localmkr Privacy Policy

1. Who is responsible

localmkr is a service of SAASCODE, LLC, an LLC formed in the State of Delaware, USA, with its address at 131 Continental Dr, Suite 305, Newark, DE 19713, USA ("localmkr", "we", "us").

• Email for privacy matters: [email protected]
• Data protection officer channel for Brazil (LGPD): [email protected]

2. Who this applies to

To everyone whose data passes through localmkr:

• businesses with their own account, makers, maker clients and their team, and partners;
• visitors to localmkr.com and the app, with or without an account, and to the pages published with localmkr;
• end customers of a business: the people who buy from it, book with it, write to it or leave it a review. The business processes their data; we do so on its behalf (§5);
• businesses that a maker finds with the search, and the people who may appear in their public data.

3. Two roles: controller and processor

• We are the controller of the data of accounts, partners, visitors to localmkr.com, billing, the guard and telemetry: we decide what it is used for and how.
• We are a processor of the data a business keeps in its system about its end customers, and of the data a maker keeps about its clients and prospects: we process it on their behalf and following their instructions (§5).

4. What data we process and why

4.1. Your account

• What: your email, your name, your sign-up date and your last sign-in, your plan and your language. The sign-in code and your session are stored only as an encrypted summary (a hash), never as they are. When you ask for a code we use your IP for a few minutes, in memory and without storing it, to stop mass attempts.
• Why: to create your account, let you sign in and tell you what matters (the code, billing, changes to these documents).
• Basis: the contract.

4.2. Your business and your page

• What: your business's name, trade, city, address, phone, hours, prices, products, photos, logo, colors and texts, and whatever you paste or import (your website, or your public Instagram or Facebook).
• Why: to build, edit and publish your page, and to build your system. With the business's location we show the day's weather on your home screen.
• Basis: the contract.

4.3. Your conversations with mkr

• What: your messages, what mkr answered and what it did (with its receipts), a short summary of what you talked about before (the business's memory), a daily journal so mkr can find what you already discussed, and the cost of each call to an AI model.
• Why: so mkr understands, remembers and works; to measure what serving you costs; to protect the service.
• Who else receives it: the AI models (through OpenRouter) and the guard (Typesafe) receive the message and the context they need to answer or to classify it (§7).
• "Forget": when you ask mkr to forget, its memory of that business starts from scratch from that moment. The stored conversation stays in your account until you ask for it to be deleted or you close the account.
• Basis: the contract and our legitimate interest in the security of the service.

4.4. Your business's system and your end customers

• What: orders, appointments and bookings, events, contacts, reviews and manual payments, with their status and history; what your end customers write on your page (name, contact, message) and their chats with your page's assistant. mkr and AI may read and sort incoming contacts (for example, whether they ask for a price or a booking). When something arrives from your published page, we keep an encrypted summary of the sender's IP, only to stop mass submissions; it is never shown.
• Role: processor, on the business's behalf (§5).

4.5. If you are a maker

• What: your maker account's details that go in your messages (the name you work under, your name, your email, your phone, your country and your website); your clients and the people of each client you invite; your prospects, proposals, invoices to your clients, diagnoses, drafts and reports; and whether a proposal or a report was opened, without recording who opened it.
• Why: so you can serve your clients and your prospects with localmkr.
• Basis: the contract. For your clients' and prospects' data we are a processor on your behalf (§3).

4.6. Business search

• What: public business data: name, trade, address, phone, website, social networks, the rating and number of reviews on its Google Maps listing and the date of the most recent ones (without the text or the authors of the reviews), whether it advertises on Meta, whether its Instagram is active and how old its website is.
• Where from: Google Maps, Meta's ad library and its public Instagram (through Apify), its own website and public web archives (Internet Archive).
• Why: so a maker can find businesses to offer its services to, with a reason to write to them. The search is built to keep the business's contact details, not the personal data of the people who work there.
• Basis: the maker's legitimate interest in offering its services to businesses, using data the business itself made public. A business can ask us to remove it from a maker's account (§11).

