MakoThis Privacy Policy explains how Mako ("Mako", "we", "us"), a service of Magnus Brand B.V. in the Netherlands, collects, uses, shares, and protects information when you use our website (trymako.ai, app.trymako.ai, and mako-ads.com), our creative and ad-publishing software, and the ads we run for our customers (together, the "Service"). By using the Service you agree to this policy.
1. Who we are
Mako is creative software for e-commerce and marketing teams, operated by Magnus Brand B.V., Kerkstraat 4, 4901 JG Oosterhout, the Netherlands (Dutch Chamber of Commerce no. 83598022). It helps you research audiences, generate ad creative, publish that creative to advertising and social media accounts you connect, and — if you choose — have Mako run the ads for you. Mako is the data controller for the account information you provide to us, and a data processor when we act on your instructions (for example when we publish to accounts you connect, or collect leads for a campaign we run for you). You can reach us at [email protected].
Mako's Meta app is registered through the verified business portfolio of our partner Strange Fruits B.V. Magnus Brand B.V. is responsible for the data described in this policy.
2. Information we collect
Information you provide
- Account details — name, email address, password (hashed), and organisation/workspace information.
- Billing details — handled by our payment processor (Stripe); we do not store full card numbers.
- Content you create — products, product URLs, images, copy, prompts, messages to the Ask Mako assistant, and the ad creatives you generate in the Service.
- Campaign settings — for ads you launch or ask Mako to run: objective, audience location, budget, schedule, destination URL, call to action, and the creatives used.
Information from accounts you connect
- Access tokens for the social and advertising accounts you connect (e.g. Meta/Facebook, Instagram, TikTok, Google Ads, YouTube). We store a token for each connected account, encrypted — we never receive or store your platform password.
- Account profile data — the account name, ID, username, and profile picture of the connected account, and the names and IDs of the Pages, Instagram accounts, business portfolios, and ad accounts you can choose from.
- Ad performance data — results of the campaigns you run through Mako, such as impressions, reach, clicks, spend, and conversions.
Information collected automatically
- Usage and device data — log data, IP address, browser type, and product analytics used to operate and improve the Service.
- Session recordings — for paying accounts, we record how the app is used (clicks, page views) to find and fix problems. Text typed into input fields is masked and not recorded.
- Cookies and similar technologies — used for sign-in sessions, product analytics (PostHog, Google Analytics), and measuring our own marketing (Meta Pixel). You can control cookies through your browser settings.
3. How we use information
- To provide, maintain, and secure the Service and your account.
- To generate the ad creatives you request, using the product information, images, and prompts you provide.
- To publish or schedule the creatives you ask us to post to the accounts you have connected, on your behalf.
- To create, run, pause, and report on the ad campaigns you launch — in your own ad account or in Mako's — and to suggest improvements based on their results.
- To answer your questions in the Ask Mako assistant, using the workspace and campaign data needed for the answer.
- To process payments and manage subscriptions.
- To provide support and send service-related communications.
- To measure our own marketing, improve features, troubleshoot, and prevent abuse.
We do not sell your personal information. We do not use data received from Meta or other connected platforms to train AI models, to build advertising profiles, or for any purpose other than the features you use in Mako.
4. Platform data & connected accounts
When you connect an account, you authorise Mako through that platform's official, secure OAuth process. We request only the permissions needed for the actions you ask for, and your use of each platform remains subject to that platform's own terms and policies.
Meta (Facebook & Instagram)
| What we access | Why |
|---|---|
| Your Facebook name and ID | To show which Facebook account is connected. |
| The Pages and Instagram accounts you manage | So you can choose the Page or Instagram account your ads and posts appear from. |
| Your business portfolios and ad accounts | So you can choose the ad account to advertise from. |
| Creating and managing ads | To create, edit, pause, and resume the campaigns you launch from Mako. |
| Ad performance | To show the results of your campaigns in Mako and recommend what to change. |
| Publishing to Pages and Instagram | To publish or schedule the posts you create in Mako. |
Other platforms
| Platform | What we access |
|---|---|
| TikTok | Basic profile and the ability to publish videos you authorise. |
| Google Ads / YouTube | The ability to create campaigns or upload content you authorise. |
5. Ads Mako runs for you
If you ask Mako to run your ads, we place them on Meta (Facebook and Instagram) from Mako's own ad account and Facebook Page. You do not need to connect a Meta account for this. We store the campaign settings and creatives you choose, and the campaign's performance data from Meta, so we can run the campaign, report its results to you, and settle your budget. Meta's ad transparency tools may show your business and Mako in connection with these ads.
