Privacy Policy

mrk18 — CMO in your pocket

Effective date: 15 July 2026
Last updated: 15 July 2026

This Privacy Policy describes how Sipnshow Private Limited ("Sipnshow", "mrk18", "we", "us", "our") collects, uses, stores, shares, and protects your information when you use our website (mrk18.com), web application, mobile experiences, the mrk18 wearable/pocket device (the "Device"), and any related services (collectively, the "Services"). MRK18 is an AI marketing platform ("AI CMO") that advises on, analyses, and — with your authorisation — executes marketing activity on connected advertising accounts.

We are an India-first company. This Policy is designed to comply with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 and the SPDI Rules, 2011. Where you access the Services from outside India, additional terms in Section 13 apply.

By using the Services, you consent to the practices described in this Policy. If you do not agree, please do not use the Services.

1. Who We Are (Data Fiduciary)

For the purposes of the DPDP Act, the Data Fiduciary is:

• Entity: Sipnshow Private Limited (a company incorporated in India)
• Registered address: A-116, First Floor, URBTECH Trade Centre, Maharishi Nagar, Noida, Gautam Buddha Nagar – 201304, Uttar Pradesh, India
• Contact: mrk18ai@gmail.com
• Grievance Officer: Founder, Sipnshow Private Limited, reachable at mrk18ai@gmail.com (see Section 15)

2. Information We Collect

2.1 Information you provide directly

• Account data: name, email address, phone number, password, company/startup name, role.
• Waitlist and Founding 500 application data: responses you submit in application or waitlist forms, including details about your business, marketing goals, budget ranges, and challenges.
• Business and marketing context: information you share about your company, products, customers, positioning, goals, and strategy — via text or voice — so that mrk18 can give context-aware advice.
• Voice input: audio you speak to the web app or the Device, and the transcripts generated from it.
• Payment data: processed by our payment partners (e.g., Razorpay/Stripe or equivalent). We do not store full card numbers, CVV, or banking passwords on our servers. We retain transaction identifiers, plan type, billing name, and invoicing details.
• Communications: emails, support requests, feedback, and testimonials you send us.

2.2 Information collected when you connect marketing accounts

If you connect ad accounts, analytics, or marketing platforms (e.g., Meta Ads, Google Ads, analytics tools), we collect, with your authorization:

• Campaign structure, spend, performance metrics (impressions, clicks, CAC, conversions, ROAS and similar), audience configuration, and creative metadata.
• We access this data read-first: execution actions (launching or editing campaigns) occur only on your instruction and within your plan limits.
• You can disconnect any linked account at any time from your settings; we stop collecting new data from that source immediately.

2.3 Information collected by the Device

The mrk18 Device includes microphones and (in later versions) a camera. Because of this, we apply heightened safeguards:

• Listening modes. The Device supports a passive listening mode (wake-on-speech) and an active assistant mode. You control when the Device is on, and hardware/software indicators show when audio is being captured.
• Audio and transcripts. Captured audio is processed to produce transcripts and marketing-relevant insights. Where feasible, processing occurs on-device or is minimized; raw audio is retained only as long as needed for transcription and quality assurance, then deleted per Section 8.
• Third-party voices. In meetings, the Device may capture the voices of people around you. You are responsible for obtaining any consent required from other participants before recording them, in accordance with applicable law and basic courtesy. We provide in-product prompts and indicator lights to support this.
• Handshake feature. If you enable Handshake (proximity-based founder matching), the Device shares a limited profile (name, company, stated intent) with nearby mrk18 users only after both parties opt in to a specific introduction. Location/proximity signals used for Handshake are ephemeral and not used to build a movement history.
• Sensors. Battery, connectivity, and diagnostic data are collected to keep the Device functioning and improve reliability.

2.4 Information collected automatically

• Usage data: features used, queries asked (text of prompts), session times, in-app actions.
• Device/technical data: IP address, browser type, operating system, device identifiers, crash logs.
• Cookies and similar technologies: see Section 11.

