Privacy Policy

Effective date: August 11, 2026

1. Introduction

This Service is operated by Operator Mark, Inc., a Delaware corporation with a registered address at 1111B S Governors Ave, Suite 41927, Dover, DE 19904, United States (“OperatorMark”, “we”, “us”, or “our”). OperatorMark operates the OperatorMark platform, also known as “Mark”, a software-as-a-service application that helps businesses manage, analyze, and optimize their digital advertising campaigns using artificial intelligence. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our services, and describes your rights under applicable data protection law, including the EU General Data Protection Regulation (“GDPR”) where relevant and Israel's Privacy Protection Law (including Amendment 13).

This policy applies to all users of operatormark.com, app.operatormark.com, and the OperatorMark API (collectively, the “Service”). By accessing or using the Service, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.

If you have any questions about this Privacy Policy, please contact us at support@operatormark.com.

2. Information We Collect

2a. Information You Provide Directly

• Account information: your email address, name, company name, role, and how you heard about us (referral source).
• Business information: business context you provide to personalize AI agent behavior, such as your industry, target audience, brand guidelines, and campaign objectives.
• Chat messages: conversations you have with our AI assistant, including questions, instructions, and any context you share within the chat interface.
• Creative content: images, videos, and text that you upload to or create within the platform for use in advertising campaigns.
• Billing information: your subscription plan selections and payment details. Payment information is processed securely by our third-party payment processor and is not stored on our servers. If you cancel, we also store any feedback you choose to provide, such as your cancellation reason.

2b. Information Collected Automatically

• Ad performance data: metrics and performance data fetched automatically from your connected advertising platforms (such as Meta/Facebook) via scheduled processes that run on daily, weekly, and monthly intervals.
• Token usage: your consumption of AI features (chat messages, image and creative generation, text generation, and insights/analytics chat), tracked per billing period to manage subscription limits.
• Authentication data: tokens issued by our authentication provider, used to verify your identity and maintain your session.
• Usage and log data: actions you take in the Service and technical data such as your IP address and browser type, kept in activity and diagnostic logs. Diagnostic error logs may include the content of a message that triggered an error.

2c. Information From Third Parties

When you connect a third-party platform to OperatorMark, we receive information from that platform on your behalf:

• Meta/Facebook: when you connect your Facebook account via OAuth, we access and store your ad account data, campaign data, ad set data, individual ad data, performance metrics, creative assets, page data, and your Facebook profile name, ID, and profile picture. Items you save in the app (audiences, pixels, lead forms, catalogs, targeting presets, and selected campaigns, ad sets, or connected Instagram/WhatsApp accounts) are stored as references. For custom audiences and pixels, we store only the name and platform identifier of each: we do not access, receive, or store the underlying audience membership (the individuals within an audience) or pixel event-level data (individual browsing or conversion events). For lead forms, we store the form schema (the questions configured on the form); we do not retrieve or store consumer-submitted lead answers, even though our Meta integration is authorized for this scope. We only access data that is necessary to provide the Service and that you have authorized us to access.

3. How We Use Your Information

• Provide and operate the Service: to create and maintain your account, authenticate your sessions, and deliver the core functionality of the platform.
• Power AI features: to enable the chat assistant, insights AI chat, campaign recommendations, creative and text generation, and weekly performance reports that form the core of the OperatorMark experience.
• Fetch and display ad performance data: to retrieve your advertising metrics from connected platforms and present them in an actionable format within the Service.
• Auto-generate weekly performance reports: to produce AI-driven summaries and analyses of your advertising performance on a recurring basis.
• Manage your subscription and billing: to process payments, enforce usage limits, and administer your subscription plan.
• Prevent fraud: to detect and prevent abuse, including detecting when the same connected advertising account is used across multiple OperatorMark accounts to circumvent free-trial limits.
• Send transactional communications: email verification, trial expiration reminders, and account-related notifications.
• Provide support: authorized staff may access your account and its data to diagnose problems and assist you.
• Improve the Service and for business analytics: to analyze usage patterns, diagnose technical issues, develop new features, and understand product usage and engagement over time. We may retain limited information for these business analytics purposes even after you delete your account, as described in Section 6.

