Privacy Policy

Market4U (“we”, “our”, “the Service”) is operated by ecremmoce Corp. (주식회사 이크레모스, also romanized as LEEKEUREMOSEU CO.,LTD.), 204 Convensia-daero, Yeonsu-gu, Incheon 22004, Republic of Korea. This Privacy Policy explains what information we collect when you use Market4U to generate and publish marketing content, how we use it, and your rights regarding that information.

1. Information We Collect

• Account information: name, email address, organization, and authentication identifiers issued by our identity provider.
• Connected channel credentials: OAuth access tokens and refresh tokens for third-party platforms (Shopee, Facebook, Instagram, Threads, TikTok, YouTube, Pinterest, X, Bluesky, LinkedIn, Telegram) that you explicitly connect. Tokens are encrypted at rest using PostgreSQL pgcrypto and are accessible only to the service-role process performing your authorized publish actions.
• Product data: product names, descriptions, images, prices, and metadata you import from connected seller accounts (e.g., Shopee).
• Generated content: text copies, images, and videos produced on your behalf by AI providers.
• Operational logs: API call timestamps, error messages, and asset references needed to operate queues, retries, and billing.

1-1. Cookies and Similar Technologies on Your Device

Market4U stores, accesses, and collects information on your device and browser, and allows the third parties listed below to do so, using cookies and similar technologies (browser local storage and session storage):

• Sign-in cookies (Market4U, set through Supabase Auth) — strictly necessary cookies that keep you signed in and protect your session. Without them the dashboard cannot work.
• Browser local storage (Market4U) — your on-screen preferences, such as list view mode, narration voice settings, and unsaved editor drafts. These stay in your browser and are not sent to us unless you save them.
• Customer support chat (Channel Talk, channel.io) — the support chat widget places its own cookies and local storage to keep your chat conversation and to recognize your browser when you return.
• Sign-in and connection providers — when you sign in with or connect Google/YouTube, Kakao, Naver, TikTok, Meta, Pinterest, X, or LinkedIn, those providers set and read their own cookies on their own domains under their own privacy policies (for Google, see Google Privacy Policy).

We do not use advertising cookies or cross-site tracking pixels. You can delete or block cookies and local storage in your browser settings at any time; if you block the sign-in cookies, you will not be able to stay signed in.

2. How We Use Information

• To generate marketing content (copy, images, videos) using AI providers under your direction.
• To publish content to the third-party channels you have connected, on the schedule you configure.
• To improve the reliability of the Service (error analysis, capacity planning, fraud prevention).
• To communicate operational notices such as failed publish attempts or token expirations.

3. Third-Party Processors

We rely on the following processors to operate the Service:

• Supabase (database, storage, authentication)
• Vercel (application hosting, cron jobs)
• Google Gemini and Higgsfield (AI text/image/video generation)
• fal.ai (alternative AI video generation)
• Shopee Open Platform, Meta Graph API, Threads API, TikTok Content Posting API, YouTube Data API, Pinterest API v5, X API v2, Bluesky AT Protocol, LinkedIn Share on LinkedIn API, Telegram Bot API (publishing endpoints)

Data is shared with these processors only to the extent required to perform the action you initiated. We do not sell your data, and we do not use connected channel data to train AI models.

4. Data Retention

We retain account, product, and generated content data for the duration of your subscription and for a reasonable period afterward to support audit and dispute resolution. You may request deletion of your data at any time by contacting james@ecremmoce.io. Connected channel tokens are deleted immediately when you disconnect a channel.

5. Security

All traffic is served over TLS. Channel access tokens are encrypted at rest. Access to production data is restricted to authorized engineers and audit-logged. We will notify affected users without undue delay in the event of a confirmed data breach.

6. Your Rights

Depending on your jurisdiction (GDPR, CCPA, PIPA in Korea), you may have the right to access, correct, export, or delete your personal information, and to object to processing. To exercise these rights, contact james@ecremmoce.io.

