Privacy Policy

This Privacy Policy explains how MBRIVAL (“we”, “us”, or “our”) processes personal data when you visit our website, create an account, or use our competitor price intelligence and creative automation platform, including its integration with Meta (Facebook and Instagram) advertising (the “Service”).

1. Who is responsible for your data?

MBRIVAL is operated by Sliko Store Kft. (registered office: Kalap utca 8. 2/8., 1037 Budapest, Hungary; tax number: 28792091-2-41), which is the data controller for the Service. For privacy-related requests, contact us at [email protected].

2. What data we collect

Depending on how you use the Service, we may process:

• Account data — email address, password hash, user role, and workspace assignment.
• Business data you provide — product catalog information (SKU, name, price, product type), Google Sheets configuration, competitor allowlists/blocklists, and workspace settings.
• Generated analytics data — competitor prices, price-position classifications, run history, and related logs created by the Service.
• Generated creatives — product images and videos the Service renders from your product data, and their review status.
• Meta (Facebook) integration data — if an administrator connects a Meta account, the data described in section 6.
• Technical data — session cookies, IP address, browser/device information, and server logs needed for security and operation.
• Communications — messages you send us (for example via email or contact forms).

We do not intentionally collect special categories of personal data. Do not submit sensitive personal data through the Service.

3. How we use your data

We use personal and business data to:

• Provide, operate, and maintain the Service;
• Authenticate users and enforce role-based access;
• Run scheduled and on-demand price-tracking jobs;
• Generate product creatives and, where you enable it, publish and manage them as ads in your own Meta ad account;
• Display dashboards, exports, and analytics to authorised users;
• Improve reliability, security, and product quality;
• Respond to support requests and legal obligations.

4. Legal bases (EEA/UK users)

Where applicable under the GDPR, we rely on:

• Contract — to deliver the Service you or your organisation requested;
• Legitimate interests — to secure the platform, prevent abuse, and improve functionality;
• Legal obligation — where we must retain or disclose data by law;
• Consent — where required (for example certain optional communications or cookies, if enabled).

5. Third-party processors

We use trusted providers to run the Service. They process data only on our instructions and for the purposes described here. These may include:

• Hosting and database providers — to store application data securely;
• Public shopping data providers — to retrieve public Google Shopping product and seller data;
• Google Gemini — to validate product matches during cluster bootstrap (where enabled);
• Google Sheets API — when you connect a spreadsheet for import/export;
• Google reCAPTCHA — to protect the login form in production environments;
• Meta Platforms Ireland Ltd. — when you connect a Meta account, to publish and manage ads through the Meta Marketing API (see section 6).

Your product and pricing data stays scoped to your workspace. Client users cannot access other organisations' data.

6. Meta (Facebook and Instagram) integration

Administrators can connect a Meta account with Facebook Login for Business so the Service can publish approved product videos as ads in an ad account they choose. This is optional and only used when an administrator connects it.

Data we receive from Meta:

• the connecting person's Facebook user ID and name, and the access token Meta issues to the Service, with its expiry and the permissions granted (ads_management, ads_read, business_management, pages_show_list, pages_read_engagement, pages_manage_ads);
• the IDs and names of the ad accounts, campaigns, ad sets, Facebook Pages and linked Instagram accounts the connection can use, and the account currency;
• for ads the Service published: their IDs, delivery status, and aggregate performance metrics (spend and purchase return on ad spend).

How we use it: only to let the administrator choose the ad account, campaign, ad set and Page; to upload the workspace's product videos; to create, pause and resume ads in that account according to the workspace's settings; and to show the publishing history in the Service. We do not access or store data about the people who see or interact with the ads, we do not read Page posts, messages or audiences, and we never delete anything in the Meta account.

What we don't do: we do not sell Meta data, use it for advertising profiles, share it with third parties other than the processors listed above, or use it for any purpose other than the Service's ad publishing.

Storage and security: the access token is encrypted (AES-256-GCM) before it is stored, every request to Meta is signed with an app secret proof, and only workspace administrators can use the integration.

Retention and deletion: the token and selected assets are kept while the connection is active and are deleted immediately when an administrator clicks “Disconnect”. Records of ads the Service published (IDs, names, status) are kept as part of the workspace's publishing history until the workspace is deleted or you ask us to delete them. See our data deletion instructions.

Your use of Meta products is also governed by Meta's own terms and privacy policy.

7. International transfers

Some providers may process data outside your country. Where required, we use appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms.

8. Retention

We retain account and workspace data for as long as your account is active or as needed to provide the Service. Price history and run logs may be retained according to your workspace configuration and our retention settings, then deleted or anonymised unless law requires longer storage.

9. Security

We apply technical and organisational measures including encrypted connections (HTTPS), hashed passwords, role-based access control, workspace isolation, and access logging. No method of transmission or storage is 100% secure.

10. Your rights

Depending on your location, you may have the right to access, rectify, erase, restrict, or port your personal data, and to object to certain processing. You may also lodge a complaint with your local supervisory authority. To exercise your rights, email [email protected]. For data received through the Meta integration, follow our data deletion instructions.

11. Cookies and sessions

We use essential session cookies to keep you signed in. We do not use third-party advertising cookies on the Service. You can control cookies through your browser settings; disabling essential cookies may prevent login.

12. Children

The Service is intended for business users and is not directed at children under 16.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version on this page and update the “Last updated” date. Material changes may also be communicated by email where appropriate.

14. Contact

Questions about this Privacy Policy: [email protected].