Privacy Policy

At a glance

MarkIt is a universal capture tool run by Tomer Ezri, a sole proprietor based in Israel. We save the links, notes, screenshots, documents, and messages you send us, organize them with AI, and let you search them later. We do not sell your data, we do not train third-party AI models on it, and we do not show you ads. This policy is the long version. If anything below is unclear, email [email protected].

1. Who we are

• Controller: Tomer Ezri, sole proprietor, Israel, trading as "MarkIt" at mark-it.co.
• Primary contact for privacy questions and rights requests: [email protected].
• Product support: [email protected].
• EU representative (Article 27 GDPR): we have not yet appointed one. We will name an EU representative in this policy before the Service is generally available to EU residents outside the closed invite-only beta. In the meantime, EU users can reach us at [email protected].
• UK representative (Article 27 UK GDPR): same status as the EU representative above.
• Data Protection Officer: we have not appointed one. We fall below the GDPR and UK GDPR thresholds that would make appointment mandatory. Privacy questions go to [email protected].

2. What data we process

2.1 Account data

• Email address, display name, and (for password sign-ups) a password hash managed by Supabase Auth.
• If you sign in with Google, we receive your email, name, and avatar URL from Google.
• Invite code (during closed beta).

2.2 Captured content

• URLs you paste, save, or send to the bots.
• Text notes you type.
• Images, screenshots, and handwritten notes you upload.
• Documents you upload (PDF, DOCX, TXT, MD). We extract the text server-side and store up to 50,000 characters of the extracted text alongside the item.
• Media you send through the WhatsApp or Telegram bots.

2.3 AI-derived metadata

• Categories, tags, content-type labels, AI-generated headlines, and summaries our system produces from your items.
• Text embeddings used to power semantic search.
• Scraped article text we pull from public web pages you save.

2.4 Integration data

• Google Calendar: if you connect it, we receive an OAuth access token and refresh token from Google. We store both only in the NextAuth session cookie on your browser. We never write them to our database.
• WhatsApp: for WhatsApp we store (a) a SHA-256 hash of your phone number used as the primary key in our database, (b) a masked display form (for example, "+972-50-***-1427") for UI purposes, and (c) during the active WhatsApp beta, the raw phone number in one table (user_engagement.phone_raw) used by our outbound-messaging code. We are migrating to hash-only storage; until that migration completes, the raw phone is retained while you have WhatsApp linked and is deleted when you unlink WhatsApp or delete your account. Every inbound and outbound message is logged in an audit table for up to 30 days for abuse-prevention and support purposes. If you unlink WhatsApp we delete the logs for your account immediately.
• Telegram: we store your numeric Telegram user ID, a short-lived link token used to tie your Telegram account to your MarkIt account, and an audit log of bot messages.

2.5 Engagement data

• Opt-in status for email (default on) and WhatsApp proactive messages (default off).
• Timestamps for the last email and WhatsApp messages we sent you, so we can respect daily and monthly frequency caps.
• An engagement segment (for example, "new", "active", "at risk", "dormant") computed daily from your activity. We use it only to decide cadence, never to gate access or set prices.
• A per-message record (send time, open, click, reply, unsubscribe, Resend identifier) for every engagement email or WhatsApp we send you.

2.6 Device and session data

• Supabase authentication cookies (session cookies named with an sb- prefix) so you stay signed in.
• A NextAuth session cookie, if you connect Google Calendar.
• A short-lived markit_invite_code cookie (10 minutes, during Google OAuth redirect).
• A random session identifier stored in your browser's sessionStorage for in-house heatmap analytics.

2.7 In-house product analytics (heatmaps)

We run our own click and scroll tracking so we can improve the dashboard. For each event we store: a random per-tab session ID (not your user ID, not your IP), the page URL (capped at 500 characters), the event type (click, scroll, rage-click, dead-click, page view), normalized coordinates, scroll depth, time on page, and the element you interacted with (tag name, ID, CSS classes, and up to 50 characters of visible text such as a button label).

We never record the text you type: inputs, textareas, selects, and any field marked as a password, email, or phone number are masked before being written anywhere.

We do not use third-party analytics providers. No PostHog, no Google Analytics, no Mixpanel, no Amplitude. Your IP is used only as a rate-limit key in memory and is not persisted.

2.8 Communication data

• Feedback and support emails you send us (including the star rating, message, and the page URL from the widget). Feedback is forwarded to an internal inbox at [email protected] via Resend so we can reply, and the message text is sent to OpenAI (gpt-5-nano) to auto-classify its category and priority for triage (see Section 5).

