Privacy Policy

1. Who we are

MarketWar OS (marketwaros.com) is the data controller for account and marketing data, and a data processor for the customer data you upload and process through the platform. Contact our privacy team via the contact page.

2. Data we collect

• Account data: name, email, organisation, authentication identifiers.
• Billing data: plan, ACU ledger, payment metadata (card details are held by our payment processor, not us).
• Usage data: features used, AI jobs, request/idempotency ids, audit logs, device/IP for security and rate limiting.
• Customer data you upload: contacts, campaigns, assets, website/product inputs — processed on your behalf.
• Email delivery events: when a message you send is opened or a link in it is clicked, plus the requesting user agent — recorded per recipient so the platform can report your campaign results and stop sending to addresses that bounce or complain.

How email tracking works, stated plainly. Campaigns sent through the platform carry a 1×1 image that records an open, and every link is rewritten through a redirector that records a click before forwarding to the original address. Both are keyed to the individual recipient, and the user agent is stored so that automated security scanners can be told apart from people. Where you send to your own contacts you are the controller for that tracking and are responsible for disclosing it in your own privacy notice; we are your processor. The same mechanism is used on the marketing email we send you, under the consent or opt-out described above. Every message carries a one-click unsubscribe, and bounces, complaints and unsubscribes are added to a suppression ledger that is never re-sent to.

3. Lawful bases

We process account and billing data to perform our contract with you; usage/security data under legitimate interests; and marketing communications under consent or legitimate interests, with an easy opt-out. Where you use the platform to market to your own contacts, you are the controller and are responsible for your lawful basis (consent or a completed Legitimate Interest Assessment) — the platform records lawful-basis status per contact and enforces suppression and frequency caps.

4. How we use data

To provide and secure the Service, meter ACUs and bill you, prevent fraud and abuse, provide support, improve the product, and communicate with you. AI actions route through our gateway; provider cost is used internally only and never exposed to you or your customers.

5. Sharing

We share data with sub-processors strictly to run the Service: cloud hosting (Vercel), backend and storage (Firebase / Google Cloud, EU region where configured), payment processing (Stripe), and AI providers (OpenAI, Anthropic, Google) for the specific request you initiate. We do not sell personal data. Restricted-category workloads may be limited to specific providers or regions.

6. International transfers

Where data is processed outside the UK/EU, we rely on appropriate safeguards (adequacy decisions or standard contractual clauses). Our Realtime Database and, where configured, Firestore/Storage are hosted in an EU region.

7. Retention

We keep personal data only as long as needed for the purposes above and to meet legal obligations. On account closure, data is retained for a defined period then deleted or anonymised. Financial/audit records are kept as required by law.

8. Security

Field-level AES-256 encryption per business, tenant isolation, App Check, least-privilege secrets in managed storage, append-only financial ledgers, and client rules that block direct manipulation of balances or audit data.

9. Your rights

Subject to law, you may access, correct, delete, restrict, port or object to processing of your personal data, and withdraw consent at any time. To exercise these rights, contact us. You may also complain to your supervisory authority (in the UK, the ICO).

10. Cookies

Essential cookies — authentication and security — are always on. They are what makes staying signed in possible, so there is no version of the product that works without them, and we do not ask for consent we would not honour a refusal of.

Analytics cookies are set only if you accept them. We use Google Tag Manager to understand which pages help and which do not. Nothing analytical loads until you choose: not on page load, not while the banner is open, and not if you ignore the banner and carry on reading. No choice means no analytics. Rejecting is a single click, in a button the same size and prominence as the one that accepts, and rejecting changes nothing about how the product behaves for you.

You can change your cookie choice at any time. See also the Cookie Policy in All policies.

11. Changes

We will post updates here and, for material changes, notify you. Continued use after an update means you accept it.