Privacy Policy

Who we are

Markyard is a web application for print shops. It reads the customer inquiries that arrive in a shop's Gmail inbox, extracts what the customer is asking for, and turns it into a quote-ready job, with a person at the shop approving what goes out. This policy covers the Markyard website and application at markyards.com.

Markyard is operated by Dušan Milićević PR štamparija FOILIFY Valjevo, sole proprietorship (preduzetnik) registered in the Republic of Serbia, Dokmirska 4, 14000 Valjevo, Serbia, which is the controller responsible for the data described here as ours. You can reach us about anything in this policy at foilifyprint@gmail.com or through the contact page. Full company details are on our legal notice.

The short version

• Markyard reads your Gmail only after you connect it and accept Google's consent screen, and only to run the inquiry, quote and reply features you see in the app.
• Messages that are not customer inquiries are not stored. Inquiries are stored in your workspace until you delete them.
• Text from your mail is processed by Google's Gemini API to sort and read inquiries. Attached files are never sent to an AI model.
• Your Google data is never sold, never used for advertising, and never used to train AI models. People at Markyard do not read it except in the narrow cases listed below.
• You can disconnect Gmail, delete inquiries, and ask us to delete your account at any time. Here is how.

What we collect and why

Account data

When you create an account we store your email address, your name if you add one, the workspace (organisation) you create or join, and your role in it (owner, admin or member). If you turn on two-step verification, the authenticator secret is held by our authentication provider, Supabase Auth. Your password is never stored by Markyard's own code: Supabase Auth handles it directly and stores only a one-way hash. If you sign in with Google, we receive your name, email address and profile picture from Google to create and identify your account; that sign-in does not give Markyard access to your mail. We use account data to run your account, show you your workspace's work, and enforce who can do what inside it.

What you put into your workspace

Your product catalogue and prices, customer records you enter or import, jobs, tasks, quotes, notes, email signatures, a profile picture, and files you upload, such as artwork. We store this to provide the service and show it to members of your workspace. It is never visible to other Markyard customers.

Gmail data

Only if you connect a Gmail mailbox. What Markyard reads, keeps, sends and never does is set out in full under Google user data below.

Billing data

Paid plans are billed through PayPal. Markyard stores your plan, the PayPal subscription identifier and its status, and the dates of your trial and billing period. Your card or bank details are entered on PayPal and never reach Markyard. PayPal processes the payment as an independent controller under its own privacy statement.

Contact form data

The forms on our marketing pages ask for your name, email address, an optional company name, and your message. We also record which page the form was sent from, and a one-way hash of your IP address built with a salt that changes every day and on every server restart. The raw IP address is never stored. The hash cannot be turned back into an address and only exists to slow down automated abuse of the forms. We use the rest only to answer you.

Technical logs

Our hosting provider (Vercel) and database provider (Supabase) keep ordinary operational logs, such as request times, error traces and the IP address of a request, as part of running the service. We use them to keep Markyard secure and working. We also keep a count of AI tokens used per workspace, without any message content, to enforce plan limits.

Records of accepted agreements

Before a workspace is created, and whenever a workspace owner accepts a new version of our agreements, the person accepting confirms the Terms of Service and the Data Processing Agreement and acknowledges this Privacy Policy. We then record: their account identifier and email address, the workspace, the versions of the Terms of Service, the Data Processing Agreement and this Privacy Policy that were accepted, a SHA-256 fingerprint of the exact Data Processing Agreement text, the version of the Markyard website that showed them, the time of acceptance, the IP address the request came from, and the browser's user-agent string. We use this record only to establish and demonstrate that the agreements were concluded, by whom and in which version, for example in a dispute or when a customer or an authority asks us to show it. Once written, the record cannot be changed.

Google user data

This section applies when an owner or admin connects a Gmail mailbox to a Markyard workspace. Before Google's consent screen opens, Markyard shows a notice with the same information in short form, and nothing is read until you have accepted both that notice and Google's screen.

Permissions Markyard asks Google for

Markyard does not ask for any other Google permission to connect a mailbox.

What Markyard reads

• New messages in the connected mailbox's Inbox, leaving out Gmail's Promotions and Social categories. The first check looks back 7 days; after that, Markyard reads only mail that arrived since its last check.
• Messages you label Markyard in Gmail yourself, from the last 30 days. A labelled message is always treated as an inquiry.
• For each of these messages: the sender, reply-to address, subject, date, the message text, Gmail's message and thread identifiers, and, for messages that turn out to be inquiries, their attached files (not images embedded in the email body, such as signature logos).