4.7. Billing

• What: your plan, the amounts, the currency, the method (card through Stripe, or PayPal), the status, the periods, the order and subscription identifiers, and the receipts. Your card or PayPal account details are processed by Stripe or PayPal: localmkr does not see or store them.
• Why: to charge, renew, cancel, refund and keep the books.
• Basis: the contract and our legal obligations.

4.8. Partners

• What: your link and your code, the accounts you invited and your commissions. To pay you, your payout details (for example, your PayPal account) and the tax details U.S. law requires (such as Form W-8BEN or W-9).
• Why: to attribute the makers you invite, calculate and pay your commissions, and comply with the law.
• Basis: the contract and our legal obligations.

4.9. The AI studio and AI photos

• What: the photos and texts you use as a starting point and what is generated (images and videos).
• Who else receives it: fal or Higgsfield, which do the generation (§7).
• Why: to generate the pieces you ask for. If you use a photo of a person, you must have their permission.
• Basis: the contract.

4.10. Security and the guard

Always. Before mkr answers, the guard classifies each message: about the business, unrelated, abuse or trolling. When a message counts as a strike, we keep the decision, the date, the screen and an excerpt of the message of up to 160 characters. Strikes count for 7 days.

The device mark.

• What is kept:
  • the random id of your browser's hx_anon cookie;
  • a random id your browser keeps in its local storage (lm_dev, which travels as the hx_dev cookie); it stays there even if you clear your cookies;
  • a summary (hash) of what your browser is like and how it draws: the browser, the system, the languages, the time zone, the screen, the processor and how it draws text and 3D. It is computed in your browser, and only the summary travels;
  • an encrypted summary of your IP address, made with a secret key. The IP is never stored as it is.
• When: with each message the guard flags (something unrelated to the business, or a strike). Those identifiers exist in every browser that opens the app (§9), but localmkr keeps them only at that moment.
• Why: only so that a closed account does not come back with another account or another page. The browser fingerprint counts only together with the same network, because phones of the same model give the same fingerprint.
• For how long: 12 months, in the guard's decision log. If the account was closed, the block lasts as long as the closure.
• How to ask for a review: with «Escribir a soporte» ("Write to support") on the closure screen. A person on the team reviews it and, if it was a mistake, reverses the closure and the mark stops being used.
• Basis: our legitimate interest in the security of the service and in preventing abuse.

Automated decisions. The guard decides on its own. You have the right to ask for a person to review it, to give your point of view and to contest the decision, with «Escribir a soporte» or by writing to the privacy email (§1).

4.11. Telemetry

• What: events with the account id and the page id, never with emails, IPs or texts: visits to the home page and to /makers (with the campaign they come from, if any), sign-ups, the first time a business publishes its page, builds its system and makes its first operation, a maker's first proposal opened by a prospect, payments and renewals, and what each use of AI costs. The first-touch campaign is kept for 30 days in the lm_utm cookie and, when the account is created, is attached to it.
• On published pages: we count, per day, the visits and the taps on WhatsApp, call and the form, with no personal data.
• Why: to know which campaigns bring businesses that actually use localmkr, to show each business its numbers and to measure how much it costs to serve each customer.
• Basis: our legitimate interest in measuring and improving the service.

4.12. Support and email

• What: what you write to us and our answers, including requests from the closure screen.
• Email: we send you the emails the service needs (the sign-in code, billing, important notices).
• Basis: the contract.

4.13. Integrations you connect

WhatsApp Business, Instagram, Messenger and Google Business Profile work only if you connect your own account. If you connect it:

• what: with WhatsApp, Instagram or Messenger, your customers' messages, their numbers or usernames and your templates; with Google Business Profile, your profile's details, your reviews and your replies, your posts and your metrics;
• why: only to provide that feature: showing messages and reviews in your inbox, sending the replies and posts you write or approve, and adding the metrics to your report;
• what we do not do: we do not sell that data, we do not use it for advertising or to train AI models, and we do not access accounts you did not connect;
• on disconnecting: we stop receiving data and delete what we kept from that integration within 30 days.

