Effective: 2026-10-27

Privacy Policy

Policy update notice Announced on 2026-10-20; effective from 2026-10-27. This revision clarifies Google integration data and AI processing without requesting new Google permissions. For dates before it takes effect, the policy effective 2026-05-14 continues to apply. On 2026-10-28 we added section 13 for the optional Messenger and Instagram connection; it does not change how other data is handled.

MARKHUB, Inc. ("Markhub", "we", "us") operates the website at markhub.ai and the related Markhub team-collaboration service (the "Service"). This Privacy Policy explains how we collect, use, share, and protect personal information, and the rights you have under Korean and U.S. privacy laws, including the Personal Information Protection Act ("PIPA") of the Republic of Korea and the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA/CPRA").

1. Information We Collect

We collect the following categories of personal information:

  • Account information: name, email address, profile photo, password (hashed), workspace and team identifiers.
  • Content you create: messages, comments, files, voice notes, todos, and other material you post to the Service.
  • Usage data: log-in times, feature usage, device type, browser, IP address, approximate location derived from IP, and cookies.
  • Payment data: billing contact and the last four digits of your card. Full card details are processed and stored by our payment processor (Stripe, Inc.).
  • Support communications: messages you send us via email, chat, or forms.

2. How We Use Your Information

We process personal information for the following purposes:

  • Provide, operate, secure, and improve the Service.
  • Authenticate users and prevent unauthorized access.
  • Process payments, manage subscriptions, and issue invoices.
  • Respond to support requests and communicate service-critical updates.
  • Generate aggregated analytics about Service usage.
  • Comply with legal obligations and enforce our Terms.

3. Legal Basis (PIPA / GDPR-style users)

Where required, we rely on (i) your consent, (ii) the necessity to perform a contract with you, (iii) compliance with a legal obligation, or (iv) our legitimate interests in operating and securing the Service.

4. Retention

  • Account information: for as long as your account is active, plus up to 1 year.
  • Payment records: 5 years (Korean Commercial Act, U.S. tax recordkeeping).
  • Server access logs: 3 months.
  • Support tickets: 3 years from closure.

You may request earlier deletion at any time, subject to retention required by law.

5. Sharing and Sub-Processors

We do not sell personal information. We share data only with:

  • Sub-processors we engage to operate the Service, currently Vercel Inc. (hosting, U.S.), Amazon Web Services, Inc. (storage, U.S.), Stripe, Inc. (payments, U.S.), Google (Gemini API), OpenRouter (AI request routing), and OpenAI, LLC and Anthropic, PBC (AI features, U.S.). The AI service and model host depend on the feature and the model selected for your workspace or agent. All sub-processors are bound by data-processing agreements.
  • Other members of your workspace, to the extent necessary to deliver the Service.
  • Authorities, where required by valid legal process.
  • A successor entity in the event of a merger, acquisition, or asset sale.

6. International Transfers

Your data may be transferred to and processed in jurisdictions outside your country of residence, including the United States and the Republic of Korea. We rely on Standard Contractual Clauses or equivalent safeguards where applicable.

7. Your Rights

Depending on your jurisdiction, you have the right to access, correct, delete, restrict, or port your personal information, to withdraw consent, and to lodge a complaint with a supervisory authority. California residents additionally have the rights to know, delete, correct, and limit the use of sensitive personal information, and the right to non-discrimination for exercising these rights.

To exercise any of these rights, email privacy@markhub.ink. We will respond within the time period required by applicable law.

8. Cookies

We use first-party cookies for authentication and language preference, and aggregated analytics cookies. You can control cookies through your browser settings.

9. Security

We apply industry-standard administrative, technical, and physical safeguards including TLS in transit, encryption at rest, role-based access control, and continuous monitoring. No method of transmission is 100% secure; we will notify affected users and authorities of any breach as required by law.

10. Children

The Service is not directed to individuals under 14 (Korea) or under 13 (United States, COPPA). We do not knowingly collect personal information from such users.

11. Changes

We may update this Policy. Material changes will be announced in-product or by email at least 7 days before they take effect.

12. Google Account Connections and AI Processing

Connecting a Google account is optional. We request access for the integration you choose, and use Google data to provide the corresponding features visible in Markhub. The following rules apply to Google data, including copies and information derived from it, in addition to the rest of this Policy.