2.9 Payment data (when paid tiers launch)

MarkIt is currently a free beta. When we turn on paid tiers, billing will be handled by a regulated payment processor and we will update this policy with that processor's name and role before charging anyone.

2.10 Early access requests

If you ask for early access through our request form (before you have an account), we collect:

• The email address you submit, so we can reach you if you are approved.
• A normalized (canonical) form of that email and its domain, derived and stored so we can de-duplicate repeat requests and prevent abuse of the form. For example, for Gmail addresses we strip dots and any "+tag" so the same mailbox is recognized as one requester.
• Your free-text pitch (why you want in), so we can evaluate the request.
• A one-way hashed form of your IP address for abuse prevention. We do not store your IP in raw form.
• Your approximate country, derived from request headers at submit time.
• The page you came from on our site.
• Your browser user-agent string.

When you submit a request, the email and pitch plus the signals above are forwarded to an internal inbox at [email protected] via Resend so our team can review it (the same way feedback is handled in Section 2.8). Please do not include sensitive personal information, or other people's personal data, in your pitch.

We use this only to evaluate and grant early access and to prevent abuse of the form. We do not name a separate sub-processor for this data; it is handled by the processors already listed in Section 4. Retention is described in Section 8.

3. Why we process your data (purposes and legal bases)

EU and UK GDPR require us to disclose the legal basis for each purpose. The table below does that.

For direct marketing outside the soft-opt-in model (for example, a future newsletter to prospects who are not yet customers), we will rely on your explicit consent and will ask for it at the point of collection.

4. Third parties we share data with

We do not sell your personal data and we do not "share" it for cross-context behavioral advertising under the CCPA definition. The companies below process data on our behalf, as independent controllers where noted, under written contracts that restrict use to the purposes listed.

We keep written data-processing agreements (Article 28 GDPR) with every processor above. We maintain an internal record of sub-processors and will update this list before adding a new one that materially changes the data flow.

Beyond this list, we may disclose data where required by law, by court order, or by a government request with legal authority. We may also transfer data in a merger, acquisition, or asset sale; if that happens, we will notify you in advance and let you delete your account before the transfer takes effect.

Bot integrations

MarkIt offers two optional messaging-bot integrations: a WhatsApp bot delivered through WaSender (which relays the WhatsApp Business API) and a Telegram bot built on the official Telegram Bot API. You activate either integration explicitly from Settings > Integrations by clicking Connect. This section is the Article 13 notice for the data processing that begins at that click.

Lawful basis. Once you click Connect, MarkIt processes the content you send the bot under GDPR Article 6(1)(b) - performance of a contract. The contract is the user-facing agreement to provide bot capture, search, and reminder features in exchange for processing the messages and media you forward. Connect is the activation moment; disconnect is the termination of that sub-contract.

What we process and why.

• Bot transport: WaSender (WhatsApp) or Telegram Messenger Inc. (Telegram) - relays the message between you and our servers. See the sub-processor table in Section 4 for hosting region and transfer mechanism.
• AI classification, tagging, and summarization: OpenAI processes the text you forward (and OCR text from images and documents) so the bot can categorize, tag, summarize, and search your items. See Section 5 for full AI processing detail.
• Social-media scraping: when you forward a public Instagram, TikTok, Facebook, LinkedIn, or YouTube URL, Apify fetches the public content. See Section 4.
• URL content extraction: when you forward any other public URL, Jina Reader (r.jina.ai) extracts the readable text. See Section 4.
• Transactional email: Resend delivers any related notifications we send by email (for example, a reminder you scheduled through the bot). See Section 4.

We do not name sub-processors inline in this subsection because the canonical list lives in Section 4. If we add or replace a bot-related sub-processor we will update that table and bump the "Last Updated" date at the top of this page.

Retention of bot data. Bot audit logs follow the schedule documented in Section 2.4 and Section 8: whatsapp_messages auto-purge after about 30 days and are deleted immediately when you unlink WhatsApp; telegram_messagesare retained for abuse prevention pending a parallel delete-on-unlink path. Saved items captured through the bot are stored under your account and deleted only when you delete the item or your account.

Contract-activation record. To meet the Article 5(2) accountability requirement we keep a small bot_link_history record of when each integration was activated and disconnected, alongside the version of the consent notice shown to you at the time. This record survives disconnect for the limitation period and is used only to demonstrate, on request, that the integration was activated by you and when. It does not contain message content.

