Privacy Policy

Effective May 28, 2026. GDPR-compliant. Terms. DPA.

1. Who we are (Controller)

Valued BV / Markomatic is the data controller. We're a Belgian limited liability company. For privacy questions, contact our Data Protection Officer at kasper@valued.be.

2. What we collect

• Account data — email + name from Clerk (you give this on sign-up).
• Workspace content — prompts, conversations, brand context, inventory items, artifacts. Everything you produce in the app.
• Usage metering — per-session token counts + cost cents for billing + capacity planning.
• Diagnostic logs — error traces (workspace ID tagged, no PII). Sentry, when configured.
• Browser telemetry — IP + user-agent, transient, for security + abuse detection. Not used for advertising. No third-party tracking pixels.

What we don't collect:we have no advertising trackers, no Facebook pixel, no Google Analytics (currently). If we ever add analytics we'll update this page and offer a cookie banner.

3. Why we process it (Legal basis)

• Performance of contract (Art. 6(1)(b) GDPR) — to run the service you signed up for.
• Legitimate interest (Art. 6(1)(f)) — security monitoring, debugging, fraud prevention.
• Legal obligation (Art. 6(1)(c)) — VAT records, tax compliance.
• Consent (Art. 6(1)(a)) — marketing emails (opt-in only; unsubscribe in footer of every email).

4. Sub-processors

We use these processors. Each has its own Data Processing Agreement with us.

US transfers rely on EU-approved Standard Contractual Clauses (SCCs) and, where applicable, the EU-US Data Privacy Framework.

5. Retention

• Workspace data is kept as long as your account is active.
• On account deletion we remove production data within 30 days; backups age out within 90 days.
• VAT records are kept 7 years (Belgian legal requirement).
• Sentry error events retain for 30 days unless explicitly extended.

6. Your rights (GDPR Art. 15-22)

You have the right to:

• Access — request a copy of your data.
• Rectification — correct inaccurate data.
• Erasure — “right to be forgotten”.
• Portability — receive your data in a machine-readable format.
• Restriction — limit how we process your data.
• Objection — object to legitimate-interest processing.
• Withdraw consent — for any consent-based processing.
• Lodge a complaint — with the Belgian Data Protection Authority (dataprotectionauthority.be).

To exercise any of these, email kasper@valued.be. We respond within 30 days.

7. Security

TLS in transit. Encryption at rest (Supabase + S3 layers). Auth via Clerk OIDC. Row-level security on every multi-tenant table. Service-role secrets stored as env vars, never in code or git history. Sub-processors are SOC 2 Type II or equivalent.

Brogilvy is not yet SOC 2 certified. If you need a formal certificate, contact us — we can share our security questionnaire response.

8. Cookies

We use one essential cookie type: auth session cookies, set by Clerk. We don't use analytics, advertising, or third-party tracking cookies. No banner needed under the ePrivacy Directive.

9. Children

Brogilvy is not directed to people under 16. If you become aware that we have inadvertently collected data from a minor, tell us and we'll delete it.

10. Changes to this policy

Material changes will be announced via email at least 30 days in advance. The current version is always at this URL.

Last updated May 28, 2026. Privacy questions go to kasper@valued.be.