Mark

Privacy Policy

Last updated: September 29, 2026

Mark is operated by Blue Pelican Digital LLC ("Blue Pelican," "we," "us"). Mark is an agentic marketing service that drafts, gets approval for, and publishes social media content for the businesses that use it. Mark is offered to businesses located in the United States; it is not directed to residents of other jurisdictions. This Policy explains what data we collect, how we use it, who we share it with, and how to request deletion.

1. What we collect

Account information. Your email address and password (managed by Supabase Auth) and your role within Mark.

Agency and client business data. The business names, URLs, addresses, contact details, and operational data you enter into Mark for the clients you manage.

API keys and OAuth tokens. API keys for third-party services you connect to your Mark account (Anthropic, OpenAI, Resend, Google Cloud, Stripe, Telnyx, Meta), Facebook Page access tokens granted to Mark via OAuth, and Instagram Business account access tokens granted to Mark via Instagram Login. When you connect a Facebook Page, we also store the connecting Facebook user's account identifier (a numeric Facebook user ID); we use it solely to revoke Mark's access on Meta's side when you disconnect, and it is deleted when you disconnect the Page. When you connect an Instagram professional account, Mark reads the account's Instagram Business account ID, username, display name, and account type (for example, Business or Creator) from Instagram, and reads them again from time to time to check that the connection still works. We store the account's Instagram Business account ID and username; we use them solely to address publish requests to the correct account, to show you which account is connected, and to identify the account in token-expiry alerts emailed to your agency's administrator — and they are deleted when you disconnect the account. We use the account type only to confirm that the account is a professional account that can publish, and we record it in the audit-log entry for the connection. We do not store the display name. All keys and tokens are encrypted at rest using AES-256-GCM before storage.

Instagram posts Mark publishes. For each post Mark publishes to Instagram, Mark receives the post's Instagram media ID from Instagram and reads back the post's permalink (its public web address). We store both with the post record and in the audit-log entry for the publish. We use them to link to the live post from Mark and, if the post is later deleted in Instagram, to confirm it is gone before Mark removes its own record of it.

Generated content. AI-generated marketing plans, post drafts, hashtags, and clarifying questions produced by Mark on your behalf.

Photos and videos you upload. If you upload your own photo or video on a post-approval page, we store it to show you a preview and to publish it when you approve. For a video we also store its file size, length and dimensions, a few still frames taken from it in your browser, any note you add, and a record — with the time, IP address and browser user-agent — of your confirmation that your business filmed it, that everyone seen or heard in it agreed to be in it, and that it was not created or altered with AI. Mark never creates, edits or alters video.

Audit logs. A record of administrative actions taken in your account (account creation, settings changes, post approvals, OAuth connections) for security and accountability.

Billing information. When you subscribe to Mark, checkout happens on Stripe's payment pages: Stripe collects your payment card details directly, and we never receive or store full card numbers. From Stripe we receive and store the business name and email address you enter at checkout, your billing status (active, past due, or canceled), Stripe customer and subscription identifiers, and a log of the subscription events Stripe sends us (used to keep your service in sync with your billing).

Consent records. When you affirmatively accept our Terms of Service and this Privacy Policy (for example, by ticking the agreement checkbox at signup or on a post-approval page), we record the acceptance together with a timestamp, the versions of the documents accepted, and the IP address and browser user-agent of the request, as evidence of the agreement.

Public content fetched for analysis. Mark fetches the public web pages at the website and Google Business Profile links you provide for a client and extracts their readable text. We use the extracted text to inform AI classification. Mark never fetches Facebook or Instagram pages: a Facebook or Instagram link you enter is stored as a link only.

2. How we use it

  • To authenticate your account and protect it from unauthorized access.
  • To run AI classification on the businesses you onboard, producing marketing plans and content suggestions.
  • To generate, send for approval, and publish social media posts on behalf of your clients via the platform APIs you have connected.
  • To send transactional emails (approval requests, password resets) via Resend.
  • To maintain an internal audit log for accountability and debugging.
  • To respond to your support requests.

3. Third parties we share data with

Mark sends data to the following third parties as part of its operation. You authorize these transmissions when you connect each integration in Settings:

  • Anthropic — prompts and the extracted text of your clients' public URLs are sent to Claude models for classification and content generation. If you ask Mark for new wording on a post that has your video attached, a few still frames from the video and your optional note are also sent. The video file itself is never sent to Anthropic.
  • OpenAI — prompts may be sent to image-generation models when image generation is enabled. Mark's suggested pictures are AI-generated. Photos and videos you upload are never sent to OpenAI.
  • Resend — recipient email addresses and approval-email content are sent to Resend for delivery.
  • Meta (Facebook / Instagram) — when you connect a Facebook Page or an Instagram professional account, your OAuth flow goes through Meta, and post content you approve is sent to Meta's Graph API to publish on your client's behalf. When you approve a post with a video, Meta receives the video file — it fetches it from a temporary private link — to publish it.
  • Google — for Places API and PageSpeed Insights lookups about your clients' businesses.
  • Stripe — our payment processor for Mark subscriptions. Checkout and card handling happen on Stripe's own pages under Stripe's privacy policy; Stripe sends us the checkout and subscription details described in "Billing information" above. If you separately connect a Stripe API key for your own billing features, the related payment and customer data you process is likewise sent to Stripe.
  • Telnyx — if you enable SMS features, recipient phone numbers and message content are sent to Telnyx for delivery.
  • Supabase — our database and authentication provider. All Mark application data, including photos and videos you upload, is stored in Supabase.
  • Vercel — our hosting provider, based in the United States. Mark's website and servers run on Vercel, so the data you send to or receive from Mark passes through Vercel, which also keeps technical logs of those requests.

We do not sell your data to any third party.

4. Requests from government authorities

We comply with valid legal requests for personal data from government and law-enforcement authorities. We review each request to confirm it is legally valid before we respond, and we decline or challenge any request that is not. When we do disclose, we disclose only the minimum information the request legally requires. We keep a record of each request, our legal review of it, our response, and who at Blue Pelican handled it.

5. How we protect it

  • All API keys and OAuth access tokens are encrypted at rest using AES-256-GCM with a server-side encryption key before being written to the database.
  • All connections between you and Mark use HTTPS.
  • Database access is gated by Supabase Row-Level Security; agency data is isolated by agency_id so one agency's data cannot be read by another.
  • If we become aware of a security breach affecting your personal data, we will notify affected account holders without undue delay, and within any timeframe required by applicable law (for example, Tennessee Code Annotated § 47-18-2107, or the 72-hour notification window under GDPR Article 33 where it applies).

6. Retention

We retain your account data for as long as your Mark account is active. Audit logs are retained for accountability and may be kept beyond account deletion in an anonymized form for security purposes. Consent records (including their IP address and user-agent) are retained for as long as needed to evidence the agreement, which may extend beyond account deletion where the law permits.

Uploaded videos and the still frames taken from them are deleted 30 days after the post publishes, immediately when you replace or remove the video or when the post is deleted, and 30 days after the approval link expires for a post that is never published. The platform keeps its own copy of a published video under its own terms. Your confirmation record is kept like other consent records.

7. Your rights

You may request a copy of your data, correction of inaccurate data, or deletion of your account and all associated data at any time.

8. Data deletion

To request deletion of your Mark account and the data associated with it, email hello@bluepelicandigital.com from the email address registered to your Mark account. Subject line: Data deletion request.

When we receive a verified request, we will:

  1. Disconnect any Meta (Facebook or Instagram) OAuth connections associated with your account.
  2. Delete your account, your clients' data, your agency record, all generated content, and any photos or videos you uploaded.
  3. Delete API keys and OAuth tokens you have stored.
  4. Retain only audit-log entries strictly necessary for security purposes (in an anonymized form) and consent records needed to evidence your prior acceptance of our terms.

We will confirm deletion within 14 days.

To revoke Mark's access to your Facebook account directly: log into Facebook → Settings & Privacy → Settings → Apps and Websites → find Mark → Remove. This revokes Mark's access on Meta's side. You should also email us so we can delete the corresponding data from our systems.

Disconnecting an Instagram account in Mark: you can disconnect a connected Instagram professional account at any time from the client's Connections card in Mark. Disconnecting immediately deletes the access token, Instagram Business account ID, and username stored in Mark. Please note: Meta does not provide a way for apps to revoke an Instagram Login authorization on Meta's side, so disconnecting in Mark deletes our copy of the token but does not revoke the authorization you granted at Meta. To fully revoke it, remove Mark yourself in the Instagram app: go to Settings → Website permissions → Apps and websites, find Mark_Agent-IG (the name Mark appears under in Instagram) on the Active tab, and tap Remove. On a computer, the same list is at instagram.com/accounts/manage_access. We recommend doing both.

Deletion requests sent through Meta: when Meta sends Mark a data deletion request for your Facebook or Instagram account (for example, after you remove Mark there), Mark automatically deletes the connections made with that account, including their access tokens and account details. We keep a record of the request (a confirmation code, the Facebook or Instagram user ID Meta sent with it, and when it was completed) so that you can check its status. To have anything else deleted, such as Mark's records of posts it published for you, email us as described above.

9. Children

Mark is not directed to children under 13. We do not knowingly collect data from children.

10. Changes to this policy

We may update this Policy. Material changes will be communicated by email to the address registered to your account.

11. Contact

Questions about this Policy or your data: hello@bluepelicandigital.com

Reporting a security issue: if you believe you have found a security vulnerability in Mark, or that data held by Mark has been exposed, email hello@bluepelicandigital.com with the subject line Security issue. Please do not include passwords or access tokens in your email.