2.5 Information we do NOT intentionally collect

We do not seek, and ask that you do not submit: government IDs, financial account passwords, health data, or data about children. If such data appears incidentally in audio or connected accounts, we do not use it for any purpose and delete it where identified.

3. How We Use Your Information

We use your information to:

1. 1.Provide the core service — analyze your marketing data, generate advice, verdicts, content, scripts, competitor and USP analysis, and (on your instruction) execute campaigns.
2. 2.Personalize your experience — mrk18 maintains a per-account context memory so that answer #50 is sharper than answer #1. This memory is scoped to your account.
3. 3.Operate accounts and billing — authentication, subscription management, invoicing, plan limits.
4. 4.Communicate with you — service updates, onboarding, security alerts, and (with your consent) product news. You can opt out of marketing emails at any time.
5. 5.Improve the Services — aggregate, de-identified analytics on feature usage and model quality.
6. 6.Safety, security, and legal compliance — fraud prevention, abuse detection, enforcing our Terms, complying with law and lawful requests.

3.1 AI processing — what we do and don't do

• Your prompts, connected marketing data, and voice transcripts are processed by our AI systems (including fine-tuned models and third-party inference infrastructure) to generate responses.
• Your data is used to build your account's context and memory. It is not used to train our global models in a way that could reproduce your confidential business information for other customers.
• If we ever offer an option to contribute data to model improvement, it will be opt-in, clearly labeled, and revocable.
• AI outputs are generated content. See our Terms of Service for disclaimers regarding reliance on AI advice.

3.2 Data from Meta and Google platforms

Meta. Our access to and use of information obtained through Meta APIs (including the Meta Marketing API) complies with the Meta Platform Terms and Developer Policies. We request only the permissions needed to provide the Services (such as ads_management, ads_read, and business_management) and use that data solely to operate features you have enabled.

Google. Our use and transfer of information received from Google APIs (including the Google Ads API) to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google advertising data only to provide user-facing features within mrk18 and do not sell this data.

We do not use platform data for advertising to you, do not transfer it to data brokers, and do not use it for any purpose unrelated to the Services.

4. Legal Bases for Processing

Under the DPDP Act, we process your personal data on the basis of:

• Consent — given when you sign up, connect accounts, enable Device features, or submit forms. Consent requests are presented in clear, plain language, and you may withdraw consent at any time (Section 9).
• Legitimate uses as permitted under the DPDP Act — such as processing necessary for the purpose for which you voluntarily provided data, compliance with law, and responding to legal process.

For users in jurisdictions applying the GDPR or similar laws, we rely on: performance of a contract (Art. 6(1)(b)), consent (Art. 6(1)(a)), legitimate interests (Art. 6(1)(f)), and legal obligation (Art. 6(1)(c)).

5. How We Share Information

We do not sell your personal data. We share information only with:

1. 1.Service providers (Data Processors): cloud hosting, GPU/inference providers, transcription services, payment processors, email/communication tools, and analytics providers — each bound by contracts limiting use of your data to providing services to us.
2. 2.Connected platforms: when you instruct mrk18 to execute actions (e.g., launch an ad), we transmit the necessary data to that platform under your authorization.
3. 3.Handshake counterparties: only the limited profile described in Section 2.3, and only after mutual opt-in.
4. 4.Legal and safety: courts, regulators, or law enforcement where required by applicable law, or to protect the rights, safety, and property of mrk18, our users, or the public.
5. 5.Business transfers: in a merger, acquisition, financing, or sale of assets, your data may be transferred as part of the transaction, subject to this Policy's protections. We will notify you of any such change.

We may share aggregated or de-identified information (e.g., "X% of founders overspend on channel Y") that cannot reasonably identify you.

6. Data Security

We use industry-standard safeguards, including:

• Encryption in transit (TLS) and at rest for stored personal data.
• Access controls, least-privilege permissions, and audit logging for internal access.
• Isolation of each customer's context memory from other accounts.
• Vendor due diligence for processors handling personal data.
• Incident response procedures. In the event of a personal data breach affecting you, we will notify you and the Data Protection Board of India as required under the DPDP Act.