How to withdraw. You can end the integration any time. From the web, open Settings and tap Disconnect on the WhatsApp or Telegram card. From inside the bot, send /unlink on either platform. Disconnect terminates the sub-contract and removes your bot link record. Saved items captured during the integration are kept under your account until you delete them.

5. AI processing

We use OpenAI (GPT-5 nano for text tasks and embeddings, GPT-5 vision for image OCR, plus an image-generation model for the optional AI image feature) for the following:

• OCR on images and screenshots you upload.
• Categorization that picks which workspace category each new item belongs to, or leaves it in "Unsorted".
• Tag generation (3 to 5 tags per item).
• Summaries and AI-written headlines shown in the item modal.
• Embeddings that power semantic search.
• Two-agent bot search that ranks your saved items when you ask the WhatsApp or Telegram bot a question.
• Engagement segmentation, run daily from your first-party activity (not from OpenAI) to decide whether a given email template is a good fit.
• AI image generation, only when you explicitly trigger it and spend credits on it.

None of these decisions produce a legal or similarly significant effect on you under GDPR Article 22. Every AI label is reversible with one click in the UI: you can rename categories, edit tags, correct summaries, move an item back to "Unsorted", or delete the item entirely.

OpenAI processes your data as our processor under the OpenAI API data policy. OpenAI does not train its publicly available models on API data by default. OpenAI retains API requests for up to 30 days for abuse monitoring. We do not have an OpenAI zero-data-retention agreement on our account today.

We do not send Google Calendar data to OpenAI today. We do not send payment data to OpenAI today. We will update this policy and obtain your consent before adding any feature that would change this.

When you send feedback through the in-app feedback widget, the message text is sent to OpenAI (gpt-5-nano) so we can automatically classify it (category and priority) for our internal triage. OpenAI processes it on our behalf as described above and does not train its publicly available models on it by default. If you would rather your feedback not be processed this way, email us at the address in Section 2.8 instead of using the widget.

6. Google Calendar integration (Limited Use disclosure)

If you connect Google Calendar, MarkIt requests the narrowest scope that fits the reminder feature: https://www.googleapis.com/auth/calendar.events, plus openid, userinfo.email, and userinfo.profile so we can identify your account.

MarkIt's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

The Google API Services User Data Policy permits the use and transfer of information received from Google APIs only for the following purposes. The four exceptions below are quoted verbatim from Google's policy:

1. "To provide or improve your appropriate access or user-facing features that are visible and prominent in the requesting application's user interface and only with the user's consent".
2. "For security purposes (for example, investigating abuse)".
3. "To comply with applicable laws".
4. "As part of a merger, acquisition, or sale of assets of the developer after obtaining explicit prior consent from the user".

Applied to MarkIt: we use Google Calendar data only to create, read, update, and delete the reminder events you schedule inside MarkIt, which is a user-facing feature prominent in the MarkIt interface. We do not use Google Calendar data to serve advertisements, including retargeting, personalized, or interest-based advertising. Humans at MarkIt do not read Google Calendar data except where an exception above applies. Beyond those exceptions, MarkIt voluntarily commits that if a merger, acquisition, or asset sale ever occurs, we will give you advance notice and the opportunity to delete your data.

We do not use Google Calendar data to train AI or machine-learning models of any kind, and we do not send Calendar data to OpenAI.

OAuth tokens live only in your browser's NextAuth session cookie. We do not copy them to our database. To revoke access at any time, sign out of your Google account in MarkIt or visit myaccount.google.com/permissions and remove MarkIt. There is no "revoke" button inside MarkIt yet - this is on our roadmap.

7. International transfers

MarkIt is operated from Israel. Our primary database (Supabase) and application hosting (Vercel) are in the United States. Several sub-processors are located in the US, the EU, or operate globally. Israel is currently recognized by the European Commission as offering an adequate level of data protection for transfers from the EEA under Commission Decision 2011/61/EU. If that decision is amended or revoked, we will update this policy and apply SCCs to those transfers.

Your data is transferred outside the European Economic Area, the United Kingdom, and Israel when it reaches US-based sub-processors. We rely on two mechanisms, in this order of priority for each recipient: (a) the EU-US Data Privacy Framework and its UK Extension, where the recipient is certified (currently Vercel; see dataprivacyframework.gov/list for current status); and (b) the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914) together with the UK Addendum to the SCCs, which are incorporated into each sub-processor's Data Processing Agreement. For Israel, we rely on the EU adequacy decision for Israel. For each sub-processor we assess the level of protection in the receiving country before transferring. You can request a copy of the transfer-impact assessment from [email protected].

