data as soon as reasonably practicable, and ask any processor holding it to do the same.
To exercise a right, email [email protected]. We may need to confirm your identity. We answer within one month and do not charge a fee unless a request is manifestly unfounded or excessive.
If you are unhappy with how we handle your personal data, please tell us first so we can put it right. You also have the right to lodge a complaint with the Data Protection Commissioner: Data Protection Office, Mauritius, [email protected], dataprotection.govmu.org.
We use encryption in transit, strict access controls, database row-level security that keeps each customer's data separate, secret keys held only on our server, spending and rate limits on our systems, and reputable infrastructure providers. Card data is handled by our payment provider and never touches our servers. No system is completely secure, but we review our measures regularly.
If a breach of personal data occurs, we will contain it, notify the Data Protection Commissioner without undue delay and, where feasible, within 72 hours of becoming aware of it, and tell affected people without undue delay where the breach is likely to put their rights and freedoms at high risk. Where we act as a processor, we notify the business customer concerned without undue delay.
We use only the cookies and browser storage strictly necessary to keep you signed in and to make features work. We do not use advertising cookies. See our Cookie Notice.
Marketiflo is a business service and is not directed at anyone under 18. We do not knowingly collect children's data; if you believe we have, contact us and we will delete it.
We update this Policy when our processing changes. Material changes are announced in the app or by email before they take effect. The version and date are shown at the top.