Privacy Policy

1. Introduction

markXpand ("we," "our," or "us") is an AI-powered marketing platform operated by Nextoria Information Technology LLC, registered in Dubai, United Arab Emirates. This Privacy Policy describes how we collect, use, store, share, and protect your personal information and data obtained through third-party services, including the Google Ads API, Google OAuth 2.0, the Meta Marketing API, the LinkedIn Marketing API, the TikTok Marketing API, and other advertising platform APIs.

By using markXpand, you agree to the practices described in this policy. If you do not agree, please do not use our services.

2. Information We Collect

2.1 Account Information

When you register or log in, we collect:

• Email address
• Mobile number
• Password (stored as a cryptographic hash — we never store plaintext passwords)
• Organization name (if provided)
• Account creation date

2.2 Google Account Data

When you connect your Google account via OAuth 2.0, we receive and store:

• Email address and profile information — used to identify your account.
• OAuth refresh token — used to maintain access to your connected Google services. This token is encrypted using AES encryption before storage in our database and is decrypted only at the time of API calls.

2.3 Google Ads Data

When you use markXpand's Google Ads features, we access the following data via the Google Ads API:

• Account information — Google Ads customer IDs, account names, manager account hierarchy.
• Campaign data — Campaign names, statuses, budgets, bidding strategies, targeting settings.
• Ad group and ad data — Ad group names, ad content, keywords, match types.
• Performance metrics — Impressions, clicks, cost, conversions, and other reporting metrics.
• Conversion tracking data — Conversion actions and conversion values synced from your Google Ads account.

2.4 Meta (Facebook & Instagram) Data

When you connect your Meta account via Facebook Login (OAuth 2.0), we receive and store:

• Facebook user ID, name, and email — used to identify your account.
• OAuth access token — used to maintain access to your Meta advertising services. This token is encrypted using AES-256 encryption before storage and is decrypted only at the time of API calls.
• Facebook Page IDs and names — to create ads on behalf of your pages.
• Instagram Business Account ID — to create Instagram ads linked to your business profile.
• Ad Account IDs and names — to manage and launch advertising campaigns.
• Campaign and ad data — campaign names, statuses, budgets, targeting settings, ad creatives, and performance metrics created through markXpand.

2.5 LinkedIn Data

When you connect your LinkedIn account via OAuth 2.0 (OpenID Connect), we receive and store:

• LinkedIn member ID, name, and email — used to identify your account.
• OAuth access token — used to maintain access to your LinkedIn advertising services. This token is encrypted using AES-256 encryption before storage and is decrypted only at the time of API calls.
• LinkedIn Ad Account IDs and names — to manage and launch advertising campaigns on your behalf.
• Campaign data — campaign group names, campaign objectives, budgets, targeting settings, ad creatives, and performance metrics created through markXpand.

2.6 TikTok Data

When you connect your TikTok Business account via OAuth 2.0, we receive and store:

• TikTok advertiser ID(s), display name, and contact email — used to identify your authorized advertiser account(s).
• OAuth access token and refresh token — used to maintain access to your TikTok advertising services. These tokens are encrypted using AES-256 encryption before storage and are decrypted only at the time of API calls.
• TikTok Ad Account IDs and names — to manage and launch advertising campaigns on your behalf.
• TikTok Business Center IDs and Pixel IDs (where applicable) — to manage advertiser relationships and conversion tracking.
• Campaign data — campaign names, statuses, budgets, schedules, targeting attributes, ad creatives (images and video), and performance metrics created through markXpand.

2.7 Customer Brand Assets

When you sign up or use markXpand, you may provide us with business identifiers that we use to operate the Service and, with your continuing customer status, to identify you in marketing materials as described in our Terms of Service §11.2:

• Company name and trade name
• Company logo and brand identifiers (when uploaded to your account or extracted from your connected ad platforms)
• Website URL and business description

You may opt out of marketing use of your company name and logo at any time by emailing info@markxpand.com.

2.8 Website & Brand Scan Data

When you enter your website address during signup or onboarding, markXpand performs an automated scan of that website only to help you set up your account faster. The scan reads your public homepage, your "About" page, and a limited number of product or service pages on the same domain. We honor robots.txt directives and do not scan any website you do not provide.

