Marketing AIgency
Menu

Privacy Notice

Last updated: September 18, 2026 · 2026-09-18.1

Version 2026-09-18.1 | 18 September 2026 | marketing-aigency.com and app.marketing-aigency.com

1. Controller and contact

CBX Media LLC, Shams Business Center, Sharjah Media City Free Zone, Sharjah, United Arab Emirates, licence 2537521, represented by Laura Eva Bozic, General Manager. Privacy: privacy@marketing-aigency.com. Support: hello@marketing-aigency.com.

EU representative for privacy enquiries and regulatory correspondence: DIS-CONNECT GmbH, Gerwigstraße 29, 76131 Karlsruhe, Germany, info@dis-connect.de. Christian Bozic and Georg of Dis-Connect jointly handle the privacy mailbox. Dis-Connect does not operate attribution or have general access to customer accounts or databases.

2. Our own processing and customer instructions

CBX is controller for its website, user accounts, contracts, billing and communication. For personal data from customer advertising accounts, attribution, surveys and content, we process on the business customer’s instructions under a DPA. Visitors to a customer website should contact its operator; we assist them. This notice does not replace the customer’s notice.

3. Accounts, contracts, support and security

We process names, business email, company, workspace role, login/security data, booked services, contract/payment information and support messages. Sources are you, authorised workspace members, connected platforms and payment services. Card details are handled by the payment provider; we receive payment status and billing references.

Where GDPR applies, bases are Article 6(1)(b) for contracts with the individual; Article 6(1)(f) for communication/contract administration with corporate contacts, secure operations, abuse prevention and legal defence; and Article 6(1)(c) for legal billing, retention and evidence duties. Necessary particulars are required for account/service delivery; additional optional fields remain voluntary.

Hosting services process necessary connection information such as IP address, time and requested resource for delivery, security and troubleshooting. Optional advertising/analytics events are separate. Any own aggregate reach measurement is limited to necessary page/referral and coarse device/country information without persistent visitor identifiers; its initial processing is not automatically anonymous. The basis is our legitimate interest in an operational website; device access requiring consent remains subject to your choice.

4. Providers and international processing

Vercel and Supabase provide hosting/database functions; booked AI uses Anthropic and optional transcription ElevenLabs. GitHub may operate automated jobs and encrypted backups. Addresses, functions and processing are set out in DPA Schedule C supplied with these documents. Technical providers are contractually bound as required.

Payments use Stripe Payments Europe, Limited (Ireland) and necessary payment/verification partners; see Stripe privacy. Email uses Google services. Our own bookkeeper is Buchhaltung International FZE, Business Centre, Sharjah Publishing City Free Zone, Sharjah, UAE. Professional advisers, authorities and courts receive information only on a necessary legal basis. Payment services and advisers may be independent controllers for their own statutory purposes.

Core infrastructure is in Frankfurt; necessary CBX access is from the UAE. International providers may also process in the USA, Singapore and countries in their provider chains. EU hosting does not exclude remote access or onward transfers. Where GDPR Chapter V requires safeguards, we use an effective basis appropriate to the flow and necessary supplementary measures, including suitable SCCs or an applicable adequacy decision. EU-US Data Privacy Framework certification covers only included recipients/operations, not CBX’s UAE processing. Request details and a copy of relevant safeguards at privacy@marketing-aigency.com. A transfer without its required basis does not start or is suspended.

5. Website analytics and advertising

Analytics and advertising are separately selectable. Optional tags/pixels and associated server-side events remain blocked before the relevant consent. Refusal does not affect contracted services. Bases are GDPR Article 6(1)(a) and, where device consent is required, section 25(1) German TDDDG. Change your choice at any time through “Privacy choices” or cookie settings in the website footer. Withdrawal applies to the future.

Google Analytics 4: With analytics consent, GA4 measures visited pages, sources and usage. It processes page/event data, a random identifier, device/browser details, coarse region and technically necessary IP information. Google states that GA4 does not log or store IP addresses. _ga and _ga_* cookies identify visits/sessions, by default for up to two years. Our property’s user/event retention is limited to 14 months. Recipients can include Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google privacy, data processing terms.

Planned advertising services: Google Ads, Meta/Facebook Ads including Meta Pixel, and TikTok Ads including TikTok Pixel are envisaged for conversion measurement and advertising optimisation. This does not mean all are already installed. A service remains inactive until its specific purposes, recipients and lifetimes are described in cookie settings and you permit it. Authorised processing particularly includes sanitised page/conversion events, click and online identifiers and device/browser information. Personalisation, audience matching and additional server-side conversions are explicitly described before use.