For transfers from Israel, where the recipient country is not on the Israeli Privacy Protection Authority's list of adequate jurisdictions, we use a written contract that binds the recipient to standards equivalent to the PPL and the Israeli Data Security Regulations 2017.

8. Data retention

• Account data: kept until you delete your account. On deletion we hard-delete the content you saved (items, notes, tags, categories, reminders) and your account record immediately, along with embeddings, credits, milestones, referrals, storage files in all three buckets, and used invite codes. Bot audit logs (WhatsApp and Telegram message metadata) and engagement-message logs currently persist as orphaned records with your user ID removed, and are purged when our retention cleanup runs. We are tightening this so deletion cascades everywhere; until then, if you want your bot audit logs deleted immediately, email [email protected].
• Backups: we keep encrypted backups of your data to protect against accidental loss. Database backups are retained up to 30 days; image and file backups up to 60 days. All backups are encrypted at rest and stored in the EU (Cloudflare R2, EU jurisdiction). Supabase additionally retains its own platform backups per its policy. When you delete your account, your data is removed from live systems immediately. Backup copies expire and are deleted within 60 days. In the unlikely event we need to restore from a backup that pre-dates your deletion, we maintain a separate deletion log (containing only one-way SHA-256 hashes of your email and phone, never the raw values) and re-apply pending deletions to the restored data so it does not reappear.
• Captured content: kept until you delete the item or the account.
• Bot audit logs (whatsapp_messages, telegram_messages): whatsapp_messages are set to auto-purge after about 30 days and are deleted immediately when you unlink WhatsApp. telegram_messages are currently retained for abuse prevention and are not yet deleted when you unlink Telegram - we will add a parallel delete on the Telegram side; in the meantime, email [email protected] to have your Telegram audit rows removed.
• Engagement message records: retained for the life of the account for compliance with direct-marketing record-keeping rules and to honor unsubscribe requests.
• Heatmap events: stored pseudonymously by session ID. Ingestion pauses automatically when the table reaches 500,000 rows; older events are rotated out when we compact.
• Server logs at Vercel: retained per Vercel's platform policy (typically several days to a few weeks, depending on plan).
• OAuth tokens: Google Calendar tokens live in your NextAuth session cookie only. They are never persisted on our servers and expire per Google's token lifetime. Revoking access through Google immediately invalidates them.
• AI request metadata at OpenAI: up to 30 days under OpenAI's default abuse-monitoring retention, then deleted by OpenAI. We do not copy that data.
• Suppression list for unsubscribed emails: kept indefinitely to honor your opt-out.
• Early access requests: request records (email, pitch, hashed IP, country, source page, user-agent) are deleted within about 30 days of a decision (approve or deny). Requests that are never decided are deleted within about 90 days.

9. Security

• HTTPS and TLS 1.2+ enforced at the edge by Vercel.
• Security headers set by the application: X-Frame-Options, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, and a Permissions-Policy that disables camera, microphone, and geolocation. A Content Security Policy is in place in report-only mode while we tune it; we will move it to enforcing before we leave beta.
• Row-Level Security is enabled on the tables that store user content, bot links, engagement messages, and audit logs. Every query in application code is scoped to the authenticated user.
• Authentication uses Supabase Auth (industry-standard password hashing, currently bcrypt per Supabase's documentation) and JWT-based session cookies. Google OAuth sign-in is supported.
• Rate limiting on heatmap, WhatsApp, and send retries, plus an atomic daily-message cap per user for the bots.
• LLM prompt-injection hardening on every AI system prompt, including a sanitizer for user-supplied text before it reaches the model.
• An admin audit log records staff actions that touch user data.
• Account deletion requires you to type your email address as a confirmation challenge.

No system is perfectly secure. If a breach is likely to risk your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it (GDPR Art. 33). Where the risk to you is high, we will notify you without undue delay (GDPR Art. 34).

10. Your rights

You have the following rights regardless of where you live. We will honor them within 30 days, extendable once by an additional 30 days for complex requests (GDPR allows up to three months; we target 30 days as our standard).

