Privacy policy

1. Who we are

MakD.in (“we”, “us”) is a marketing automation service operated by MakD.in, India. It is available at https://makd.in. We are the data controller for the account and billing information described below. For the content, customer contacts and leads that your business uploads or collects through the service, your business is the controller and we process that data on its behalf.

Questions about this policy: privacy@makd.in.

2. What we collect

Account data

• Name, email address and password hash when you create an account.
• If you sign in with Google: your Google account identifier, name, email and profile picture.
• Organisation details: business name, category, website, address, phone, logo, brand colours and products.
• Billing details: plan, invoices, payment status. Card numbers are handled by our payment processor and never stored on our servers.

Connected social media accounts

When you connect Facebook, Instagram, WhatsApp Business, LinkedIn, X or a Google Business Profile we receive, with your permission, the information needed to publish on your behalf and report results:

• The identifier, name, handle and profile picture of each page or account you select.
• The identifier of the user who authorised the connection (for example your Facebook user ID), so that we can honour deletion and deauthorisation requests.
• Access tokens, which are encrypted at rest and used only to publish your content, read performance metrics for posts we published, and receive messages to your WhatsApp Business number.
• Post and account metrics (reach, likes, comments, followers) for reporting.

We do not read your personal timeline, friends list or private messages other than WhatsApp messages sent to the business number you connected.

Content and customer data you add

• Briefs, captions, images and campaigns you create or that our AI generates for you.
• Leads and contacts you import or capture through forms, landing pages, WhatsApp or QR codes, including their name, phone number, email and messages.
• Email and SMS campaign content and delivery results.

Technical data

• IP address, browser and device information, pages visited and actions taken, kept in security and audit logs.
• Cookies used to keep you signed in and to remember preferences (see section 8).

3. How we use it

• To provide the service: generate creatives and captions, schedule and publish posts, run campaigns, manage leads and show analytics.
• To send transactional messages such as approval requests, publishing failures, invoices and security alerts.
• To bill you and prevent fraud and abuse.
• To comply with legal obligations and enforce our terms.

We do not sell personal data and we do not use your content, your customers’ data or data obtained from social platforms for advertising or to train AI models.

4. AI providers

Text and images are generated by third-party AI models (for example OpenAI, Anthropic, Google, Stability AI, OpenRouter or Pixazo, depending on the platform configuration). To do this we send them the brief, your brand profile (name, tagline, colours, products) and any text you ask us to rewrite. We do not send access tokens, passwords or your customers’ contact details to AI providers. Providers process this data under their own API terms, which prohibit training on API inputs by default.

5. Who we share data with

6. Google user data

Our use of information received from Google APIs (Google sign-in and Google Business Profile) adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google data is used only to sign you in and to publish posts to the Business Profile you connect. The scopes we request, what each one is used for and how to revoke access are listed on the Google user data disclosure page.

Our use of the LinkedIn and X APIs is described on the LinkedIn API disclosure and X API disclosure pages.

7. Retention and deletion

• Account and organisation data is kept while your account is active.
• When you delete content, media, leads or an organisation, it is soft-deleted and permanently removed after 30 days. Media files are erased from storage at the same time.
• Disconnecting a social account deletes its access tokens immediately and cancels queued posts.
• Audit and security logs are kept for up to 12 months.
• Invoices are kept for as long as tax law requires.

You can delete connected accounts, individual data or your whole organisation from inside the app, or ask us to do it. Step-by-step instructions, including the Facebook data deletion callback, are on the data deletion page.

8. Cookies

We use strictly necessary cookies only: an encrypted session cookie and a refresh cookie to keep you signed in, and a small marker that tells the app you are logged in. We do not use advertising or cross-site tracking cookies. Public landing pages you publish do not set cookies for visitors.

9. Security

Data is transmitted over HTTPS. Access tokens and integration secrets are encrypted at rest. Passwords are hashed. Access to tenant data is isolated per organisation and every sensitive action is written to an audit log. Rate limiting and account lock-out protect sign-in.

10. Your rights

Depending on where you live you may have the right to access, correct, export, restrict or delete your personal data, and to object to certain processing. Most of this can be done in the app; for anything else email privacy@makd.in. We answer within 30 days. Residents of India may also exercise their rights under the Digital Personal Data Protection Act, 2023.

11. Children

The service is for businesses and is not directed at anyone under 18.

12. International transfers

Our servers are hosted in India. Social platforms, AI providers and payment processors may process data in other countries under their own safeguards.

13. Changes

We will post any changes on this page and, for material changes, notify account owners by email before they take effect.