Google Ads may involve the Google entities above. Meta recipients particularly include Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, and Meta Platforms, Inc., USA. TikTok entities depend on account, function and visitor region, particularly TikTok Pte. Ltd., Singapore, TikTok Technology Limited, Ireland, and TikTok Information Technologies UK Limited, UK. The specific activated recipient and any joint-controllership information are explained in the service-specific notice before selection. Meta privacy, TikTok business privacy.

Other platforms may be added after we describe their actual processing and obtain any required new consent. Earlier consent does not generally cover unknown future recipients. Google Signals, User-ID, enhanced conversions, advanced matching, list uploads and remarketing do not automatically follow from analytics consent. Hashing does not replace a legal basis. Logged-in areas containing customer content are excluded from our own advertising tracking.

6. Consent records and necessary storage

Necessary storage supports login, language, workspace and your privacy choice. Consent records include the choice, time, text version, a random evidence identifier and, where applicable, coarse country/device information. They demonstrate and implement the choice, not advertising; randomness does not make an identifier anonymous. The basis is GDPR Article 6(1)(c) with Article 7(1), where applicable. Records are normally retained for three years, longer only for a specific legal need, separate from marketing data.

7. Customer modules

Attribution processes authorised source/click identifiers, time, sanitised URL and possibly transient plaintext email for hashing. Surveys process voluntary answers and expressly agreed order fields. Conversion feedback requires recorded customer instructions and appropriate visitor consent. AI functions receive necessary campaign context and user inputs; optional speech is transcribed. We do not use this instructed data for our own personal advertising or model training. Customer agreements/DPAs define particulars, recipients and periods.

8. Retention

Account data are needed during use; document 04 governs export/deletion after termination. Raw lead/attribution and survey data normally last at most 90 days, AI chat normally 90 days, campaign/action logs at most twelve months and routine operational logs 30 days. Tokens are promptly revoked/deleted on disconnect or authorisation expiry. Backups expire no later than 30 days after active deletion. Contract/consent evidence normally lasts three years after the relevant operation ends; legally required records follow the applicable statutory period. Specific disputes may require bounded, separate evidence preservation. Earlier valid deletion claims and loss of purpose remain relevant.

9. Your rights

Statutory rights include access, correction, deletion, restriction and portability. You may withdraw consent for the future at any time. You may object to GDPR Article 6(1)(f) processing on grounds relating to your situation, and to direct marketing at any time. Contact privacy@marketing-aigency.com or our EU representative. You may complain to a competent supervisory authority, particularly at your residence, workplace or the place of an alleged infringement. The relevant customer controls instructed customer data; we forward and assist with requests.

AI suggestions and campaign actions serve agreed advertising management. This does not describe a solely automated decision about an individual with legal or similarly significant effects. New functions with different purposes/effects are explained beforehand. Material notice changes are announced on the website and additionally where necessary; required new consent is obtained before new processing.

Website addendum (19 September 2026)

These points apply to marketing-aigency.com in addition to the notice above and will be folded into its next version.

Demo-call calendar (Cal.com)
The booking calendar on the start page is provided by Cal.com, Inc., San Francisco, USA. It loads only after you press “Load the calendar”; before that nothing is sent to Cal.com. When it loads, your browser transmits the usual connection data (IP address, browser, time) to Cal.com, and anything you enter to book a call goes to Cal.com and to us. Legal basis: Art. 6(1)(b) GDPR for the booking itself and Art. 6(1)(f) for showing the calendar you asked for. Cal.com participates in the EU-US Data Privacy Framework; its privacy notice is at cal.com/privacy.
Cookie-free page counting
Independently of your consent choice we count page views. For each view we store the day, the page path, the domain the visit came from (never the full address), the device type (phone, tablet, desktop) and the country, as a daily sum. No cookie is set, nothing is read from your device, no IP address and no identifier is stored, so two views cannot be linked to one person. Legal basis: Art. 6(1)(f) GDPR, our interest in knowing how many people visit which pages.
Record of your consent choice
When you decide in the consent dialog we store the time, your choice, the version of the dialog shown, your country, device type and browser string together with a random identifier that is also saved in your browser (local storage and a cookie named maig_consent, valid one year). This is our evidence under Art. 7(1) GDPR. Google Analytics only loads after this record has been written. Withdrawing consent switches Analytics off immediately in the running page and deletes its cookies.
Funnel events from our servers
If, and only if, you accepted Google Analytics on this website, our servers report five milestones of your account to Google Analytics (registration completed, order summary viewed, order submitted, ad account approved, calibration completed) under the same random identifier, without names, e-mail addresses or workspace identifiers. If you chose “essential only”, none of these events is sent.