Data from Google APIs is used in accordance with the Google API Services User Data Policy, including its Limited Use requirements. Data from Meta is used in accordance with Meta's platform terms.

5. Your business's customers' data (for businesses and makers)

This section serves as the data processing agreement between the business (or the maker that serves it) and localmkr.

• The business is the controller. If a maker serves it, the maker acts on the business's behalf, and localmkr on behalf of both.
• What we use it for: only to provide the service and following your instructions (what you do in the app and what you ask mkr). We do not use it for our own purposes, we do not sell it and we do not use it for advertising.
• Who has access: only authorized people at localmkr, when needed (support you asked for, security or a legal obligation), under a duty of confidentiality.
• Providers: those in §7. If we add one, we update this policy.
• Security: as in §13.
• Incidents: if a security incident affects that data, we tell you without undue delay, within 72 hours of learning of it, so you can meet your obligations.
• Your end customers' requests: if an end customer writes to us, we pass their request on to the business. We help you comply with what the app allows: finding, correcting and deleting their records.
• Deletion: when you delete a record in the app, it is marked as deleted so you can undo it. If you need it fully deleted (for example, because your end customer asked), write to us and we delete it within 30 days. When you close your account, we delete that data as §10 says.
• Your notice: you must tell your end customers how you process their data and that you use localmkr to do so.

6. What we do not do

• We do not sell personal data or share it for cross-context advertising.
• We do not use third-party advertising cookies or pixels.
• We do not use your data or your customers' data to train our own AI models. Model providers receive it only to answer and, under their terms for API use, do not use it to train their models.
• We do not send messages to your customers or your prospects on your behalf unless you turn that on.

Besides the providers in §7, which act on our behalf, we share data only when the law requires it, to defend our rights or those of other people, or if the company changes hands (in that case, under this same policy).

7. Providers that process data for us

Stripe and PayPal also process some data as controllers, under their own policies (for example, to prevent fraud).

8. Where the data is and international transfers

• The app's data (your business, your page, your system and your conversations with mkr) is stored on servers operated by SAASCODE, LLC in Uruguay. Accounts and published pages, with what arrives through them, are stored on Cloudflare, in the United States and on its global network. The providers in §7 process what they receive mainly in the United States.
• If you live in another country, your data is transferred out of it. We do so to provide the service you signed up for, and with the safeguards each provider offers, such as the European Commission's standard contractual clauses or the EU-U.S. Data Privacy Framework, where they apply.

9. Cookies and browser storage

• We do not use advertising cookies or third-party cookies.
• localmkr.com and the app load fonts from Google Fonts and animation libraries from cdnjs (Cloudflare) and jsDelivr: your browser connects to those services and sends them its IP, as with any website. Published pages serve their fonts from our own servers.
• Published pages do not use cookies. They keep the visitor's cart, bookings and chat with the page's assistant in their browser, so they are not lost when they come back.
• The guard's cookies (hx_anon, hx_dev, hx_fp) are created in every browser that opens the app and travel with each request, but localmkr keeps them only with a message the guard flags (§4.10).
• You can delete cookies from your browser. If you delete hx_session, your session closes.

10. How long we keep data

• Your account, page, system and conversations with mkr: as long as your account exists.
• When you close your account: we delete them within 30 days, except what the law requires us to keep.
• Pages built without an account that nobody claimed: 90 days from the last time they were opened.
• Billing and receipts: 7 years, for the company's tax and accounting obligations.
• Guard: the device mark, while the closure lasts; the decision log, 12 months.
• Telemetry: 24 months.
• A maker's prospects: as long as the maker keeps them in its account.

11. Your rights and how to exercise them

Depending on your country's law (§12), you can:

• find out whether we process your data and ask for a copy (access), including in a format you can take to another service (portability);
• correct or complete it (rectification);
• ask us to delete it (erasure);
• object to a use or ask us to restrict it;
• withdraw your consent, where a use is based on it;
• ask for a person to review an automated decision, such as a closure by the guard;
• complain to the data protection authority of your country.

