MarketinistPrivacy Policy
Last updated: 2026-10-05
This explains what Mark collects, why, and who else sees it. The controller of your data is Always True, Unipessoal Lda., Avenida da Guarda Inglesa - n. 27, Santa Clara 3040-193, Coimbra. For anything in this policy, including a request about your own data, contact contact@alwaystrue.io.
What we collect
| Your Telegram identity | Your numeric Telegram user ID and your @username. That’s the whole of it — we don’t store your name, phone number, or profile photo. The username is kept so we can still recognise you if the ID we were given at sign-in doesn’t match the one the bot sees. |
| Your email address | Only if you subscribe — it comes from Stripe’s checkout page. Used for receipts and for anything important about your account. We don’t market to you. |
| What you tell Mark | Your messages, including any photos and voice notes you send; your brand profile (what your business does, tone, topics, goals, things never to say, sample copy, and the links you want used); and the drafts, images, and posts produced from them. |
| Your existing posts — only if you ask | If you ask us to, we fetch up to 15 recent posts from each account you connect and use them to work out how you write. We keep a copy so we can show you what we based it on; you can delete them at any time from your business’s page, and they go when your account does. We never do this unless you say yes, and we never post anything to those accounts without your approval. |
| Posts you publish without us — only if you ask | If you switch cross-posting on, we check the accounts you have connected every couple of hours during the day to see what you posted directly, so we can offer to put it on your other accounts too. We keep a record of which posts we have looked at and what we decided — not the posts themselves — and anything we offer to relay becomes a draft you approve or discard like any other. Nothing goes out without your approval. Switch it off any time and we stop checking; the record goes when your account does. |
| Comments on your posts — only if you ask | If you switch comment replies on, we check the accounts you have connected every couple of hours during the day for new comments on your own posts, and bring you each one with a reply written for you to approve. To do that we keep the comment’s text and the commenter’s display name, so you can read what you are approving a reply to and so we can tell you why we suggested what we did. We never reply to anyone without your approval, we only ever look at comments on your own posts, and we do not read direct messages. Switch it off any time and we stop checking; the record goes when your account does. |
| Messages you ask Mark to pass to us | If you ask Mark to send something to the people who make it — a problem, a complaint, an idea — it shows you the exact wording and sends it only when you say so. We keep what you sent and what we replied, so that we can answer you and so that the next reply can see the last one. The messages are about your account and your business, they are read by the person who runs Mark, and they go when your account does. |
| Your website and documents — only if you ask | If you hand Mark pages of your own website, a document (a PDF, a Word file, a text file) or a note, we read it once, tidy the text with a model call, and keep that text — and the file, if there was one — so Mark can write from it for that business and nothing else. We read only your own site, up to ten of its pages at a time, and we never keep a file you sent without asking us to. Everything kept is shown on your business’s page, where you can remove any of it at once; it goes when your account does. Please don’t hand over documents with other people’s personal data in them. |
| Connected accounts | A reference to the social accounts you connect, and, for a blog, whatever that kind of site needs us to hold: a site address and an application password, an API key and the id of the site it belongs to, or a URL and a signing secret. Credentials are encrypted at rest and are never shown back to you or to anyone else. |
| Your site in Google search — only if you connect it | If you connect Google Search Console, we read how your website does in Google search — the searches it appears for, and the clicks and impressions page by page — to choose and refresh your articles. We keep those figures and the access Google grants us, encrypted at rest. Disconnect it any time and we stop reading; closing your account revokes the access. |
| Billing records | Your Stripe customer and subscription identifiers, your plan, and your usage history (how many posts, when). We never see or store your card details — those go straight to Stripe. |
| Technical logs | Server logs of requests and jobs, for debugging, security, and abuse prevention. |
Cookies
Three, all set by us and all HTTP-only: a sign-in cookie that keeps you logged in for 30 days; a short-lived sign-in-in-progress cookie that lasts ten minutes and protects the Telegram login round trip; and, only if you choose a language on this site, a language cookie that remembers it for a year. The first two are strictly necessary; the third is there because you asked for it.
There is no analytics, advertising, or third-party tracking on this site, and no cookie banner, because there is nothing to consent to beyond the three above.
Why we’re allowed to process it
- To perform our contract with you — running the Service: drafting, generating, scheduling, publishing, and billing.
- Our legitimate interests — keeping the Service secure, preventing abuse, and debugging failures.
- Legal obligation — keeping records of payments for as long as accounting and tax rules require.
Who else processes it
Mark is built on other people’s services, and running it means sending them the parts they need. Several are outside the EEA; transfers rely on the safeguards in those providers’ terms (typically Standard Contractual Clauses).
| Telegram | Delivers the chat, and provides sign-in. Sees your messages to the bot. |
| Anthropic | Writes the copy. Receives your messages and brand profile as prompts. |
| Generates images. Receives image prompts. | |
| Google Search Console | Only if you connect it: reports how your website does in Google search. Receives the request for your site’s figures. |
| DataForSEO | Tells Mark how often people search for the subjects your articles could cover. Receives those search terms, your country and language, and the addresses of any competitors’ sites you have named. |
| OpenAI | Transcribes voice notes and produces spoken replies. Receives the audio. |
| Zernio | Connects your social accounts and posts to them. Receives the content being published. |
| Stripe | Takes payment. Holds your card details and billing email; we don’t. |
| Cloudflare (R2) | Stores images and voice notes. |
| Railway | Hosts the application and its database. |
Publishing to your own website or social accounts sends content to those platforms, under their privacy policies rather than ours.
What we don’t do
- We don’t sell your data, or share it for advertising.
- We don’t use your content to train our own models.
- Our AI providers state that they don’t train on data submitted through their APIs. That’s their commitment rather than ours, and their terms can change — check them if it matters to you.
How long we keep it
- Your account, brand profile, drafts and media: while your account exists.
- Copies of your own posts, if you asked us to read them: while your account exists, or until you delete them — whichever comes first.
- Active conversation context: a short rolling window, held in memory and refreshed as you talk.
- Billing and usage records: kept as long as accounting and tax rules require, even after you close the account.
- Logs: a short retention window, then discarded.
You can close your account yourself from your account page. It asks you to sign in with Telegram again, then a few questions about why. When you confirm, every connected social account, blog and Search Console connection is disconnected at once, anything scheduled is cancelled, and any subscription is cancelled without a refund of the rest of the period. Your posts, articles, brand and settings are kept for 7 days in case you change your mind and reopen it; after that they are deleted, along with your images and your conversation history.
Two things outlive the account. First, one record kept for 200 days in case a card payment is disputed with your bank: your email, your Telegram user ID and username, which plan you had and when, when you used Mark and what you approved, the addresses of the posts we published for you, any messages you exchanged with our team, which terms were in force, and the closure request itself. It never contains your posts, your articles, your images, your settings or any credential. Second, your answers to the closing questions, kept with nothing that identifies you, so we can understand why people leave. You can also ask us to close the account by email and we will do the same.
Your rights
If you’re in the EEA or UK, you can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable form. Email contact@alwaystrue.io and we’ll respond within one month. You can also complain to the data protection authority in Portugal or where you live.
Automated content
Mark writes drafts automatically, but it doesn’t make decisions about you, and nothing it produces is published without your approval.
Children
The Service isn’t for anyone under 18, and we don’t knowingly collect their data.
Changes
If this policy changes in a way that matters, we’ll tell you before it takes effect. The date at the top always reflects the current version.