Legal Basis for Processing

• Contractual necessity: processing required to provide the Service you have requested.
• Legitimate interests: fraud prevention, security, service improvement, and business analytics, where those interests are not overridden by your rights.
• Consent: where required by applicable law, such as for optional communications. You may withdraw consent at any time by contacting us.
• Legal obligation: processing necessary to comply with applicable laws, regulations, or legal processes.

We do not sell, rent, or trade your personal information to third parties. Information is shared only with trusted third-party service providers, solely to operate and improve the Service. Your use of the Service is also governed by our Terms of Service and Refund & Cancellation Policy.

4. Third-Party Service Providers

We share information with trusted third-party service providers solely to operate and deliver the Service. Each provider receives only the minimum data necessary to perform its designated function. Categories of providers we engage include:

• Authentication providers: to verify your identity and maintain secure sessions.
• Bot protection services: to prevent automated abuse on login and signup forms.
• Advertising platform APIs: to connect to and interact with your advertising accounts (currently Meta/Facebook, with additional platforms planned).
• AI providers: to power the AI chat assistant, insights chat, campaign recommendations, report generation, creative generation, and contextual search features.
• Cloud storage providers: to securely store creative files you upload to the Service, encrypted at rest.
• Payment processors: to securely handle subscription billing and payment card processing.
• Infrastructure and hosting providers: to host and operate the Service.
• Analytics providers: to understand how users interact with the Service and measure product engagement. Analytics data is processed in the European Union.
• Email delivery providers: to send service and promotional emails on our behalf. Email delivery is processed in the European Union.
• Error tracking / application monitoring: to detect and diagnose technical issues. This provider may incidentally process personal data present in error reports.

Our AI providers do not use data submitted via their APIs to train their models on the service tiers we use. You may request a current, named list of our sub-processors at any time by contacting support@operatormark.com; we will provide this as a dedicated document on request.

5. AI Data Processing

OperatorMark uses artificial intelligence extensively to deliver its core features. It is important that you understand how your data is processed in connection with these AI capabilities, and how AI-generated output is disclosed:

• Chat and recommendations: your chat conversations, ad account context, and business information are transmitted to third-party AI providers for processing when you interact with the AI assistant, the insights AI chat, or when automated reports and recommendations are generated.
• Image and creative generation: image generation and editing requests, including any source images you provide, are transmitted to third-party AI providers for processing.
• AI interaction disclosure: the chat assistant and insights AI chat are clearly and persistently identified within the product interface as AI systems, so that you always know when you are interacting with AI rather than a human.
• AI-generated content marking: images and other generated creative output are marked using machine-readable provenance signals (such as embedded metadata and invisible watermarking) provided by our AI providers, so that AI-generated content remains detectable as such.
• Vector search: text embeddings derived from your data may be transmitted to third-party vector search infrastructure to enable contextual retrieval that improves the relevance of AI responses.
• No model training: we do not use your data to train AI models, and our third-party AI providers do not use API-submitted data for training purposes on their current service tiers.
• Accuracy disclaimer: AI-generated outputs, including recommendations, reports, creative content, and chat responses, may be inaccurate, incomplete, or inappropriate. You are solely responsible for reviewing, verifying, and approving all AI-generated content, and any asset, campaign, or ad uploaded through the Service, before acting on it or publishing it.

6. Data Retention

We retain your data for the periods outlined below. When data reaches the end of its retention period, it is deleted.

Retention periods may vary by subscription tier in the future. Any changes will be reflected in an updated version of this Privacy Policy.

Accounts that remain inactive for more than 12 consecutive months may be terminated. We will notify you by email at least 30 days before any such termination, with a reminder shortly before it takes effect; logging in at any point keeps your account active. Upon termination, all associated data is deleted in accordance with this policy.

