Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Max Benz
Am hohen Stein 36a
01189 Dresden
Germany
Email: team@themarketingopsmanager.com

We have not appointed a data protection officer, as we are not legally required to do so. For all privacy questions, contact us at the email address above.

2. Overview

The Marketing Ops Manager is a web application for marketing operations teams. It monitors campaign journeys (ads, landing pages, forms, tracking and CRM handoffs), opens incidents with evidence and lets people approve proposed fixes. We process personal data only as far as needed to provide the website, the blog and the application, to keep them secure and to answer your messages.

We do not use analytics, tracking or advertising tools, we do not set marketing cookies and we do not sell personal data. Fonts are served from our own servers, not from Google Fonts or other font services.

3. Hosting of the website and web application

The website and the web application are built and deployed with Bolt.new (StackBlitz, Inc., USA) and hosted on the content delivery network of Netlify, Inc., San Francisco, USA. When you open a page, your browser sends technical data that the host processes in server logs:

• IP address
• date and time of the request
• requested URL and HTTP status code
• referrer URL, if your browser sends it
• browser type and version (user agent) and operating system

This processing is necessary to deliver the website, to protect it against attacks and to analyse errors. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is the secure and reliable operation of the website. We do not combine log data with other data sources.

Netlify may process data in the USA. Transfers are based on the EU-US Data Privacy Framework, where the recipient is certified under it, and on the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR) in the provider's data processing agreement.

4. Account, sign-in and access codes

Signup is currently invite-only. To create an account you enter an access code, your full name, your work email address and a password. We process:

• account data: name, email address, a hash of your password (we never see or store the password itself), account creation and sign-in timestamps
• profile data you add, such as a job title, and the color of your avatar
• the access code you used and a redemption record (code, user ID, email address, time of redemption)
• authentication security events recorded by our backend provider, such as sign-ins and password resets, including the IP address

We send transactional emails needed for the account: email confirmation, password reset links and workspace invitations. These emails are sent through the authentication service of Supabase (see section 5). We do not send newsletters.

The legal basis is Art. 6 (1) (b) GDPR (performance of the contract or steps prior to entering into it). Logging security events is based on Art. 6 (1) (f) GDPR; our legitimate interest is protecting accounts against misuse.

5. Backend, database and authentication (Supabase)

User accounts, authentication, the database and our server functions run on Supabase, operated by Supabase, Inc. Supabase processes the data on our behalf under a data processing agreement (Art. 28 GDPR). The servers may be located in the EU or the USA. For transfers to countries outside the EU/EEA, the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR) and, where the recipient is certified, the EU-US Data Privacy Framework apply.

Supabase stores account data (section 4), workspace data (section 6), credentials of connected tools (section 7) and hashed MCP tokens (section 8). Server functions running on Supabase perform the scheduled checks, call the APIs of connected tools and send notifications.

6. Workspaces, team members and invitations

In a workspace, your team stores the data the product works with: campaigns, journey steps and the URLs, form IDs and event names to check, check results and evidence (HTTP status codes, response times, API responses, counts), incidents, notes, tasks, approval requests and an activity log. The activity log records who did what and when, for example which person approved a change, so that every change is traceable.

Workspace admins can invite teammates by email address and assign a role. We store the invited email address, the role, the inviter and the time of the invitation until the invitation is accepted or revoked. The invited person receives an invitation email (section 4).

The legal basis for account holders is Art. 6 (1) (b) GDPR. For personal data of other people that a customer adds to a workspace (for example invited colleagues), we act as a processor on behalf of the customer (see section 7).

7. Monitoring and connected tools

To monitor a campaign journey, our server functions request the landing pages and destination URLs you configure, like a browser would, and record status codes, response times, redirects and whether forms and tracking tags are present.

A workspace can connect the following tools. We only connect a tool when a workspace member enters its credentials, and we only call its API for the checks and actions configured in the workspace:

• HubSpot (HubSpot, Inc., USA): forms, form submission counts and contact searches to verify that leads arrive in the CRM and have an owner. We store counts, record IDs and timestamps as evidence, not the content of form submissions. Updates to contacts are only made after a workspace member approves them.
• Google Analytics 4 and Google Ads (Google Ireland Limited, Ireland, and Google LLC, USA): event counts, campaign status and final URLs.
• Slack (Slack Technologies, LLC, USA): incident and approval notifications posted to the channel of the incoming webhook you provide. Messages contain incident or approval titles, campaign names and the name of the person or agent who requested an approval.
• Jira Cloud (Atlassian Pty Ltd, Australia, or its affiliates): issues created for incidents and their status.
• Asana (Asana, Inc., USA): tasks created for incidents and their status.

API keys and tokens are stored server-side in a database table that cannot be read from the browser; the database is encrypted at rest by Supabase. The application only shows a masked hint of a stored key. Disconnecting a tool deletes its stored credentials.

For data that customers process through the product, including data fetched from their connected tools, the customer is the controller and we act as a processor under Art. 28 GDPR. A data processing agreement is available on request at team@themarketingopsmanager.com. The respective tool provider is responsible for processing within its own service under the customer's agreement with that provider.

