Privacy Policy

1. Introduction

MarketFlow ("we", "us", "our") is operated by nrg core global SRL, Romania, the data controller for the Service and the owner of the MarketFlow Facebook apps (including Facebook Login for Business). MarketFlow is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our Service at marketflow.ro.

2. Information We Collect

• Account data: name, email address, encrypted password.
• Business data: business name, location, social media handles, niche description.
• Social media data: when you connect a social account (e.g., TikTok), we retrieve profile info, follower counts, and post statistics via official APIs with your explicit consent.
• Usage data: pages visited, features used, timestamps — for improving the Service.

3. How We Use Your Information

• To provide and improve the Service (analytics, content suggestions, competitor analysis).
• To authenticate you and manage your account.
• To display your social media performance data within the platform.
• We do not sell, rent, or share your personal data or social media data with third parties for advertising purposes.

4. Third-Party Social Media Integrations

When you connect a social media account, we request only the permissions necessary to provide the Service. Access tokens are stored securely and encrypted. You can revoke access at any time from your account settings or directly from the platform (e.g., TikTok Settings → Connected Apps).

Facebook Pages: When you connect your Facebook account, we access your Facebook Pages list (pages_show_list) to identify the business Page you manage, and read its post engagement data (pages_read_engagement) — including reactions, comments, shares, reach, and impressions — exclusively for display within your MarketFlow analytics dashboard. We do not access Pages that you do not manage, and we do not use this data for advertising or share it with third parties.

Facebook videos (Video Editor): If you choose “Connect Facebook” in the Video Editor, we ask for your public profile and the videos you uploaded to your own Facebook profile (user_videos). We read each video’s title, thumbnail, length and file only to show them to you under “My Facebook videos” and to create the new clip you ask for (trimmed and reframed to 9:16 or 1:1). The list of videos is not stored — it is read from Facebook each time you open the editor — and the new clip exists on our server only while it is being sent to you. We only access videos uploaded by your own profile, never videos of other people. You can disconnect at any time from the Video Editor or by removing the app in Facebook Settings → Apps and Websites; both delete the stored access token immediately. The connection is also deleted automatically when Facebook reports the access token as expired or revoked, and in any case 60 days after you connected, when the token expires and is no longer needed.

Data retrieved from social platforms is used exclusively within your MarketFlow account and is not shared with other users or third parties.

5. Data Retention

We keep your data only while it is needed to provide the Service to you. You can delete your account at any time from My Account → Delete my account and all data: your account, businesses, imported posts and social media connections are deleted from our database immediately, and MarketFlow is removed from your Facebook account. Social media connections are deleted as soon as you disconnect them, when the platform revokes access, or when their access token expires (Facebook video connections: 60 days). Encrypted server backups are rotated automatically and no longer contain deleted data after at most 6 months. We also delete your data when the law requires it, for example on a GDPR erasure request.

6. Data Security

We use industry-standard security measures including HTTPS encryption, secure HTTP-only cookies, and hashed passwords. Access tokens for social integrations, and the Facebook user ID stored with a Facebook video connection, are encrypted (AES-256-GCM) before they are written to our database; server backups are encrypted as well.

7. Your Rights

You have the right to access, correct, or delete your personal data. To exercise these rights, contact us at [email protected]. We will respond within 30 days.

8. Cookies

We use strictly necessary cookies for authentication (session cookies) and security (CSRF tokens). We do not use tracking or advertising cookies.

9. Children's Privacy

The Service is not directed to individuals under 18. We do not knowingly collect data from minors.

10. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes via email or an in-app notice. Continued use of the Service constitutes acceptance.

11. Contact

Data controller: nrg core global SRL, Romania. Privacy questions: [email protected]