7. Children

The Service is not directed to children under 14 and we do not knowingly collect their data.

8. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email and reflected on this page with a new “Last updated” date.

9. TikTok Integration (Content Posting API)

When you connect a TikTok account, we request the following OAuth scopes and process the corresponding data strictly to deliver the publishing features you initiate.

• user.info.basic — to display your connected TikTok username and avatar in the dashboard so you can confirm which account you are publishing to.
• video.upload — to upload AI-generated short product videos to your TikTok inbox (drafts) for review and final publishing inside the TikTok app.
• video.publish — to publish AI-generated short product videos with operator-approved captions (including legally required advertisement disclosure) directly to your TikTok account.
• video.list, user.info.profile, user.info.stats (requested once TikTok approves them for our app) — to show the performance of your recent videos, your real username (so links to your posts are correct), verification status, and follower, following, like, and video counts for your own account.
• TikTok for Business (video.list, comment.list, comment.list.manage) — if you connect a TikTok Business account for the inbox, to show comments on your own videos and post the replies you approve.

We do not store TikTok video content on our servers after upload completes; we retain only post metadata (publish_id, permalink, publish timestamp) for tracking and for your dashboard view. We do not share TikTok user data with third parties, do not use it for advertising profiling, and do not use it to train AI models. You can revoke our access at any time by disconnecting the TikTok channel in your dashboard or by removing the authorization at TikTok > Settings > Manage Apps. Upon disconnection, all stored TikTok access tokens are deleted immediately.

10. YouTube / Google Integration (YouTube Data API)

When you connect a YouTube channel, Market4U uses the YouTube Data API Services and requests the following Google OAuth scopes strictly to deliver the publishing features you initiate:

• youtube.upload — to upload AI-generated short product videos to your channel.
• youtube.readonly — to read your channel and video metadata (e.g., upload status, video ID, watch URL) so we can show publish results in your dashboard.
• youtube.force-ssl — to set the custom thumbnail and post an operator-approved comment (such as your store link) on the video you just published.
• userinfo.email, userinfo.profile, openid — to identify the connected Google account so you can confirm which channel you are publishing to.
• yt-analytics.readonly — to show views, watch time, and audience retention for your own channel and videos in Channel Insights and the Shorts diagnosis.
• yt-analytics-monetary.readonly, youtube.channel-memberships.creator(requested only after Google verifies them for our app) — to show your own channel's revenue figures and your channel members list in Channel Insights.

Thumbnail impressions and click-through rate (YouTube Reporting API). When the connected channel has granted yt-analytics.readonly, Market4U creates two YouTube Reporting API report jobs on that channel (channel_reach_basic_a1 and channel_reach_combined_a1). These jobs only ask YouTube to generate daily reports of your own videos’ thumbnail impressions and click-through rate; they do not change your videos or channel information. We download these reports once a day while the channel stays connected and store only per-video daily impression counts and click-through rates to show them in Channel Insights. You can ask us to delete the report jobs at any time.

Market4U’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use YouTube/Google user data only to provide the user-facing publishing features described above; we do not transfer or sell it, do not use it for advertising, and do not use it to train AI models. Our use of YouTube API Services also complies with the YouTube Terms of Service and the Google Privacy Policy. We do not store your video content after upload completes; we retain only post metadata (video ID, watch URL, publish timestamp). You can revoke Market4U’s access at any time by disconnecting the channel in your dashboard or at Google Account > Third-party access. Upon disconnection, all stored Google tokens are deleted immediately.

How long we keep YouTube API data.Video statistics (views, likes, comments) for videos you published through Market4U are refreshed from the YouTube API several times a day for 30 days after publishing; if a video's statistics have not been re-verified for 30 days, we delete them. Thumbnail impression and click-through reports are downloaded once a day while the channel stays connected. Comments shown in your inbox and caption reports are deleted 30 days after we fetched them. Your authorization is re-checked every hour when we refresh the access token. When you disconnect the channel, we delete the channel's stored YouTube API data within 1 day. You can also ask us to delete your stored YouTube API data at any time by emailing james@ecremmoce.io; we complete the deletion within 7 calendar days. Deleting data from Market4U does not delete your videos, comments, or any other data on YouTube itself.