How Markyard uses it

Only to provide these features, all of which you can see in the app:

• Sorting: deciding whether a message is a customer inquiry. The subject and text are sent to Google's Gemini API for this (see AI processing).
• Inquiries: showing the inquiry, its attachments and the conversation in your workspace, and linking it to a customer record and a job.
• Extraction: pulling out products, quantities, sizes, colours, print methods, deadlines and contact details, and checking them against your own catalogue.
• Replies and quotes: drafting a reply or quote for a person in your workspace to review, edit and approve, and sending it in the customer's own thread.
• Automatic missing-detail replies: off by default. When an admin turns it on for a mailbox, Markyard may send a short reply asking the customer for details the inquiry is missing, without a person approving each one. It is limited to three automatic replies per inquiry and 200 per workspace per day, and is never used for quotes.
• Notifications: telling members of your workspace, in the app and by email if they turn that on, that an inquiry or a customer reply arrived.

Through the direct connection, Markyard never deletes, archives, labels, marks as read or otherwise changes anything in your Gmail; the permissions it holds do not allow it. (The optional Apps Script connector, described below, adds one label.)

What Markyard stores

• Messages that are not inquiries are not stored. Markyard keeps only the Gmail message identifier and the result of the check, so it does not read the same message twice.
• For inquiries: the sender, subject, date, message text, the customer's later replies in that thread, the details extracted from them, the drafts and replies written for them, and their attachments (up to 20 files per message and 50 MB per file), in your workspace.
• For the connection: which mailbox is connected, the permissions Google granted, when it last synced, and the refresh token Google issues, encrypted before it is written to the database. The token is what lets Markyard check for new mail without asking you to sign in again. Markyard never sees your Google password.

Who it is shared with

Gmail data is visible to the members of the workspace the mailbox is connected to, and to no other Markyard customer. Outside Markyard it is transferred only to the service providers that run the features above: Supabase (storage), Vercel (the application servers) and Google (the Gemini API). Beyond that, it is transferred only where needed for security, such as investigating abuse, where the law requires it, or as part of a merger, acquisition or sale of Markyard's business, and in that last case only after asking you first.

Gmail data is never sold, never shared with or used for advertising, including retargeting and interest-based ads, never given to data brokers or information resellers, and never used to decide creditworthiness or for lending.

When people at Markyard can see it

Nobody at Markyard reads your mail, inquiries or attachments, except:

• when you ask us to look at specific messages, for example to investigate an inquiry that was read wrongly, and we keep a record of that request;
• when it is necessary for security, for example investigating a bug or abuse;
• when the law requires it; or
• in aggregated and anonymised form, for internal operations such as counting how many messages were processed.

How long it is kept, and how to delete it

• Inquiries, their attachments and replies stay in your workspace as part of your job history until you delete them, or until your workspace is deleted. Admins can delete an open inquiry in the app; a completed inquiry is locked as a record of finished work and is archived instead, and is removed when the workspace is deleted.
• Disconnecting a mailbox in Settings → Connections asks Google to revoke Markyard's access and deletes the stored token straight away. Reading and sending stop. Inquiries already imported are not deleted by disconnecting; delete them separately, or ask us to.
• You can also remove Markyard's access from your Google Account at myaccount.google.com/permissions.
• If you ask us to delete your account or workspace, we delete its Gmail data, including stored files, within 30 days.

Step-by-step instructions are on How to delete your data.

The Apps Script connector

Markyard also offers an optional connector that runs as a Google Apps Script in your own Google account instead of through Markyard's Google sign-in. Google shows its own permission screen for it, which asks for broader access to Gmail than the direct connection does. The script checks your Inbox every five minutes through a trigger in your own account, reads the same kinds of messages and sends the same kinds of replies described above, and adds the Gmail label Markyard/Obradeno to each conversation it has handed to Markyard, so it does not send it twice. It does not delete or archive mail. Everything it hands to Markyard is treated under this section exactly like data from the direct connection. Stopping it is covered on How to delete your data.

Limited Use

Markyard's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace APIs will adhere to the Google Workspace API User Data and Developer Policy, including its Limited Use requirements.

AI processing

Markyard uses Google's Gemini API to sort incoming messages, extract order details from inquiry text, and draft replies. For this, Markyard sends Gemini the subject and text of a message, and later the text of the conversation it belongs to. Attachments from Gmail are never sent to Gemini or any other AI model. Artwork you upload to Artwork Check yourself may be sent to Gemini for a visual review; background removal in Artwork Check runs on Markyard's own servers. A product catalogue you upload as a PDF to import your products is sent to Gemini, which reads the products, their prices and where their photos are; the file is deleted once the import is finished, and at the latest after 7 days.

Markyard uses the Gemini API only as a paid service. Under Google's terms for paid use, Google does not use what Markyard sends, or Gemini's answers, to improve its products, and processes it as Markyard's data processor. Google keeps prompts and answers for up to 55 days solely to detect and prevent abuse of its service, as described in its Gemini API usage policies.