From your website, we may extract and store:

• Brand information — business name, tagline, description, logo, brand colors and fonts, tone of voice, and positioning.
• Catalog information — product and service names, descriptions, prices, and images.
• Publicly listed business contact details — such as a contact email address, phone number, or physical address, where these appear on your website.
• Competitor references — the names of comparable companies in your market. These are generated by AI based on your business category and are not obtained by scanning any competitor's website.

To perform this analysis, the text of your scanned pages (which may include the contact details above) is sent to our AI providers (Google Gemini, with OpenAI as a fallback) for extraction. This content is used only to build your brand profile and is not used to train any generalized or non-personalized AI or machine-learning model, consistent with Section 4.6 of this policy.

The resulting brand profile is stored in your markXpand account and used to pre-fill your organization details and to generate campaign content. You can review, edit, or remove this information at any time from your account, or request its deletion as described in Section 10.3.

2.9 Billing and Payment Information

If you subscribe to a paid plan, we (or our payment processor on our behalf) collect and store:

• Billing name and address
• Tax identifier (TRN/VAT number) where applicable
• Payment method metadata — last four digits of the card, card brand, expiration date, billing country. We do not store full card numbers or CVV codes on our servers; these are handled directly by our PCI-DSS compliant payment processor.
• Transaction history — invoice records, payment dates, amounts, and failure/retry logs for fraud prevention.

2.10 Usage Data

We collect standard web server logs including IP addresses, browser type, pages visited, and timestamps to maintain service security and performance.

3. How We Use Your Data

We use the data we collect for the following purposes:

Data Type	Purpose
Account information	Authentication, account management, and communication
Google Ads account data	Displaying your campaigns, creating and managing ads, budget allocation
Google Ads performance metrics	Reporting dashboards, AI-powered campaign optimization recommendations
OAuth tokens (Google, Meta, LinkedIn, TikTok)	Maintaining authenticated access to your connected advertising platforms
Conversion tracking data	Syncing and displaying conversion performance within markXpand
Company name, logo, and brand identifiers	Identifying you as a markXpand customer in our marketing materials (case studies, customer lists, partner submissions). Opt-out available per Terms of Service §11.2.
Billing and payment metadata	Processing subscription payments, issuing invoices, fraud prevention, and tax compliance
Usage data	Service improvement, security monitoring, and debugging

4. Google Ads API Data — Specific Disclosures

markXpand's use of information received from the Google Ads API adheres to the Google Ads API Terms and Conditions and the Google API Services User Data Policy.

4.1 What We Access

We request the following Google OAuth scopes:

• https://www.googleapis.com/auth/adwords — to manage your Google Ads campaigns
• https://www.googleapis.com/auth/userinfo.email — to identify your account
• https://www.googleapis.com/auth/userinfo.profile — to display your name
• https://www.googleapis.com/auth/content — to manage Google Merchant Center (Shopping campaigns)

4.2 How We Store Google Data

• OAuth refresh tokens are encrypted using AES-256 encryption before storage in our SQL Server database. The encryption key is stored separately in application configuration and is not accessible from the database.
• Campaign and reporting data is fetched on-demand from the Google Ads API and is used for display in the markXpand dashboard. We cache performance data temporarily to reduce API calls.
• No Google Ads data is stored permanently beyond what is necessary for the features you use (e.g., campaign configurations you create through markXpand).

4.3 How We Share Google Data

We do not share your Google Ads data with any third parties except:

• Google — when making API calls on your behalf to manage your campaigns.
• Google Gemini AI — when you use our AI features, anonymized campaign context (not personal data) may be sent to Google's Gemini API to generate content recommendations. No Google Ads customer IDs, account names, or personally identifiable information is sent to Gemini.
• Legal requirements — if required by law, regulation, or valid legal process.

4.4 Prohibited Uses

We will never:

• Sell or transfer Google user data to third parties, advertising networks, data brokers, or information resellers.
• Use Google user data for serving ads, retargeting, or personalized advertising.
• Use Google user data to determine creditworthiness or for lending purposes.
• Use Google user data for surveillance purposes.