Data accessed and its purpose

  • Account identification: Google account ID, email address and, where requested, name and profile photo identify the connected account and support sign-in and connection status. These are requested through OpenID Connect, email and profile permissions.
  • Gmail: the gmail.send permission sends an email you request and approve in Markhub. We process its recipients, subject, body and send result. This connection does not read, list or search your Gmail inbox, and does not request Gmail reading permission.
  • Google Calendar: the calendar.events permission retrieves events for your scheduling request and creates events you ask for. Event data may include the title, description, start and end times, time zone and event link. The permission does not grant calendar administration access.
  • Google Drive: the drive.file permission accesses files created by Markhub or selected by you through Google Picker, rather than all files in your Drive. We process their content and metadata, such as file ID, title, type, owner and modification time, to import files into a channel or create, read and edit the selected spreadsheets and other supported files.

AI services and sharing

When you ask an AI agent to work with connected Google data, the request, relevant conversation context, selected file content and necessary tool results may be sent to the AI service used for that feature. Our hosted AI features use the Gemini API and OpenRouter; OpenRouter routes requests to the selected model host. Available model families include Google, OpenAI, Anthropic, DeepSeek and Qwen. A model developer and the provider hosting its endpoint may differ. If you choose a connected local agent, the context you provide to that agent is also processed through that agent and its configured AI service. Google connection credentials are used by the integration server to call Google APIs, not supplied to the model as prompt content.

We use this processing to carry out the requested user-facing task. We do not use Google Workspace API data to develop, improve or train generalized or non-personalized AI or machine-learning models, and do not permit its transfer for those purposes. Keeping conversation history or task context for your use of Markhub is separate from training a general-purpose model. We do not sell Google data or use it for advertising, retargeting, creditworthiness or lending.

Importing a Drive file into a channel makes the imported copy and its resulting messages available to people with access to that channel. Emails are sent to the recipients you approve, and events are stored in the Google calendar you select. Apart from these user-directed actions, transfers are limited to providing the requested features with your consent, security purposes, legal requirements, or a business transfer with explicit prior user consent as required by Google policy. Human access to Google data is limited to your affirmative permission, necessary security investigation, legal requirements, or aggregated internal operations permitted by Google policy.

Storage, disconnecting and deletion

We store connection identifiers, granted permissions and encrypted access and refresh tokens to maintain the connection until you disconnect it or delete the account. Messages, draft cards, imported file copies and task results are stored as workspace content for the features you use. AI providers may retain data for security, abuse prevention and service operation under the terms of the service in use; this Policy does not promise zero retention by every provider.

Disconnect the service in Markhub to remove its stored connection and stop future access through it. You can independently revoke Markhub access in your Google Account connections. Disconnecting does not remove emails already sent, events already created, or imported copies and messages already stored in a workspace. Delete that content using the relevant service or ask privacy@markhub.ink for deletion, subject to applicable legal retention requirements. Workspace access controls and the security measures in section 9 also apply to Google data.

Markhub's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements, and the Google Workspace API User Data and Developer Policy.

13. Facebook Messenger and Instagram Connections

Connecting a Facebook Page or an Instagram business account is optional. A workspace owner or admin connects it in Markhub with Facebook Login, so that messages customers send to that Page or account appear in a Markhub channel and staff can reply from Markhub. The following rules apply to data received from Meta Platforms, in addition to the rest of this Policy.

Data received and its purpose

  • Connected accounts: the IDs and names of the Facebook Pages you choose to connect, the ID and username of the linked Instagram business account, and a Page access token, stored encrypted. We use them to show which accounts are connected, to receive their messages and to send the replies you write.
  • Customer messages: for each person who messages a connected Page or account, the Meta-provided ID for that person, their name and profile photo where Meta provides them, the message text, links to attachments, and timestamps. We show them in the channel you chose so your team can read and answer.
  • Replies: the reply your staff writes in Markhub and whether Meta accepted it. Markhub sends only replies written or approved in Markhub, and only within the reply window Meta allows. It does not send marketing or unsolicited messages.

Sharing and AI processing

Messages are visible to members who can access the channel that receives them. If you ask an AI agent to work with these messages, the relevant messages and context are processed as described in section 12 for AI services. We do not sell data received from Meta, do not use it for advertising or profiling, and do not use it to train generalized AI models. Our use complies with the Meta Platform Terms and Developer Policies.

Storage, disconnecting and deletion

Access tokens are kept until you disconnect the account or delete your Markhub account. Messages are kept as workspace content until they are deleted. To stop access, disconnect the account in Markhub (Tools, then Messenger or Instagram, then Disconnect), or remove Markhub in your Facebook settings under Business Integrations. Disconnecting deletes the stored token; messages already received stay in the channel until you delete them. People who messaged a business through Markhub can ask that business, or us at privacy@markhub.ink, to delete their messages. See Data Deletion Instructions for the steps.

14. Contact

MARKHUB, Inc., privacy@markhub.ink
For Korean PIPA inquiries, the Personal Information Protection Officer can be reached at the same address.