← Back to Mark

Privacy Policy

This Privacy Policy explains how BERKANA INFORMATION TECHNOLOGY CONSULTANTS L.L.C ("we", "us"), Office 13F-A-06, Business Bay, Dubai, United Arab Emirates, collects, uses and protects personal data in connection with the Mark service and website (the "Service"). We are the data controller for the data described below.

1. Data we collect

• Data you provide: name, company or project name, role, contact details (email, phone or Telegram), and information submitted through our forms or during onboarding.
• Account data: login identifiers and authentication data.
• Billing data: agreed rates, measured operational activity, transaction history and partial card details. Full card numbers are processed by our payment provider and are never stored by us.
• Usage data: log data, device and browser information, IP address, and interactions with the Service.
• Customer content: data you or your team upload or connect to the Service, which may include contact details of your own leads and customers.

2. How we use data

We use personal data to:

• provide, operate, secure and improve the Service;
• create and administer accounts, and process billing and payments;
• respond to enquiries, schedule calls and provide customer support;
• send service, billing and security notifications;
• comply with legal, tax and regulatory obligations, and prevent fraud or abuse.

We rely on the performance of our contract with you, our legitimate business interests, your consent (where required, for example for marketing messages), and compliance with legal obligations as our lawful bases for processing.

3. Sharing with third parties

We do not sell personal data. We share it only with service providers who process it on our behalf under written agreements — including payment processing, cloud hosting and infrastructure, communication and messaging platforms, and analytics. We may also disclose data where required by law, court order or a competent authority, or in connection with a merger, acquisition or reorganisation.

4. International transfers

We are based in the United Arab Emirates and our providers may process data in other countries. Where personal data is transferred across borders, we take steps to ensure an appropriate level of protection through contractual safeguards with our providers.

5. Retention

We keep personal data for as long as needed to provide the Service and for a reasonable period afterwards, and longer where required to meet legal, accounting or tax obligations or to resolve disputes. Customer content is deleted or returned on request after termination, subject to those obligations.

6. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit, access controls and least-privilege permissions. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Your rights

Subject to applicable law, you may request access to your personal data, correction of inaccurate data, deletion, restriction of or objection to processing, a copy of your data in a portable format, and withdrawal of consent at any time. To exercise these rights, contact us using the details below. We may need to verify your identity before responding.

8. Cookies

We use cookies and similar technologies that are necessary to operate the Service (for example to keep you signed in) and, where permitted, to understand usage and improve performance. You can control cookies through your browser settings; disabling essential cookies may affect functionality.

9. Children

The Service is intended for business use and is not directed to children under 18. We do not knowingly collect personal data from children.

10. Changes to this Policy

We may update this Policy from time to time. The revised version will be posted here with an updated "Last updated" date, and we will provide notice of material changes where required.

11. Google user data

Mark AI (the "Service") can connect to a broker's Google Calendar when the broker explicitly grants access through Google's consent screen. This section describes how we handle data received from Google APIs.

• What we access: the OAuth refresh token issued by Google; the email address and account type reported by Google; and busy/free time spans on the broker's primary calendar for the dates we ask about. We also create, update and cancel calendar events on that calendar for the meetings the Service schedules. We never read the content of the broker's existing events and never access any other calendar.
• How we use it: solely to provide the scheduling features of the Service — matching a prospective client's enquiry to the broker's availability, booking a video call, and reminding both parties shortly before it begins.
• How we store and protect it: in a PostgreSQL database on a private virtual server. OAuth refresh tokens are encrypted at rest (AES-128-CBC with HMAC-SHA256); access tokens are held in memory only. Backups are encrypted.
• How we share it: we do not sell Google user data and do not share it for advertising. It is transmitted back to Google only as needed to read availability and to create, update or cancel calendar events under the broker's own account.
• Retention and deletion: refresh tokens are retained until the broker disconnects or revokes access in their Google Account settings; on the next operation we detect the revocation and delete the stored token automatically. A broker may also request deletion by writing to the address in section 12.

Limited Use. Mark AI's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not used to develop, improve or train generalised or non-personalised AI and/or ML models.

12. Contact