Markyard does not use Google Workspace or Gmail data, or anything derived from it, to develop, improve or train generalized or non-personalized AI or machine learning models. Markyard does not train or fine-tune any AI model on that data at all, including personalized models. It is used only to produce the result for the workspace whose mailbox it came from, and is never pooled across workspaces.

Customer email is untrusted input. Markyard marks it as such in every request to Gemini, checks Gemini's answers against a fixed format before using them, and never lets an AI answer change permissions, settings or anything outside the inquiry it was asked about. See our Security page.

Legal basis under GDPR

For your own account, billing and workspace administration data, Markyard is the data controller. Our legal basis is the contract between you and Markyard: we need that data to provide the service you signed up for (Art. 6(1)(b) GDPR).

The inquiries in your mailbox, and the customer records, jobs and quotes built from them, contain personal data about your own customers. For that data, your print shop is the controller and Markyard is your processor: we process it only on your instructions, to provide the service to you, under our Data Processing Agreement. You are responsible for having a lawful basis to process your customers' inquiries, just as you are when you read and answer them yourself. If you are one of a print shop's customers, please contact that shop about your data; we will help them answer you.

Connecting Gmail also relies on the permission you give on Google's consent screen, which you can withdraw at any time by disconnecting. For contact form submissions and technical logs, our basis is our legitimate interest in answering messages and keeping Markyard secure and working (Art. 6(1)(f) GDPR). Where we must keep billing records, the basis is our legal obligation (Art. 6(1)(c) GDPR).

For records of accepted agreements, our basis is our legitimate interest in being able to prove which agreements were concluded, by whom and when, and in establishing, exercising or defending legal claims (Art. 6(1)(f) GDPR). Where a law requires us to keep evidence of a contract, that legal obligation is the basis for keeping it (Art. 6(1)(c) GDPR). You may object to processing based on our legitimate interest; for these records we will generally have to continue it, because it is needed to establish, exercise or defend legal claims.

How long we keep it

Who processes data for us

International transfers

Markyard is operated from Serbia, outside the European Economic Area, and Serbia has no adequacy decision from the European Commission. Where we process personal data of, or for, a print shop in the EEA, that is covered by the European Commission's Standard Contractual Clauses, which are incorporated into our Data Processing Agreement. Serbia's Law on Personal Data Protection, which closely follows the GDPR, also applies to us.

Markyard's database and files are stored in the European Union and the application runs in Frankfurt, Germany. Some providers above are based in, or process data in, countries outside the European Economic Area, notably the United States: Google for the Gemini API, Vercel for its global network, and Resend for account emails. Where personal data leaves the EEA, the transfer is covered by the European Commission's Standard Contractual Clauses in that provider's data processing terms, or by the provider's certification under the EU-U.S. Data Privacy Framework.

Cookies and local storage

Markyard uses only cookies it needs to work: your sign-in session, which workspace you have open, a short-lived security cookie while you connect Gmail, and one that remembers you have seen the welcome screen. Your light or dark theme choice is kept in your browser's local storage. There are no analytics, advertising or tracking cookies. When you open checkout, PayPal's own payment button is loaded from PayPal, which may set its own cookies under PayPal's privacy statement.

How we protect it

Data is encrypted in transit (HTTPS only) and at rest by our database and storage provider. Gmail refresh tokens are additionally encrypted with AES-256-GCM, using a key kept outside the database. Each workspace's data is separated by row level security enforced in the database itself. Accounts can use two-step verification, and a workspace can require it. The details, and what we have not built yet, are on our Security page. If we learn of a breach affecting your data, we will tell you, and the authorities where the law requires it, without undue delay.

Your rights

If GDPR or a similar law applies to you, you have the right to:

• access the personal data we hold about you
• correct it if it is inaccurate or incomplete
• have it deleted
• restrict how we use it
• receive a copy of it in a portable, machine-readable format
• object to processing based on our legitimate interests
• withdraw consent at any time where we rely on it, for example by disconnecting Gmail, without affecting what was processed before
• lodge a complaint with a data protection supervisory authority: in the EEA, the authority where you live or work; in Serbia, the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik)

To exercise any of these, use the contact page. We will confirm it is really you asking, and answer within one month. Deleting data yourself is described on How to delete your data.

Children

Markyard is a business tool for print shops and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

When this policy changes, we update the date at the top. If we ever want to use Google user data in a way, or for a purpose, not described here, we will tell you first and ask for your consent before doing so. Other significant changes, such as a new kind of data or a new provider, are announced in the app or by email, not only by editing this page.

Contact us

Dušan Milićević PR štamparija FOILIFY Valjevo, Dokmirska 4, 14000 Valjevo, Serbia. foilifyprint@gmail.com, or the contact page.