8. MCP server and AI assistants

The product offers a server for the Model Context Protocol (MCP), so that a workspace can be used from AI assistants such as Claude, ChatGPT, Cursor or another MCP client. A workspace member creates an access token for this. We store only a cryptographic hash of the token together with its name, client and revocation status.

When you connect an AI assistant, the data it requests (for example campaigns, incidents and approvals of your workspace) is returned to that assistant. The provider of the assistant (for example Anthropic, OpenAI or Anysphere) processes this data under your own or your organization's agreement with that provider; we have no influence on that processing. Changes to connected external systems that an AI assistant proposes are executed only after a workspace member approves them.

The legal basis is Art. 6 (1) (b) GDPR; for customer data we act as a processor (section 7).

9. Blog

Our blog at themarketingopsmanager.com/blog/ runs on WordPress, hosted by ALL-INKL.COM - Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. Requests to the blog are passed through Netlify (section 3) to that server. Both hosts process the server log data listed in section 3 on the basis of Art. 6 (1) (f) GDPR. ALL-INKL.COM processes the data on our behalf under a data processing agreement.

If you write a comment, we store your name, email address, optional website, the comment text, the time and your IP address. The name, website and comment are published; the email address is not. Comments are checked for spam with the WordPress plugin Antispam Bee, which runs on our own server and does not send data to third parties. We store comments until the post is deleted or you ask us to remove your comment. If you tick the option to save your details, WordPress stores your name, email address and website in cookies in your browser for one year so you do not have to enter them again. The legal basis is Art. 6 (1) (a) and (f) GDPR.

The blog does not display Gravatar profile pictures, so no data is sent to Gravatar. Fonts on the blog are served from our own server.

10. Cookies and browser storage

The web application does not set cookies. It uses the local storage of your browser only for functions you request:

• your sign-in session from Supabase Auth, so that you stay signed in
• interface preferences: the selected workspace, the selected date range, when you last read notifications and whether you dismissed the getting started checklist

This storage is strictly necessary to provide the service you have requested, so no consent is required (§ 25 (2) no. 2 TDDDG). The subsequent processing is based on Art. 6 (1) (b) GDPR. You can delete the stored data at any time in your browser settings; you will then be signed out. For comment cookies on the blog, see section 9.

11. Contact by email

If you email us at team@themarketingopsmanager.com, we process your email address, your name if provided and the content of your message to answer your request. The legal basis is Art. 6 (1) (b) GDPR if your request relates to a contract or its preparation, and Art. 6 (1) (f) GDPR otherwise; our legitimate interest is answering your request.

12. Recipients at a glance

• Netlify, Inc. (USA), via Bolt.new by StackBlitz, Inc. (USA): hosting and content delivery of the website and web application
• Supabase, Inc.: database, authentication, server functions and account emails
• ALL-INKL.COM - Neue Medien Münnich (Germany): blog hosting
• tools that a customer connects to a workspace (HubSpot, Google Analytics 4, Google Ads, Slack, Jira Cloud, Asana), only on the customer's instruction
• AI assistants that a customer connects via MCP, under the customer's own agreement with that provider

We disclose data to authorities only if we are legally obliged to do so.

13. Retention

• server logs: deleted by the respective host after a short period, at the latest after 30 days, unless a security incident requires longer retention for its investigation
• account data: until you delete your account, then deleted, unless statutory retention obligations apply (for example 6 or 10 years for business letters and accounting records under German commercial and tax law)
• workspace data, including evidence, incidents, approvals and the activity log: until the workspace is deleted or the customer deletes the data
• invitations: until accepted or revoked, at the latest when the workspace is deleted
• access code redemption records: as long as the account exists
• credentials of connected tools: until the tool is disconnected or the workspace is deleted
• MCP token hashes: until the token is revoked or the workspace is deleted
• emails: as long as needed to handle the request, and longer only where statutory retention obligations apply
• blog comments: until the post is deleted or you ask us to remove the comment

14. Your rights

You have the following rights regarding your personal data:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing based on Art. 6 (1) (f) GDPR on grounds relating to your particular situation (Art. 21 GDPR)
• withdrawal of consent at any time with effect for the future (Art. 7 (3) GDPR)

To exercise your rights, email team@themarketingopsmanager.com. If your data is processed in a customer's workspace, we forward your request to that customer as the controller.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority competent for us is the Sächsische Datenschutz- und Transparenzbeauftragte, Devrientstraße 5, 01067 Dresden, Germany (www.datenschutz.sachsen.de).

15. No automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR. The automated checks of the product test technical systems such as web pages, forms and tracking; they do not make decisions about people. Actions that an AI assistant proposes for connected systems require approval by a person before they are executed.

16. Obligation to provide data

You are not obliged to provide personal data. Without the data marked as required at signup, however, we cannot create an account for you. Without the server log data, the website cannot be delivered.

17. Changes to this policy

We update this policy when the product or the legal requirements change. The current version is always available on this page.