11. Meta Integration (Instagram & Facebook)

When you connect a Facebook Page and its linked Instagram professional account, Market4U uses the Meta Graph API (and the Instagram API with Instagram Login). Every connection requests the publishing permissions below. The additional permissions further below are requested only after Meta approves them for our app, and each one is used only for the feature named next to it, for your own connected accounts:

• Publishing (all connections)— instagram_basic, instagram_content_publish, pages_show_list, pages_read_engagement, pages_manage_posts (and instagram_business_basic, instagram_business_content_publish for Instagram Login): to confirm your account and Page and publish the posts, Reels, and Page videos you approve. publish_video is used only to publish the videos you approve to your Page (Meta’s Pages API asks for it for video posts); Market4U does not broadcast live video.
• Inbox (comments and messages) — instagram_manage_comments, instagram_business_manage_comments, instagram_manage_messages, instagram_business_manage_messages, instagram_manage_engagement, pages_messaging, pages_manage_metadata, pages_read_user_content, pages_manage_engagement, pages_utility_messaging, pages_user_locale, pages_user_timezone, and the Human Agent feature: to show comments and direct messages your accounts receive and send the replies you approve (automatic replies only where you turn them on; we never start unsolicited conversations).
• Insights — read_insights, instagram_manage_insights, instagram_business_manage_insights: to show reach and engagement for your own accounts and posts.
• Content management — instagram_manage_contents, instagram_manage_upcoming_events: to manage (for example hide or delete) your own posts and event reminders when you ask.
• Shopping and partnerships — catalog_management, instagram_shopping_tag_products, instagram_branded_content_brand, instagram_branded_content_ads_brand, instagram_branded_content_creator, instagram_creator_marketplace_discovery, instagram_creator_marketplace_messaging, facebook_branded_content_ads_brand, facebook_creator_marketplace_discovery: to show the product catalogs your Business owns and add a product to a catalog when you confirm it on screen (catalog_management), to tag products from your own Shop catalog in posts you publish, and to manage branded-content partnerships you choose.
• Ads and leads— ads_read, ads_management, business_management, ads_mcp_management, pages_manage_ads, leads_retrieval: to show your own ad accounts, recent ad performance, Meta's Opportunity Score and delivery errors (read-only, via Meta's Ads MCP server), your Page's ad posts, and the leads your own lead forms collect. Campaign changes (pause/resume) happen only after you confirm them on screen; we never change campaigns through the Ads MCP server. Leads are shown to you in your dashboard and are not stored by Market4U.

We do not request permissions for features we have not built, and we do not use Meta data from one seller for another seller.

We do not store your Meta, Instagram, or Facebook content after publishing completes; we retain only post metadata (media/post ID, permalink, publish timestamp). We do not sell Meta user data, do not use it for advertising profiling, and do not use it to train AI models. You can revoke access at any time by disconnecting the channel in your dashboard or at Facebook > Business Integrations. Upon disconnection, all stored Meta access tokens are deleted immediately.

Inbox data (comments and messages your customers send you).To show them in your Inbox and to draft replies, we store the comments and direct messages your connected accounts receive: the message text, the sender's name or username and platform ID, the post it belongs to, timestamps, and the reply you sent. Only your organization can see them. We delete each item 90 days after we received it, and we delete all inbox items of an account within 1 day after you disconnect it. Replies outside the platform's messaging window are blocked on our server; a human agent reply (where the platform allows it) can only be sent by a person on your team, never by AI or automation.