Business analytics retention

Where you delete your account, we delete your personal data as described in Section 9, except that we may retain limited information for business analytics purposes (such as understanding product usage, retention, and engagement trends over time) and for fraud-prevention purposes, such as recognizing a previously used advertising account to prevent free-trial abuse. Where reasonably possible, information retained for these purposes is minimized or aggregated so that it is not readily attributable to you individually.

We also retain limited legal, security, and business records after account deletion: billing and invoice records held with our payment processor (required for accounting, tax, and dispute purposes), error reports already sent to our error-tracking provider (which expire on that provider's retention schedule), administrative audit logs (kept up to 90 days), and a record of the deletion itself (kept as evidence that the deletion was carried out).

7. Data Security

• Encryption at rest: sensitive credentials such as OAuth tokens are encrypted using industry-standard symmetric encryption. Creative files are encrypted at rest using industry-standard encryption provided by our cloud storage infrastructure.
• Encryption in transit: all connections to and from the Service are encrypted via HTTPS, with HTTP Strict Transport Security (HSTS) enforced.
• Content Security Policy: CSP headers mitigate cross-site scripting and other code injection attacks.
• Rate limiting: authentication endpoints are rate-limited to prevent brute-force and credential-stuffing attacks.
• Bot protection: bot detection and prevention measures are deployed on login and signup forms.
• Disposable email blocking: disposable and temporary email addresses are blocked during registration.
• Webhook verification: incoming webhook callbacks from third-party platforms are verified using cryptographic signatures.
• CSRF protection: cross-site request forgery protections are implemented on OAuth authorization flows.

While we strive to protect your information, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security, but we are committed to maintaining industry-standard protections and promptly addressing any identified vulnerabilities.

8. Data Breach Notification

In the event of a data breach that compromises the security, confidentiality, or integrity of your personal information, we will notify affected users and relevant authorities as required by applicable law, including, where applicable, the relevant EU supervisory authority and Israel's Privacy Protection Authority. We aim to provide notification within 72 hours of becoming aware of a qualifying breach, including a description of the breach, the categories of data affected, remediation steps taken, and recommended actions you can take. Notification will be delivered via the email address associated with your account.

9. Your Rights

You have the following rights with respect to your personal information, which apply to all users and, where the GDPR or Israeli Privacy Protection Law specifically applies, include the additional rights noted below:

• Right of access: you may request confirmation of whether we process your personal data and request a copy of it.
• Right to rectification: you may update your account information at any time through the application; where information cannot be updated directly, contact support@operatormark.com.
• Right to erasure: you may delete your account at any time from the Settings page. Account deletion removes your user profile, chat history, creative files, authentication records, and all connected platform data, except for the limited information described in Section 6 (Business analytics retention). Data is removed from our active systems immediately and fully deleted within 30 days.
• Right to restriction of processing and right to object: you may request that we restrict or stop certain processing of your personal data, including processing based on legitimate interests, by contacting support@operatormark.com.
• Right to data portability: you may request an export of your personal data by contacting support@operatormark.com. We will provide your data in a machine-readable format within 30 days of receiving your request.
• Right to lodge a complaint: where the GDPR applies to our processing of your data, you have the right to lodge a complaint with your local data protection supervisory authority. Where Israeli Privacy Protection Law applies, you may contact the Israeli Privacy Protection Authority.
• Meta disconnect and deletion: you may disconnect your Meta/Facebook account at any time from the Settings page, which revokes our access and removes your connected ad account data from our systems. Items you saved while connected (creatives, media, chats, and pinned audiences, pixels, and lead forms) remain until you remove them or delete your account. Meta may also request deletion of your Facebook-related data via webhook, which we honor promptly with a confirmation code returned to Meta.
• Opt out of AI processing: you may request to opt out of AI-powered data processing by contacting support@operatormark.com. AI features are central to the Service, so opting out may significantly limit functionality.