6. People who respond to ads we run
Some campaigns we run for our customers ask people who tap the ad to leave their contact details on a Mako-hosted page. If you filled in such a form:
- What we collect — your name, phone number, email address, and whether you ticked the box agreeing to be contacted, plus the ad click ID, your browser type, and the country derived from your IP address.
- Who it is for — the business named on the page. That business decides how your details are used and is responsible for them; Mako processes them on its behalf.
- What we do with it — we deliver your details to that business (in its Mako inbox and by email), and we send Meta a hashed (SHA-256, not readable) copy of your email, phone, and name so Meta can measure and optimise the ad. We do not use your details for any other purpose and do not sell them.
- Your choices — to access or delete your details, contact the business named on the page, or email [email protected] and we will help.
7. How we share information
We share information only as needed to run the Service:
- Service providers (sub-processors), listed below, under contracts that protect your data.
- Platforms you connect, when we publish content or ads on your instruction.
- Businesses you contact through a lead form, as described in section 6.
- Legal reasons, where required by law or to protect rights and safety.
| Sub-processor | Purpose |
|---|---|
| Railway (United States) | Cloud hosting: application servers, database, and background processing. Stores all Service data, including encrypted connection tokens. |
| Anthropic | Powers the Ask Mako assistant. Receives your messages and the workspace and campaign data needed to answer them, including ad performance you ask about. |
| OpenAI, Google, Replicate, ElevenLabs, BytePlus, Kie.ai (AI model providers) | Generating the ad creatives, copy, voice-overs, videos, and research you request. We send the product information, images, and prompts needed for each generation. |
| Apify, Zyte, ScreenshotOne | Fetching the public web pages and public ads you ask us to research. |
| Cloudinary | Storage and processing of images and videos. |
| Stripe | Payment processing and subscription billing. |
| Resend | Email: sign-in links, notifications, and new-lead alerts. |
| PostHog (United States) | Product analytics and session recordings of paying accounts, with typed text masked. |
| Google Analytics | Website analytics. |
| Meta | Measuring our own ads (Meta Pixel and Conversions API), and measuring lead campaigns we run, using hashed contact details only. |
8. Security
We protect your data with encryption in transit (HTTPS), encryption at rest for connection tokens, and access limited to the people and systems that need it to run the Service. No method of transmission or storage is 100% secure, but we work to protect your information and to notify you and the relevant authorities of material incidents where required.
9. Data retention
We keep personal data for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. Connection tokens are deleted as soon as you disconnect a platform or remove Mako in the platform's settings. Leads are kept while the business's Mako workspace exists and are deleted with it. When you delete your account, we close it and delete its connection tokens immediately, and delete or anonymise the remaining data within 30 days, except where retention is legally required (for example, invoices for tax purposes).
10. Your rights
Depending on where you live (including under the EU/UK GDPR and the CCPA), you may have the right to access, correct, export, restrict, or delete your personal data, and to object to certain processing. To exercise these rights, contact us at [email protected]. You can also disconnect platforms and edit most data directly in the app. If you believe we have not resolved your concern, you can lodge a complaint with your local data protection authority (in the Netherlands: the Autoriteit Persoonsgegevens).
11. Data deletion instructions
You can remove your data from Mako in any of these ways:
- Delete your whole account in the app: go to Settings → Billing → Manage account and use Delete account. Your account is closed and its connection tokens are deleted immediately; the rest of your data is permanently deleted within 30 days.
- Disconnect a platform: go to Integrations in the app and choose Disconnect. This deletes the stored access token and account profile for that connection.
- Remove Mako from Facebook: in Facebook, go to Settings & privacy → Business integrations and remove Mako. Meta notifies us and we automatically delete the Meta data linked to that Facebook account.
- Delete specific content: remove products, creatives, or scheduled posts directly in the app.
- Email us: send a message to [email protected] with the subject "Data deletion request" from your account email. We will verify your request and delete your personal data within 30 days, except where the law requires us to keep it.
See also our dedicated data deletion instructions page.
12. Children's privacy
The Service is intended for businesses and is not directed to children under 16. We do not knowingly collect personal data from children.
13. International transfers
Our servers and database are located in the United States, and several of our service providers process data there or in other countries outside the European Economic Area. For these transfers we rely on the EU Standard Contractual Clauses and, where the provider is certified, the EU-U.S. Data Privacy Framework.
14. Changes to this policy
We may update this policy from time to time. We will post the updated version here and revise the "Last updated" date above. Material changes will be communicated where appropriate.
15. Contact us
Questions about this policy or your data? Email [email protected], or write to Magnus Brand B.V., Kerkstraat 4, 4901 JG Oosterhout, the Netherlands.