How: write to [email protected] from your account's email, so we know it is you. We answer within 30 days, or within the shorter period your country's law sets. It is free.

If you are an end customer of a business, write to the business, which is the controller of your data. If you write to us, we pass your request on to it.

If you are a business that appears in a maker's search, write to us to have it removed from that account.

How to delete your data

1. If you have a paid plan, cancel it on the Plan screen.
2. Write to [email protected] from your account's email, with the subject "Delete my account".
3. We confirm the request, take your pages offline and delete your data within the period in §10. We tell you when it is done.
4. To delete only what mkr remembers, use "Forget"; to delete your conversations, ask us by email.

12. By country

Uruguay

Law 18,331 on Personal Data Protection and its regulations apply. You have the rights of access, rectification, updating, inclusion and erasure. The authority is the Unidad Reguladora y de Control de Datos Personales (URCDP).

Argentina

Law 25,326 on Personal Data Protection applies. The data subject has the right to access their personal data free of charge at intervals of no less than six months, unless a legitimate interest is shown, under article 14, paragraph 3, of Law 25,326. The Agencia de Acceso a la Información Pública, as the supervisory body of Law 25,326, has the authority to handle complaints and claims filed by anyone whose rights are affected by a breach of the rules in force on personal data protection.

Mexico

The Federal Law on the Protection of Personal Data Held by Private Parties applies. This policy is our privacy notice. You have the rights of access, rectification, cancellation and objection (ARCO rights), and you can revoke your consent or limit the use of your data by writing to the email in §1. We do not transfer your data to third parties for their own purposes, except in the cases in §6. You may go to Mexico's personal data protection authority.

Brazil

The General Data Protection Law (LGPD, Law 13,709/2018) applies. You have the right to confirm whether we process your data, to access it, correct it, ask for its anonymization, blocking or deletion when it is unnecessary, to portability, to know who we share it with, to revoke your consent and to ask for a review of automated decisions. The authority is the National Data Protection Authority (ANPD). The data protection officer is in §1.

Spain and the European Union

The General Data Protection Regulation (GDPR) and Organic Law 3/2018 apply. The legal basis for each use is in §4: the contract, our legal obligations and our legitimate interest (security, preventing abuse and measuring the service), to which you can object. You have the rights in §11 and can complain to the Spanish Data Protection Agency (AEPD) or the authority of your country. For any privacy matter from the EU, write to [email protected].

United States

If the California privacy law (the CCPA, as amended by the CPRA) or another state law applies to localmkr:

• What data we process: identifiers (email, name, account and device ids), commercial information (plans and payments), internet activity (use of the app and the pages), the business's approximate location and what you write to us. The sources and purposes are in §4.
• Sale and sharing: we do not sell personal data or share it for cross-context advertising, and we have not done so in the last 12 months.
• Sensitive data: we do not use it to infer characteristics about you.
• Your rights: to know, delete and correct your data, and not to be treated differently for exercising them. You or an authorized agent can ask, through the email in §1; before answering we verify your identity.

13. Security

• You sign in with a one-time code sent by email: there are no passwords to steal. The code expires, and after 5 failed attempts it stops working.
• Of the code and your session we keep only their encrypted summary.
• Connections are encrypted (HTTPS), through Cloudflare.
• IPs are kept only as an encrypted summary (in the forms on pages and in the guard).
• Payment details are processed by Stripe and PayPal.
• Inside localmkr, only the people who need the data have access to it.

No system is infallible. If an incident affects your data, we will tell you as the law requires.

14. Minors

localmkr is for people over 18 who use it for a business. We do not knowingly collect data from children under 13, or under the age your country's law sets; if we learn that we did, we delete it. The data of end customers who are minors is processed by the business, which is responsible for it.

15. Changes to this policy

We may change this policy. If the change is significant, we will tell you by email or in the app at least 30 days before it takes effect. The version date is at the top.

16. Contact

• Privacy: [email protected]
• Support: [email protected]
• Address: SAASCODE, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, USA