No system is perfectly secure. You are responsible for keeping your login credentials confidential.

7. Your Rights

Subject to applicable law, you have the right to:

• Access — obtain a summary of the personal data we hold about you and our processing activities.
• Correction and updating — fix inaccurate or incomplete data.
• Erasure — request deletion of your personal data (see Section 8 for what deletion covers).
• Withdraw consent — at any time, with effect going forward (Section 9).
• Grievance redressal — raise a complaint with our Grievance Officer (Section 15) and, if unresolved, with the Data Protection Board of India.
• Nominate — nominate an individual to exercise your rights in the event of death or incapacity, as provided by the DPDP Act.

To exercise any right, email mrk18ai@gmail.com from your registered email address. We will verify your identity and respond within the timelines required by applicable law.

8. Data Retention and Deletion

• Account data: retained while your account is active.
• Business context and memory: retained while your account is active, so advice keeps improving; deleted on account deletion.
• Raw audio: retained only for the period needed for transcription and quality checks — no longer than 30 days — then deleted. Transcripts persist as part of your account context unless you delete them.
• Connected marketing data: refreshed on sync; historical snapshots retained to power trend analysis; deleted on disconnection or account deletion.
• Payment and tax records: retained as required by Indian law (typically 7–8 years under tax and company law).
• Backups: deleted data may persist in encrypted backups for up to 90 days before being purged.

When you delete your account, we delete or irreversibly de-identify your personal data within 30 days, except where retention is required by law. To request deletion, email mrk18ai@gmail.com with the subject "Data Deletion Request". Disconnecting a Meta or Google account from within mrk18 revokes our access tokens and stops further data collection from that account immediately.

9. Withdrawing Consent

You may withdraw consent by:

• Disconnecting linked marketing accounts in settings;
• Turning off Device listening or Handshake in Device settings;
• Unsubscribing from marketing emails;
• Deleting your account; or
• Writing to mrk18ai@gmail.com.

Withdrawal does not affect the lawfulness of processing before withdrawal. Withdrawing consent for core processing may mean we cannot provide the Services to you.

10. Children

The Services are intended for business users and are not directed to anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

11. Cookies and Tracking

We use:

• Essential cookies — sign-in, security, session management (cannot be disabled).
• Analytics cookies — to understand usage and improve the product.
• Preference cookies — to remember settings.

You can control non-essential cookies through your browser settings or our cookie banner where displayed. We do not use third-party advertising cookies to track you across other websites.

12. Third-Party Links and Services

The Services may link to third-party sites and integrate third-party platforms. Their privacy practices are governed by their own policies. Review them before connecting accounts or clicking through.

13. International Users and Data Transfers

Our primary infrastructure and operations are in India, and personal data may also be processed on cloud infrastructure located in other countries (e.g., for AI inference). Where data is transferred outside India, we do so consistent with the DPDP Act and applicable government notifications. For users in the EEA/UK, we implement appropriate safeguards (such as standard contractual clauses) for transfers, and you additionally have the rights to data portability, restriction, and objection, and to lodge a complaint with your supervisory authority.

14. Changes to This Policy

We may update this Policy from time to time. Material changes will be notified via email or in-product notice, with the updated effective date above. Continued use of the Services after changes take effect constitutes acceptance.

15. Grievance Officer and Contact

In accordance with the Information Technology Act, 2000, the DPDP Act, and rules made thereunder:

• Grievance Officer: Founder, Sipnshow Private Limited
• Email: mrk18ai@gmail.com
• Address: A-116, First Floor, URBTECH Trade Centre, Maharishi Nagar, Noida, Gautam Buddha Nagar – 201304, Uttar Pradesh, India
• Response time: we acknowledge complaints within 24–72 hours and aim to resolve them within 15 days, and in any case within statutory timelines.

For general privacy questions: mrk18ai@gmail.com.