Deleting your Meta data. You can request deletion in any of three ways: (1) disconnect the channel in your Market4U dashboard, (2) remove Market4U at Facebook > Settings > Business Integrations, which sends a deletion request to our data deletion callback at https://market4u.ai/api/m4u/meta/data-deletion, or (3) email james@ecremmoce.io. In every case we delete the connected Facebook, Instagram, and Threads account records and all associated access tokens immediately, and the callback returns a confirmation code you can use to verify the deletion status.

12. Threads Integration (Threads API)

When you connect your Threads profile, Market4U requests threads_basic (to show your connected Threads username and profile picture in the dashboard so you can confirm the destination) and threads_content_publish(to publish the product video and caption you review and approve by clicking “Post to Threads”). We never post without that click. We also request threads_manage_insightsto show views, likes, replies, and reposts of the posts you published through Market4U, and your profile's totals, in your dashboard. We keep only the Threads user ID, username, access token, and post metadata (post ID, permalink, timestamp). Deletion works the same way as described in section 11, including the Meta data deletion callback.

13. Pinterest Integration (Pinterest API v5)

When you connect a Pinterest business account, Market4U requests user_accounts:read (to show the connected account), boards:read (to let you choose the destination board), boards:write (required by Pinterest to save a new Pin to the board you choose; we do not create, rename, or delete boards), pins:read (to confirm the Pin you created), and pins:write(to create a Pin with your AI-generated product image or video, title, description, and a link to your own product page). Pins are created only when you publish them. We store only the account ID, username, access and refresh tokens, and Pin metadata (Pin ID, board ID, link, timestamp). We do not read or store other users' Pins, and we do not use Pinterest data for advertising profiling or AI training. You can revoke access by disconnecting Pinterest in your dashboard or in Pinterest > Settings > Security and logins > Apps; tokens are deleted immediately on disconnection.

14. X, Bluesky, LinkedIn, and Telegram

• X (Twitter): tweet.read, tweet.write, tweet.moderate.write, users.read, users.email, media.write, offline.access — to post the text and media you approve and hide replies on your own posts; dm.read, dm.write — to show direct messages your account receives and send the replies you approve (never unsolicited DMs); like.read, like.write, follows.read, follows.write, list.read, list.write, bookmark.read, bookmark.write, mute.read, mute.write, block.read, block.write, space.read, broadcast.read, broadcast.write — to show and manage, at your request, your own account's likes, follows, lists, bookmarks, mutes, blocks, Spaces, and live broadcasts. We never follow, like, or message other accounts automatically without your approval.
• Bluesky: an app password you create in Bluesky settings — to post to your own account. You can revoke it in Bluesky at any time.
• LinkedIn: openid, profile, email, w_member_social — to show your LinkedIn name and post the content you approve to your own LinkedIn profile. As LinkedIn approves the related products for our app, we also request: r_organization_social, w_organization_social, r_organization_admin, rw_organization_admin (to post to and read engagement for Company Pages you administer), r_events, rw_events (to list and create events for your Company Page), r_ads, r_ads_reporting, rw_ads (to show your LinkedIn ad accounts and campaign performance and make campaign changes only after you confirm them). If LinkedIn approves Lead Sync, Conversions, and Matched Audiences for our app, leads from your own lead forms are shown only within your organization, conversion events are sent only from your own store, and any audience data you upload is hashed before sending; we never combine one seller's data with another's.
• Telegram: a bot token you provide — to post to a channel where your bot is an administrator.

For all channels we store only the tokens required to publish and the resulting post metadata, never sell the data, never use it to train AI models, and delete tokens immediately when you disconnect the channel.

15. Contact and Privacy Officer (개인정보 보호책임자)

Ecremmoce — james@ecremmoce.io

개인정보 보호책임자: 대표이사 (연락처 james@ecremmoce.io). 개인정보 열람·정정·삭제·처리정지 요청과 고충 처리는 위 연락처로 받습니다. Privacy Officer: Chief Executive Officer (same contact).