Privacy Policy
This policy explains what personal data ANDATA LLC collects when you use Markets MRI, why we collect it, who we share it with and the choices you have.
Controller: ANDATA LLC ("ANDATA" MChJ), registration No. 3120144, TIN 312 790 752, 20A Akhmad Donish Street, Yunusabad District, Tashkent, Republic of Uzbekistan.
Privacy contact: support@marketsmri.com
1. Data we collect
Information you give us
- Account and contact details: name, work email, company, role, and the details you send in an application or support request.
- Decision inputs: the decision you want assessed, target market, your website and product information, and any documents, notes or evidence you add. This is business information, but it may contain personal data, for example names in pilot notes.
- Research approvals: the research briefs you approve or decline.
Information collected automatically
- Usage and device data: pages and features used, product events, timestamps, IP address, browser type and approximate location derived from IP.
- Cookies: strictly necessary cookies that keep you signed in and protect forms from abuse. We do not use advertising cookies or sell data to advertisers.
Information from third parties
- Payment information: Paddle processes your payment details as Merchant of Record. We receive the order, subscription status, country and billing email, but never your full card details.
- Public sources: when you give us a website or company, we collect publicly available information about that company to produce your analysis.
2. How we use it
| Purpose | Legal basis |
|---|---|
| Creating your account, signing you in and providing the service you ordered | Performance of our contract with you |
| Billing, invoicing, tax records and fraud prevention | Contract and legal obligations |
| Service emails such as sign-in links, report delivery and changes to terms | Contract |
| Keeping the service secure, debugging and improving product quality | Legitimate interests |
| Replying to enquiries and onboarding requests | Legitimate interests or steps before a contract |
| Occasional product updates, which you can opt out of at any time | Consent or legitimate interests, as local law requires |
We do not sell personal data. Our AI provider processes submitted material under business API terms that exclude its use for model training, and we do not use your content or decision inputs to train any models. We do not use your content to produce outputs for other customers.
3. Who we share it with
We share personal data only with service providers that process it on our behalf under contract, and only as needed to run Markets MRI:
| Provider | Purpose | Location |
|---|---|---|
| Paddle.com | Merchant of Record: checkout, payment processing, invoicing, tax and refunds | UK / EU |
| Supabase | Database, authentication and file storage | Cloud infrastructure, see Supabase's region settings |
| DigitalOcean | Application hosting | Amsterdam, Netherlands |
| OpenAI | Language-model processing used to analyse submitted material and draft outputs | United States |
| Resend | Transactional email, such as sign-in links and report notifications | United States |
The current list, including what data each provider handles, is kept on our Subprocessors page.
We may also disclose data where required by law or a valid order of a competent authority, to protect our rights or users' safety, or as part of a merger or acquisition subject to this policy.
4. Research respondents
Our research base includes interviews and research conversations with professionals. Outputs provided to customers contain aggregated, anonymised findings only and do not identify individual respondents. Respondents can contact us at the address above to exercise their rights over data held about them.
5. International transfers
Our providers may process data outside your country, including in the European Union, the United Kingdom and the United States. Where required, transfers rely on appropriate safeguards such as standard contractual clauses offered by those providers. We process personal data in line with applicable law, including the Law of the Republic of Uzbekistan "On Personal Data" and, where it applies to you, the EU and UK GDPR.
6. How long we keep it
- Account data and your content: for as long as your account is active, then deleted within 30 days of closure unless you ask us to delete it sooner.
- Billing and tax records: for the period required by tax and accounting law.
- Security and server logs: up to 90 days.
- Enquiries from people who did not create an account: up to 12 months.
7. Security
We use encryption in transit (HTTPS), access controls and row-level security on our database, restricted production access and regular backups. No system is perfectly secure, and we will notify you and the relevant authorities of a personal data breach where the law requires it.
8. Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise any of these rights, email support@marketsmri.com. We reply within 30 days. You can also complain to your local data protection authority.
9. Children
Markets MRI is a business service and is not directed at anyone under 18. We do not knowingly collect children's data.
10. Changes
We will post any changes on this page and update the date above. For material changes we will notify account holders by email. See also our Terms of Service.