Privacy Policy
Full transparency on how we collect, use, and protect your personal data.
Who we are
MARKETING OS (hereinafter the "Platform", "we" or the "Service") is an autonomous marketing platform for small and medium businesses, operated by:
- Legal name
- FREDERICO CANTEIRO DA SILVA - COMÉRCIO E PRESTAÇÃO DE SERVIÇOS, (SU), LDA
- Tax ID (NIF)
- 5003212467
- Registered address
- Benguela, Município de Lobito, Bairro Caponte, Rua Oliveira Cardonega
- Contact email
- contato@mktos.app
- Data Protection Officer (DPO)
- contato@mktos.app
This policy is drafted in accordance with the following laws:
By using the Service, the user declares to have read, understood and accepted the terms described in this policy.
Data we collect
We collect different categories of data depending on how the user interacts with the Platform.
2.1 — Account data
When the user creates an account:
- Full name
- Email address
- Password (stored encrypted — never in plain text)
- Preferred language (Portuguese or English)
- Google authentication data: name, email and unique identifier
2.2 — Company data (Brand Brain)
- Business name and description
- Website and social media profiles
- Logo, color palette and visual identity
- Target audience, products, services and competitors
- Business goals
- Content, images and assets uploaded by the user
2.3 — Social media data
When the user connects Instagram or Facebook via the Meta Graph API:
- Account ID and username
- OAuth access tokens (stored encrypted)
- Public profile metadata (bio, followers, category)
- Metrics for existing posts and future posts made via the Platform
2.4 — Data generated by the Platform
- Monthly strategies, editorial calendars and AI-generated posts
- Designs, images and videos produced automatically
- History of approvals, edits and publications
- Performance reports and audits
2.5 — Payment and credits data
- Available credit balance
- History of credit consumption by action
- Bank transfer receipts (manual payment)
- Card tokens via Stripe — we never store full card data
2.6 — Technical and usage data
- IP address
- Device type, operating system and browser
- Pages visited, actions taken and session time
- Technical errors and crash reports
- Traffic source (referrer)
2.7 — Communications
When the user contacts us, we retain the content of the communication and associated data (email, date, subject) for support and record-keeping purposes.
How we use the data
We use the data we collect for the following purposes:
| Purpose | Legal basis |
|---|---|
| Create and manage the user's account | Contract performance |
| Generate content, strategy and designs via AI | Contract performance |
| Publish content on connected social media accounts | Contract performance |
| Perform audits and generate recommendations | Contract performance |
| Process payments and manage credits | Contract performance and legal obligation |
| Send transactional emails | Contract performance |
| Send marketing communications about the Service | Consent — revocable at any time |
| Analyse usage to improve the product | Legitimate interest |
| Detect fraud, abuse and violations of the terms | Legitimate interest |
| Comply with legal and tax obligations | Legal obligation |
Artificial Intelligence and content processing
The Platform uses LLMs and image/video generation models to create strategy, content, designs and other marketing assets.
- 01Sending to AI providersThe content provided is sent to OpenRouter and fal.ai to generate the requested outputs.
- 02No training on your dataThese providers are contractually prohibited from using your data to train their own models, unless explicitly enabled by the user.
- 03Controlled storageGenerated content is stored only to make it available to the user, and is never shared with third parties without authorisation.
- 04User responsibilityThe user is responsible for the final content approved and published, even when generated by AI.
Sharing data with third parties
To provide the Service, we rely on third-party providers (subprocessors) who are contractually required to meet security and privacy standards equivalent to our own.
| Provider | Purpose | Location |
|---|---|---|
| OpenRouter | AI language processing | United States |
| fal.ai | AI visual and audio content generation | United States |
| Cloudflare R2 | File storage | Global |
| Meta Platforms | Social media connection and publishing | USA / Ireland |
| ElevenLabs | AI voice synthesis | United States |
| HeyGen (via fal.ai) | AI video generation | United States |
| Stripe | Card payments (outside Angola) | USA / Ireland |
| Resend | Sending email communications | USA / EU |
| PostHog | Product usage analytics | European Union |
| Sentry | Technical error monitoring | USA / EU |
| OAuth authentication | Global |
International data transfers
Some providers are located outside Angola and the European Union, namely in the United States. When these transfers occur, we ensure appropriate safeguards:
- Standard Contractual Clauses approved by the European Commission
- Providers' adherence to recognised data protection frameworks
- Prior assessment of the recipient country's level of protection
Data retention
We retain data for as long as necessary to fulfil the purposes for which it was collected, unless a longer period is required by law.