4.5 Limited Use Compliance

In accordance with these Limited Use requirements:

• We use Google user data only to provide or improve user-facing features that are prominent in the markXpand experience.
• We do not transfer Google user data except as necessary to provide or improve user-facing features (with user consent), for security purposes, to comply with applicable law, or as part of a merger, acquisition, or sale of assets where the user is notified.
• We do not use Google user data for serving advertisements, including retargeting, personalized, or interest-based advertising.
• We do not sell or transfer Google user data to third parties such as advertising platforms, data brokers, or information resellers.

4.6 No AI/ML Model Training With Google User Data

markXpand does not use Google user data — including data received via the Google Ads API, Google Merchant Center (Content) API, or Gmail API — to develop, train, fine-tune, or improve any generalized or non-personalized artificial intelligence or machine learning model.

markXpand uses Google's Gemini AI (via Google Cloud Vertex AI) to generate marketing content suggestions such as ad headlines, descriptions, and image concepts. When generating content, markXpand sends only the campaign context the user has explicitly provided (for example: product name, marketing objective, target audience description, and country). markXpand does not send Google Ads account data, Google Ads customer IDs, conversion data, performance metrics, Gmail message content, or any other Google user data obtained via Google API scopes to Gemini or any other AI/ML service.

markXpand uses Gemini through Google Cloud Vertex AI in a configuration where customer prompts and responses are not used by Google to train Google's foundation models, in accordance with Google Cloud's data governance commitments for Vertex AI.

4.7 Human Access to Google User Data

markXpand does not permit any human (including markXpand employees, contractors, or third parties) to read Google user data, except in the following limited circumstances expressly permitted by the Google API Services User Data Policy:

• With the user's explicit affirmative consent to view specific data (for example, a support request where the user authorizes us to view a specific campaign or ad).
• When necessary for security purposes, such as investigating abuse, fraud, or a security incident.
• When required to comply with applicable law or valid legal process.
• For internal operations, and only when the data has been aggregated and anonymized so it cannot be used to identify any individual user.

5. Meta (Facebook & Instagram) Data — Specific Disclosures

markXpand's use of information received from the Meta Platform adheres to the Meta Platform Terms and the Meta Developer Policies.

5.1 What We Access

We request the following Facebook Login permissions:

• public_profile — to identify your Facebook account
• email — to verify your identity
• pages_show_list — to list your Facebook Pages for ad creation
• pages_manage_ads — to create ads on behalf of your Facebook Pages
• ads_management — to create and manage advertising campaigns
• ads_read — to retrieve campaign performance metrics
• business_management — to access your business and ad accounts
• instagram_basic — to link your Instagram Business Account for Instagram ads

5.2 How We Store Meta Data

• OAuth access tokens are encrypted using AES-256 encryption before storage in our SQL Server database. The encryption key is stored separately in application configuration.
• Campaign data created through markXpand (campaigns, ad sets, ads) is stored in our database to track launch status.
• Performance metrics are fetched on-demand from the Meta Marketing API and are not permanently cached.
• Facebook Page and Ad Account IDs are stored to enable campaign management.

5.3 How We Share Meta Data

We do not share your Meta data with any third parties except:

• Meta — when making API calls on your behalf to create and manage your advertising campaigns.
• Google Gemini AI — when you use our AI features, anonymized campaign context (not personal data or account identifiers) may be sent to generate ad content suggestions.
• Legal requirements — if required by law, regulation, or valid legal process.

5.4 Prohibited Uses

We will never:

• Sell, license, or transfer Meta user data to third parties, data brokers, or information resellers.
• Use Meta user data for purposes unrelated to providing our advertising management services.
• Use Meta user data for surveillance, profiling, or discriminatory purposes.
• Store Meta user data longer than necessary to provide our services.

6. LinkedIn Data — Specific Disclosures

markXpand's use of information received from the LinkedIn Marketing API adheres to the LinkedIn API Terms of Use and the LinkedIn Marketing API Terms.

6.1 What We Access

We request the following LinkedIn OAuth scopes:

• openid — OpenID Connect authentication identifier
• profile — to display your name on your markXpand dashboard
• email — to identify your account
• rw_ads — to create and manage LinkedIn ad campaigns, creatives, and ads
• r_ads — to read your ad account structure and settings
• r_ads_reporting — to retrieve campaign performance metrics for reporting

6.2 How We Store LinkedIn Data

• OAuth access tokens are encrypted using AES-256 encryption before storage in our SQL Server database. The encryption key is stored separately in application configuration.
• Campaign data created through markXpand (campaign groups, campaigns, creatives) is stored in our database to track launch status.
• Performance metrics are fetched on-demand from the LinkedIn Marketing API and are not permanently cached beyond temporary display caching.
• LinkedIn Ad Account IDs are stored to enable campaign management.