• Access: ask for a copy of the personal data we hold about you.
• Rectification: correct data that is wrong.
• Erasure: delete your account and the data tied to it. You can do this yourself from Settings > Delete Account.
• Restriction: ask us to pause processing while we investigate an accuracy or objection request.
• Portability: receive your data in a structured, machine-readable format. We do not currently have a self-service export button. On written request to [email protected] we will prepare an export, typically as JSON with attached media links, within 30 days.
• Objection: object to processing based on legitimate interests (including engagement emails). We will stop unless we can show compelling grounds.
• Withdraw consent: where we rely on consent (for example, WhatsApp proactive messages), you can withdraw it at any time without affecting past processing.
• Not be subject to solely automated decisions with legal or similarly significant effect: MarkIt does not make such decisions about you. Our AI produces labels you can change.
• Complain to a supervisory authority: see section 14.

To exercise any of these rights, email [email protected] from the address on your account or from an address you can verify you control. We may ask you to confirm your identity if the request is not obviously from you.

Channel-specific opt-outs already built in

• Email marketing: one-click unsubscribe in every engagement email. We implement RFC 8058 (List-Unsubscribe and List-Unsubscribe-Post headers) so Gmail, Yahoo, and other clients can unsubscribe you without round-tripping through our site.
• WhatsApp proactive messages: to opt out, reply STOP in English. (We are adding Hebrew STOP - reply STOP in English for now; or unlink WhatsApp from Settings at any time to stop all WhatsApp messages.)
• Telegram proactive messages: to stop Telegram bot messages, use /unlink in the bot (links to your MarkIt account are removed) or unlink Telegram from Settings. Your Telegram audit logs are retained per the general retention schedule and are removed on account deletion.
• Google Calendar: revoke access at myaccount.google.com/permissions.

11. California residents (CCPA / CPRA)

This section applies if you are a California resident. We treat these rights as extending to all US residents regardless of state.

Categories of personal information we collected in the preceding 12 months (using the CCPA's statutory categories under Cal. Civ. Code § 1798.140(v)(1)):

Sources: directly from you, from Google (OAuth profile), from Apify/Jina (public content you chose to save), and from your device (session data).

Purposes: see section 3. Business purposes: providing the service, preventing fraud, and ensuring security.

We do not sell personal information. Disclosures to the vendors in Section 4 are made to service providers under written contracts that meet CCPA § 1798.140(ag) requirements and that restrict use of the personal information to providing the services to MarkIt. We do not "share" personal information for cross-context behavioral advertising under the CCPA definition. We honor the Global Privacy Control signal as a valid opt-out of sale or sharing, even though we have no such activities.

Sensitive Personal Information: we do not collect any SPI (CA CC § 1798.140(ae)) - no government IDs, financial account numbers, precise geolocation, racial/ethnic/religious origin, union membership, genetic/biometric data, health information, or sexual-orientation data. Users may upload such data into their own captured content (notes, documents); they remain responsible for that, and we treat it as User Content subject to standard protections, not as SPI we collect for our own purposes.

Shine the Light (Cal. Civ. Code § 1798.83): we do not disclose personal information to third parties for their own direct-marketing purposes. California residents are entitled to request this information once per year; the response for MarkIt would be: none.

Your California rights: to know, to delete, to correct, to opt out of sale/share (not applicable to us), to limit use of sensitive PI (not applicable, since we collect no SPI), and not to be retaliated against for exercising these rights.

Automated decision-making technology (ADMT): our AI categorization, tagging, summarization, and engagement segmentation are ADMT under the CPPA definition. California's Automated Decisionmaking Technology regulations were adopted by the California Privacy Protection Agency in September 2025 and are being implemented on a phased schedule. MarkIt's AI features do not make decisions that produce legal or similarly significant effects on users (our AI only suggests a category, generates a tag, summarizes text, or ranks search results - all of which you can override), so the ADMT transparency obligations that apply to us are limited. We will update this policy if any MarkIt feature begins producing ADMT-covered decisions.

How to exercise: email [email protected]. We verify by replying to the address on file.

12. UK residents (UK GDPR / DPA 2018)

If you are in the UK, the rights listed in section 10 apply under the UK GDPR. You can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint. We rely on the "soft opt-in" in Regulation 22(3) of the Privacy and Electronic Communications (EC Directive) Regulations 2003 for engagement emails to existing users, and every such message carries a one-click unsubscribe. We will name a UK Article 27 representative in this policy before the Service is generally available to UK residents outside the closed invite-only beta.

13. Israel residents (PPL 5741-1981, as amended by Amendment 13, 14 August 2025)

MarkIt is operated from Israel and the controller is an Israeli sole proprietor. The Israeli Privacy Protection Authority is our home supervisory authority.