| Data category | Retention period |
|---|---|
| Active account data | For as long as the account is active |
| Inactive or deleted account data | Up to 30 days after the deletion request |
| Content generated by the Platform | For as long as the account is active |
| Social media OAuth tokens | Until disconnection or account deletion |
| Billing and transaction data | 10 years (tax and accounting obligation) |
| Aggregated and anonymised analytics data | Indefinitely |
| Technical logs and error reports | 90 days |
After these periods end, data is securely deleted or anonymised.
Your rights
Under applicable law, the user has the following rights over their personal data:
To exercise any of these rights, contact us at contato@mktos.app or visit delete data for deletion requests. We respond within the legal deadline (up to 30 days).
Data security
We apply technical and organisational measures to protect data against unauthorised access, loss, alteration or disclosure:
In the event of a data breach that may significantly affect the user's rights, we commit to notifying the competent authority and the user within the legal deadline.
Minors
The Platform is intended exclusively for users aged 18 or older (or the legal age of majority in the user's country of residence). We do not knowingly collect data from minors. If we become aware that we have done so without parental consent, we will delete that data immediately.
Account and data deletion
The user can delete their account at any time in Account Settings or by sending a request to contato@mktos.app.
More information at delete data.
Partner and Affiliate Program
This section applies to anyone who applies to or takes part in the Affiliate Program or the Managing Partner Program, and supplements the other sections of this policy.
13.1 — Application and partner account
When you fill in the application form, we collect:
- Name, email address and the type of partnership you want (affiliate, manager or both)
- Phone/WhatsApp and city, if you provide them (optional fields)
- The introduction message, if you write one (optional field)
We use this data to assess the application, reply to you and, if it is approved, create your access to the Partner Area. We keep it only as long as needed for these purposes. Once you are approved, the account rules described in the previous sections also apply.
13.2 — Referral tracking
- Each affiliate has a personal link. When a visitor opens it, we store a cookie (mos_ref) with the partner code for 90 days; the first link the visitor clicked prevails
- We record the click with the IP address converted into a non-reversible code (hash), to count clicks and detect abuse, without storing the IP in clear for this purpose
- If the visitor creates an account in that period, the account is attributed to the partner for commission purposes
- The affiliate only sees totals and the status of the accounts they referred; they have no access to the referred business account or its content
13.3 — Commission payments
- To pay commissions by bank transfer, we process the data needed for payment (account holder and bank details) and, where applicable, tax information
- This data is kept for the periods required by tax and accounting obligations
13.4 — Managing Partners
- A Managing Partner processes, inside their workspace, data of their clients' businesses. They do so on the client's behalf and are responsible for having the business owner's authorisation
- Each business keeps its data, plan, credits and history separate. The manager's other clients cannot access that data
- What the manager charges each client is recorded only in the manager's workspace and is not shown to the client
- If a business leaves the workspace, its owner keeps ownership and the full history of the business
We do not sell applicant or partner data. The rights described in section 08 also apply to this data and can be exercised through contato@mktos.app.
Changes to this policy
We may update this policy to reflect legal, technical or Service changes. When that happens:
- We publish the updated version on this page with a new revision date
- We notify users by email in case of material changes
- Continued use of the Service after notification implies acceptance of the new terms
We recommend checking this page periodically.
Contact
For any question, request or complaint related to this policy or the processing of your personal data:
- General email
- contato@mktos.app
- Data Protection Officer (DPO)
- contato@mktos.app
- Postal address
- Benguela, Município de Lobito, Bairro Caponte, Rua Oliveira Cardonega