To exercise any of these rights, contact us at support@operatormark.com. We will verify your identity before fulfilling your request and respond within a reasonable timeframe, and in any event within the timeframe required by applicable law.

10. California Privacy Rights

Where the California Consumer Privacy Act (“CCPA”) applies to OperatorMark, California residents may have the following rights regarding their personal information:

• Right to know: disclosure of the categories and specific pieces of personal information we have collected, the categories of sources, the business purpose for collection, and the categories of third parties with whom it is shared.
• Right to delete: deletion of your personal information, subject to certain legal exceptions.
• Right to non-discrimination: we will not discriminate against you for exercising any CCPA rights.
• No sale of personal information: we do not sell your personal information, as defined under the CCPA, and have not sold personal information in the preceding 12 months.

To exercise any of these rights, contact us at support@operatormark.com. Where the CCPA applies, we will verify your identity before fulfilling your request and respond within the timeframe required by law.

10a. Israeli Privacy Rights

OperatorMark's primary current market is Israel, and we process personal data of Israeli users in accordance with Israel's Privacy Protection Law, 5741-1981, as amended (including Amendment 13). Israeli users have rights to access and correct their personal information held in our databases, consistent with the rights described in Section 9. If you wish to exercise these rights or have concerns about our handling of your personal data, contact support@operatormark.com; you may also contact the Israeli Privacy Protection Authority.

11. International Data Transfers

Our primary infrastructure is hosted on servers located in the European Union. Certain third-party service providers we rely on may process your data in other regions, including the United States, to provide core functionality such as AI processing and payment handling. Where your data is transferred internationally, we rely on appropriate safeguards, including Standard Contractual Clauses approved by the European Commission, to protect your information.

12. Children's Privacy

The Service is intended for use by individuals who are 18 years of age or older. We do not knowingly collect personal information from anyone under the age of 18. If we become aware that we have inadvertently collected personal data from a minor, we will take prompt steps to delete that information. If you believe a minor has provided us with personal information, contact support@operatormark.com.

13. Browser Storage & Analytics

OperatorMark uses browser localStorage and sessionStorage (rather than tracking cookies) to store authentication session tokens, your UI theme preference, temporary creative and message drafts, temporary OAuth flow data, and a cached copy of your profile details locally on your device. We do not use cookies for tracking or advertising. Our bot-protection service (Google reCAPTCHA), which protects the login and signup pages, may set its own cookie for security purposes.

We use a privacy-focused analytics service, hosted and processed in the European Union, to understand how users interact with the Service. This service also stores its visitor identifier in localStorage (not cookies) to maintain session identity across page views, used solely for product improvement: not for advertising, and not shared with third parties for marketing. As part of this analytics service, we may record how the interface is used during a session (session replay) to diagnose usability problems and improve the product; these recordings are processed in the European Union and are used solely for product improvement.

Links in emails we send may be routed through a redirect on a subdomain we control, so we can measure whether a message was useful. This information is used only to improve our communications, and never for advertising or third-party marketing.

The Service does not currently respond to “Do Not Track” (DNT) browser signals.

14. Communications

We send two kinds of email.

Service emails are part of the Service and are sent to all users: email verification, setup and trial reminders, account and billing notifications, product notices, inactivity and account-termination notices, and security alerts. You cannot opt out of these while you hold an account, because they are necessary to provide the Service and to keep you informed about your subscription.

Promotional emails (product news, tips, offers and similar marketing messages) are sent only to users who have given prior, separate, opt-in consent. Consent is never bundled with acceptance of our Terms and is never a condition of using the Service. You may withdraw it at any time from the preferences link included in every promotional email, or from your account settings, with no effect on your service emails. We do not sell your email address or share it for third-party marketing. We handle these communications in accordance with applicable anti-spam laws.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. When we make material changes, we will notify you by email or through a prominent in-Service notice prior to the changes taking effect. Your continued use of the Service after such changes constitutes acceptance of the revised terms. Previous versions are available on request.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, contact us at support@operatormark.com. We will respond within a reasonable timeframe.