Privacy Policy

1. Who we are

Mark'd IT Up is a website review tool for agencies, made by Hook'd IT Up and run by Hook'd IT Up (“we”, “us”). This policy explains what personal information we handle, why, and what you can do about it.

Two kinds of people use it. Agencies hold accounts, capture their clients' websites and send review links. Reviewers — usually the agency's clients — open those links and leave comments, without an account.

For an agency's account, we decide how your information is used. For the content an agency puts into Mark'd IT Up — its captures, and what its reviewers write — we act on the agency's behalf, as its service provider. If you reviewed a site for an agency, that agency is the best first contact for questions about your comments; you can also contact us.

2. What we collect and why

Agency account holders

• Your email address, and your name if you add one — to sign you in, show teammates who did what, and send the emails described below.
• Your password, if you set one. It is checked and stored by our sign-in provider, Supabase, not in our own tables. You can also sign in with an emailed link instead.
• Your role in each workspace (owner, admin or member) and which projects you belong to — to decide what you can see and change.

Workspaces

• The workspace name, logo, brand color and any custom domain — to brand the review pages your clients see.
• The plan, trial end date and subscription status — to apply plan limits.

Projects and captures

• The website addresses you add, crawl settings, and the addresses and titles of the pages we capture.
• Screenshots of those pages at desktop, tablet and mobile sizes, and any screenshots you upload yourself.
• Login details for a password-protected staging site, if you give them. The password is encrypted before it is stored and is used only to capture that site.

A screenshot records whatever the page showed at the time, which can include personal information published on that site. We capture only the sites agencies add, and agencies are responsible for having the right to capture them.

Reviewers

• Your name, which you type when you first comment, and your email address if you choose to give it — so the agency knows who said what, and so you keep one identity if you come back.
• When you first and last used the link.
• Your comments, pins, drawings and attachments (images, PDFs, text and zip files up to 25 MB), which the agency's team and the people they share the link with can see. Your comments are emailed to the agency's team when you send them, or in a daily round-up if you do not.

We do not create an account for reviewers, and we do not use a reviewer's email address to send them anything.

Billing

Payments are handled by Stripe. You enter card details on Stripe's own checkout and billing pages, so they never reach our servers. Stripe may ask for a billing address. We keep only the Stripe customer and subscription identifiers, the subscription status and the plan, and we give Stripe the workspace name.

Emails we send

Sign-in links and password resets; invitations to a workspace or project; capture results, to a workspace's owners and admins; and reviewers' comments, to the agency's team and the people added to that project. These are part of the service rather than marketing.

Technical information

Like any website, our hosting provider records requests as they arrive, which can include your IP address, browser type, the address requested and the time. We use these logs to keep the service running and secure. We do not store IP addresses in our application database.

The sign-in page uses Cloudflare Turnstile to check that a person, not a bot, is signing in. Turnstile is loaded from Cloudflare and looks at information about your browser and device to do that.

We do not use analytics, advertising or tracking scripts, and we do not sell personal information or share it for targeted advertising.

3. Cookies

We set only the cookies Mark'd IT Up needs to work. None of them are for advertising or analytics, and none are shared with anyone else.

The review page also saves two display preferences in your browser's local storage — whether the viewer is full screen and whether the comment panel is open. They never leave your device. Cloudflare Turnstile, on the sign-in page, may use its own cookies or similar storage to tell people from bots.

4. Who processes data for us

We use these providers to run Mark'd IT Up. Each handles personal information only to provide its service to us.

We will update this list before we start using a new provider that handles personal information.

5. How long we keep it

• While a plan is active, rounds — screenshots, comments and attachments — are kept for as long as the account exists.
• When a paid plan ends or a trial expires, everything is kept for 90 days. Owners and admins are emailed 30 days and 7 days before deletion. After 90 days the workspace's projects, screenshots, comments and attachments are permanently deleted. Starting a plan again before then keeps everything.
• Deleted files are removed from storage by a background queue shortly after the records that point to them are deleted.
• Backups may hold copies of deleted data for 30 days, after which they are gone too. We do not use backups for anything but recovering from a fault.
• Account details are kept while you belong to a workspace. Ask us at markd@hookditup.com to delete your account.
• Billing records are kept by Stripe, and by us where tax and accounting law requires.

6. How we protect it

• Every workspace's data is separated at the database level by row-level security rules, so a signed-in user can read only the workspaces they belong to.
• Review links use long random tokens, and can be revoked, set to expire, or protected with a password. Those passwords are stored only as salted scrypt hashes.
• Staging-site passwords are encrypted with AES-256-GCM before they are stored.
• Sign-in cookies cannot be read by page scripts and, in production, are sent only over HTTPS. The sign-in page has a bot check.
• Screenshots and attachments are served only after a permission check, through short-lived links.

7. Your rights

You can ask us to show you the personal information we hold about you, correct it, delete it, or give you a copy to take elsewhere. Write to markd@hookditup.com. We will check that the request comes from you, and respond within the time the law allows. If you are a reviewer, we may pass your request to the agency whose link you used, since they control that content.

US state privacy rights

Depending on where you live — for example California, Colorado, Connecticut or Virginia — state law may give you further rights, such as the right to know what categories of personal information we collect and why, to have it deleted or corrected, and to opt out of its sale or use for targeted advertising.

In the terms those laws use, and in the last 12 months:

• We collected identifiers (names, email addresses, IP addresses in request logs), commercial information (plan and subscription records), internet activity (request logs), and the content described above, for the purposes in this policy.
• We did not sell personal information or share it for cross-context behavioral advertising, so there is nothing to opt out of.
• We do not use sensitive personal information to infer anything about you.

You can use an authorized agent to make a request, and we will not treat you differently for exercising any of these rights.

8. Children

Mark'd IT Up is a tool for businesses and is not meant for anyone under 16. We do not knowingly collect personal information from children under 16. If you believe a child has given us information, contact us and we will delete it.

9. Changes to this policy

We will update this policy when what we collect or who processes it changes. The date at the top always shows the latest version. If a change materially affects you, we will email workspace owners before it takes effect.

10. Contact

Privacy questions and requests: