Privacy Policy
In force since 24 August 2026. Version 1.0.
This covers the Ai Builders app and the site at aios.marketingled.com. Short version: we collect what you type in when you sign up, and which pages you read once you are in. Nothing is sold, nothing is shared for advertising, and you can have all of it deleted by writing one email.
1. Who is responsible
marketing-led LLC
10685-B Hazelhurst Dr. #40067
Houston, TX 77043, United States
Contact for anything in this policy, including deletion requests: matt@marketingled.com. We are the controller for the data described here. We have not appointed a data protection officer, because we are not required to.
2. What we collect
Data you give us
When you create an account, the sign-up asks for your email address, your name and company, your phone number, and a handful of questions about your business: your goal for the year, your biggest challenge, the problem you would hand to a magic wand, your revenue band, and how far along you are with AI. The phone number and the free-text answers are optional. Leave them blank and the account still works.
Data created by using the library
Once you are signed in we record which pages you open and how long each one stays visible. This is our own table in our own database, tied to your account. The app sends no name, no email address and no identifier from your device. Your identity is resolved on our server from your session.
Data your device sends automatically
Our hosting provider logs the usual technical request data: IP address, time, the page requested, browser and operating system version. These logs exist to keep the service running and secure. We do not build profiles from them.
We record whether an email we sent was opened and whether a link in it was clicked, so we send less and only what gets read. You can opt out of marketing email with the unsubscribe link in every message. Sign-in emails are not marketing and cannot be switched off while your account is open.
What we never collect
- The app asks for no device permissions. No location, no contacts, no photos, no camera, no microphone, no calendar.
- We do not track you across other apps or websites, and we run no advertising network.
- We do not take payment in the app, so we hold no card data.
3. Why we use it, and on what basis
| Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|
| Email address | Creating your account, sending the sign-in code, letting you back in | Contract, Art. 6(1)(b) |
| Name, company | Addressing you as a person | Contract, Art. 6(1)(b) |
| Phone number | Following up about the library | Consent, Art. 6(1)(a). Optional, withdraw any time |
| Sign-up answers | Deciding which systems to write next and which to point you at | Legitimate interest, Art. 6(1)(f) |
| Pages read, time visible | Knowing which cookbooks earn their place | Legitimate interest, Art. 6(1)(f) |
| Email opens and clicks | Sending less and better email | Legitimate interest, Art. 6(1)(f) |
| Server logs | Running the service, finding faults, stopping abuse | Legitimate interest, Art. 6(1)(f) |
Where we rely on legitimate interest, our interest is running a library that is worth reading and keeping it available. We weighed that against your interests: the data stays first party, it is never sold, and you can object at any time under section 7.
We do not use your data for automated decision-making or profiling that has legal effects for you.
4. Cookies and local storage
We set no advertising cookies and no analytics cookies. What is stored is:
- Session cookies that keep you signed in. Without them the gate cannot tell it is you, so they are strictly necessary and need no consent banner.
- A short-lived cookie that remembers the page you were heading to when the sign-in interrupted you.
- Local storage in your browser for small interface state, for example your scroll position and whether the offline mode is switched on. It stays on your device.
5. Who else touches it
These companies process data on our instructions, under a data processing agreement, and for nothing else:
| Provider | What for | Where |
|---|---|---|
| Supabase | Accounts, database, sign-in | EU and US |
| Vercel | Hosting and delivery | EU and US |
| Resend | Sending sign-in codes and email | EU and US |
Two more load in your browser and therefore see your IP address:
- Google Fonts (fonts.googleapis.com, fonts.gstatic.com) serves the typeface. Google receives your IP address when the font loads.
- The Matt AI chat widget, provided by YOU AI on marketingos.passion.io, loads when you open a member page. If you type into it, your messages are processed there to answer you. Do not put anything confidential in a chat window.
6. Data leaving the EU
Some of the providers above process data in the United States. Those transfers rest on the European Commission's standard contractual clauses, and where available on the provider's certification under the EU-US Data Privacy Framework. You can ask us for a copy of the safeguards.
7. Your rights
Under the GDPR and comparable laws you can ask us to:
- tell you what we hold about you, and give you a copy
- correct anything wrong
- delete all of it
- restrict how we use it, or object to use based on legitimate interest
- hand your data over in a portable format
- withdraw a consent you gave, with effect from now on
How to use them: write to matt@marketingled.com. We answer within 30 days and it costs you nothing. To delete your account and everything attached to it, see deleting your account.
If you think we handled your data badly, you can complain to a supervisory authority. In Germany that is the authority of the state you live in; in other EU countries, your national authority.
8. How long we keep it
| What | How long |
|---|---|
| Account and sign-up answers | Until you ask us to delete them |
| Pages read and time visible | 24 months |
| Email opens and clicks | 24 months |
| Sign-in codes | One hour, then they expire |
| Server logs | Up to 30 days at our hosting provider |
| Unsubscribe record | Kept after deletion, so we cannot mail you again by accident |
9. How we protect it
Everything travels over HTTPS. There are no passwords to steal, because signing in uses a one-time code that expires. Access to the database is limited to the people who run the service, and the library sits behind the sign-in gate on the server, not merely hidden in the interface.
10. Children
This is a tool for people running businesses. It is not directed at children, and we do not knowingly collect data from anyone under 16. If you believe a child gave us data, write to us and we will delete it.
11. Changes to this policy
If something material changes, the version and date at the top change with it, and we tell you by email before it takes effect. Small corrections we make quietly.