6.3 How We Share LinkedIn Data

We do not share your LinkedIn data with any third parties except:

• LinkedIn — when making API calls on your behalf to create and manage your advertising campaigns.
• Google Gemini AI — when you use our AI features, anonymized campaign context (not personal data or account identifiers) may be sent to generate ad content suggestions.
• Legal requirements — if required by law, regulation, or valid legal process.

6.4 Prohibited Uses

We will never:

• Sell, license, or transfer LinkedIn user data to third parties, data brokers, or information resellers.
• Use LinkedIn user data for purposes unrelated to providing our advertising management services.
• Use LinkedIn user data to develop, train, or improve any generalized or non-personalized artificial intelligence or machine learning model.
• Use LinkedIn user data for surveillance, profiling, or discriminatory purposes.
• Store LinkedIn user data longer than necessary to provide our services.

7. TikTok Data — Specific Disclosures

markXpand's use of information received from the TikTok Marketing API adheres to the TikTok for Business Developer Terms of Service and the TikTok Privacy Policy.

7.1 What We Access

We request the following TikTok Marketing API scope categories (granted at the app level by TikTok):

• Ad Account Management — to list and manage your authorized advertiser accounts
• Ads Management — to create and manage campaigns, ad groups, and ads
• Audience Management — to create and manage custom audiences (with your data only)
• Reporting — to retrieve campaign performance metrics for in-app reporting
• Creative Management — to upload images and videos used in your ads
• Pixel Management — to manage TikTok Pixel conversion tracking
• Lead Management — to retrieve leads from TikTok Lead Generation forms
• Custom Conversion Management — to manage custom conversion events for your campaigns

7.2 How We Store TikTok Data

• OAuth access and refresh tokens are encrypted using AES-256 encryption before storage in our Microsoft Azure SQL database. The encryption key is stored separately in application configuration.
• Campaign data created through markXpand (campaigns, ad groups, ads, creatives) is stored to track launch status and enable reporting.
• Performance metrics are fetched on-demand from the TikTok Marketing API and are not permanently cached beyond temporary display caching.
• TikTok advertiser IDs and Business Center IDs are stored to enable campaign management.

7.3 How We Share TikTok Data

We do not share your TikTok data with any third parties except:

• TikTok — when making API calls on your behalf to create and manage your advertising campaigns.
• Google Gemini AI / OpenAI — when you use our AI features, anonymized campaign context (not personal data or account identifiers) may be sent to generate ad content suggestions.
• Legal requirements — if required by law, regulation, or valid legal process.

7.4 Prohibited Uses

We will never:

• Sell, license, or transfer TikTok user data to third parties, data brokers, or information resellers.
• Use TikTok user data for purposes unrelated to providing our advertising management services.
• Use TikTok user data to develop, train, or improve any generalized or non-personalized artificial intelligence or machine learning model.
• Use TikTok user data for surveillance, profiling, or discriminatory purposes.
• Store TikTok user data longer than necessary to provide our services.

8. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption in transit: All communications are encrypted using HTTPS/TLS.
• Encryption at rest: OAuth refresh tokens are encrypted using AES-256 before database storage.
• Authentication: ASP.NET Core Identity with hashed passwords (PBKDF2), session management, and optional two-factor email verification (OTP).
• Access control: Role-based access control with organization-level data isolation.
• Infrastructure: Application hosted on secured servers with restricted access.