• Access and correction: on request to [email protected], we will provide the data we hold about you in Hebrew, English, or Arabic and correct inaccuracies within 30 days.
• Database registration: our database is not registrable under the post-Amendment-13 thresholds (we do not collect personal data to transfer to others as a business activity, and we are below the sensitive-data thresholds).
• Data Protection Officer / Privacy Supervisor: we have not appointed one under Amendment 13 thresholds. Privacy questions go to [email protected].
• Hebrew translation: the authoritative version of this policy is in English. A Hebrew translation is available on request. We plan to publish a bilingual /privacy page; until then, email us.
• Cross-border transfers: see section 7.

14. Supervisory authorities

You can complain to the supervisory authority where you live, where you work, or where you believe a violation occurred.

• Israel: Privacy Protection Authority - gov.il/en/departments/about/about_ppa.
• EU: your member-state authority. A list is maintained by the European Data Protection Board at edpb.europa.eu/about-edpb/board/members_en.
• UK: Information Commissioner's Office - ico.org.uk.
• California: California Privacy Protection Agency (cppa.ca.gov) and the California Attorney General (oag.ca.gov/privacy).

We would appreciate the chance to address your concerns before you contact a regulator. Email [email protected] first.

15. Children

MarkIt is not directed to children. You must be at least 13 years old to use MarkIt in the United States (COPPA), at least 16 in the European Union unless your member state has lowered the digital-consent age to 13, 14, or 15, and at least 18 in jurisdictions where that is the default age of contractual capacity unless your legal guardian has agreed on your behalf.

We do not have a technical age gate today. We rely on your acceptance of the Terms and on user reports. If you believe a child under the applicable minimum age has used MarkIt, email [email protected] and we will delete the account.

16. Cookies and local storage

We use strictly necessary cookies and first-party browser storage only. We do not set advertising, analytics, or cross-site tracking cookies, and we do not use third-party analytics providers.

Because we use only strictly necessary cookies and first-party UI state, we do not show a cookie consent banner under the ePrivacy Directive. If we ever add third-party analytics or marketing tags, we will present a consent banner with an equal-weight "Reject All" option before any non-essential technology loads.

17. Who at MarkIt can see your data

MarkIt is a small team. Access to production data is limited to the controller (Tomer Ezri) and staff on the ADMIN_EMAILS allow-list, and is logged in an admin audit table. Staff access is used only to investigate abuse, diagnose a bug you reported, respond to a legal request, or build a feature you asked for. We do not read your content for marketing purposes.

18. Direct marketing (email and messaging)

• Email: we send product engagement emails to existing users under the ePrivacy "soft opt-in" (Directive 2002/58/EC Article 13(2), as transposed in each EU member state, and PECR Regulation 22(3) in the UK), which permits marketing emails to existing customers about similar products or services where: (a) we collected your email during a sale or sign-up, (b) every email includes a one-click unsubscribe, and (c) you did not opt out when we first collected your email. Our lawful basis under GDPR Art. 6(1)(f) is our legitimate interest in keeping active users informed about MarkIt features, balanced against your rights; you can object at any time via the unsubscribe link. For US recipients we comply with CAN-SPAM. Every message identifies us as the sender, uses an accurate subject line, and includes a one-click RFC 8058 unsubscribe header plus a visible unsubscribe link. Our postal address for CAN-SPAM purposes is: Helsinki St 4, Tel Aviv 6299604, Israel.
• WhatsApp and Telegram: proactive messages (bi-weekly recaps, occasional re-engagement nudges) go out only to users who have explicitly opted in. To pause future bot messages, send /mute to the bot at any time, or toggle "Recap channel" in Settings. /mute stops both recaps and re-engagement nudges; you can resume with /unmute. The legacy STOP keyword (in English) is still honoured immediately, and /unlink disconnects the bot from your account entirely. Both keywords take effect on the next inbound message.
• Frequency caps: at most one engagement message per user per day across channels, at most two WhatsApp proactive messages per month, a 24-hour gap between channels, progressive reduction after two ignored emails or three ignored WhatsApps, and a 90-day sunset after zero engagement.

19. Changes to this policy

We will post a new "Last Updated" date at the top of this page for every change. For material changes we will also email the address on your account and show a banner in the app for at least 30 days before the change takes effect. Corrections and additions that expand your rights may take effect immediately. If you do not agree to a material change, you can delete your account before the effective date.

20. Contact

• Privacy, legal, rights requests: [email protected]
• Product support: [email protected]