9. Data Retention

• Account data is retained for as long as your account is active.
• OAuth tokens (Google, Meta, LinkedIn, TikTok, and other connected platforms) are retained until you disconnect the platform or delete your account.
• Campaign data created through markXpand is retained for the lifetime of your account.
• Website and brand scan data (your brand profile, including extracted brand assets and publicly listed business contact details) is retained for the lifetime of your account and is deleted upon account deletion as described in Section 10.3.
• Google Ads, Meta, LinkedIn, and TikTok reporting data is fetched on-demand and not permanently stored beyond temporary display caching.
• Billing records and tax invoices are retained for five (5) years after the relevant transaction, as required by Article 26 of the UAE Commercial Companies Law (Federal Decree-Law No. 32 of 2021), even after account deletion.
• Server logs are retained for up to 90 days for security and debugging purposes.
• Fraud-prevention and security incident logs may be retained for up to two (2) years to investigate and prevent abuse.

10. Your Rights and Data Controls

You have the following rights regarding your data:

10.1 Access and Export

You may request a copy of the personal data we hold about you by contacting info@markxpand.com.

10.2 Revoke Platform Access

You can disconnect any connected platform at any time from the Settings page within markXpand. This will:

• Delete the stored OAuth tokens for that platform
• Stop all API access to that platform's data

You can also revoke markXpand's access directly from:

• Google: Google Account Permissions
• Facebook/Meta: Facebook Business Integrations Settings
• LinkedIn: LinkedIn Permitted Services
• TikTok: TikTok Business Authorizations (or via your TikTok Ads Manager account)

10.3 Account & Data Deletion

You may request complete deletion of your account and all associated data by contacting info@markxpand.com. Upon receiving your request, we will permanently delete the following within thirty (30) days:

• Your account, profile, and login credentials
• All stored OAuth tokens (Google, Meta, LinkedIn, TikTok, and all other connected platforms) and refresh tokens
• All campaigns, ad creatives, images, videos, and AI-generated content created through markXpand
• All performance data, analytics, and reports stored on markXpand
• Connected Ad Account IDs, Facebook Page IDs, Instagram Business Account IDs, LinkedIn Ad Account IDs, TikTok Advertiser IDs, TikTok Pixel IDs, Google Merchant Center IDs, and other platform metadata
• Organization membership and team associations
• Customer brand assets (uploaded logos and identifiers)

This action cannot be undone. The following limited categories of data are retained beyond account deletion only as required by law or for legitimate fraud prevention:

• Billing records and tax invoices — retained for five (5) years per Article 26 of the UAE Commercial Companies Law
• Security and fraud-prevention logs — retained for up to two (2) years
• Data subject to a valid legal hold, court order, or regulatory request

10.4 Opt-Out of Personalized Advertising

markXpand does not use your data for personalized advertising. However, if you wish to manage ad personalization from Google, you may visit Google Ads Settings.

11. Cookies and Tracking

markXpand uses the following cookies:

• Authentication cookies — essential cookies to maintain your login session. These are strictly necessary and cannot be disabled.
• Anti-forgery cookies — used to protect against cross-site request forgery (CSRF) attacks.

We do not use third-party tracking cookies, advertising cookies, or analytics cookies. We do not use Google Analytics on markXpand.

12. Third-Party Services

markXpand integrates with the following third-party services, each governed by their own privacy policies:

• Google Ads API — Google Privacy Policy
• Google Gemini AI — used for AI-powered content generation
• OpenAI — used for AI-powered text generation and campaign optimization advisory
• SendGrid — used for transactional emails (OTP verification, notifications)
• Twilio — used for WhatsApp Business messaging features
• Meta/Facebook Ads API — Meta Privacy Policy
• LinkedIn Marketing API — LinkedIn Privacy Policy
• TikTok Marketing API — TikTok Privacy Policy
• Microsoft Azure — cloud hosting and database infrastructure

13. International Data Transfers

markXpand is operated from the United Arab Emirates. If you access our services from the European Union or other regions with data protection laws, please note that your data may be transferred to and processed in the UAE. By using markXpand, you consent to such transfer. We ensure that appropriate safeguards are in place to protect your data in accordance with applicable data protection laws.

14. Children's Privacy

markXpand is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected data from a child, we will delete it promptly.

15. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a notice on our website prior to the change becoming effective. Continued use of markXpand after changes constitutes your acceptance of the updated policy.

16. Contact Us

If you have any questions about this Privacy Policy, your data, or wish to exercise your rights, please contact us:

• Email: info@markxpand.com
• General inquiries: info@markxpand.com
• Phone: +971 563348487
• Address: Nextoria Information Technology LLC, Dubai, United Arab Emirates