Privacy Policy

This notice explains how MarketGapRadar handles personal data for accounts, private commercial research, report questions, supplier observations and support. It is separate from our Terms. Research is generated with AI and can be incomplete or wrong.

• Account name, email, password hash, optional company, country and timezone.
• Essential session cookies, session dates, browser details, security and rate-limit records; authenticator secrets and recovery codes when you enable two-factor authentication.
• Research requests, source snapshots, reports, questions and answers, private notes, saved economic scenarios, supplier observations and verification quote requests.
• Research-credit allocations, provider-usage receipts, demo/test orders, simulated report-slot claims, refund status, notification preferences, support correspondence and recorded versions of accepted terms.

Passwords are hashed by the authentication service. Authenticator secrets and recovery codes are encrypted by the authentication library. Keep passwords, card details, sensitive personal information and unnecessary third-party personal data out of research requests and support messages.

• Contract and steps you request before a contract: provide your account, requested research, saved reports, exports, support and agreed verification scope.
• Legitimate interests: protect accounts, prevent fraud and duplicate charges, investigate errors, maintain the service and improve research using aggregate feedback categories. We balance these purposes against privacy and you may object where this basis applies.
• Legal obligations: comply with applicable records, tax, consumer and data-protection requirements when relevant.
• Consent: optional completion emails where you request them. You can stop requesting future completion emails; this does not undo delivery already requested or remove necessary security and account communications.

Required account details are necessary to provide an account. Optional profile details are not required. Reading this notice is not consent to unrelated marketing.

Research scope, questions, selected saved report evidence and relevant source text are sent to the configured AI provider to perform your request. Private notes and account passwords are not added to research prompts by default. Avoid including confidential third-party data in prompts. The current research engine uses OpenAI; OpenRouter may be configured for supported provider routes. Provider processing and retention are governed by the applicable API arrangements; we do not promise zero retention or an unverified model-training exemption. Shared feedback guidance uses aggregate categories and counts, not other customers’ private notes or free-text feedback. Reports are private unless separately and explicitly selected for publication. There is no automated decision determining your legal rights; report verdicts are research suggestions.

Render hosts the application and Neon hosts the database. OpenAI processes research and report questions; OpenRouter is used only for configured routes. Resend handles email when an approved sender is connected. Google or Apple receive sign-in information only if you choose an enabled provider. Infrastructure regions and provider processing locations can differ, including locations outside the EEA. Before commercial launch, the operator must verify and document each applicable processor agreement, subprocessors, processing location and Chapter V transfer mechanism, such as an adequacy decision or standard contractual clauses with any required safeguards. We do not represent that European hosting alone keeps all processing in Europe. No advertising analytics is installed. An optional Stripe hosted test checkout sends only application/order references, offer description, amount and currency to Stripe; Stripe receives the test checkout details you enter. This application does not collect or store card numbers. Use published test details only, never a real card. Another payment provider is not enabled merely because the software supports adapters.

Where configured, originals use authenticated private object storage and bounded isolated extraction. Text, CSV, PDF, DOCX and XLSX are limited to 20,000,000 bytes per file and separate account quotas. Legacy DOC/XLS conversion and OCR are unavailable. You control use instructions and inclusion. Selected excerpts and private observations may be sent to the configured AI provider to answer your questions; full files are not appended to every question. Documents are not independently authenticated. Deletion disables future retrieval and removes live originals and derivatives; backups follow provider retention. Download originals separately before deleting.

• Account profile and private workspace content are kept while your account is active, until you delete applicable content or your account.
• Account deletion removes live owned reports, notes, scenarios, supplier observations, support tickets, conversations, credit allocations, local test orders/slot claims/refund records and associated login access. Provider-side test records follow that provider’s retention; deleting an account here neither erases those records nor automatically refunds a payment. Minimal usage/accounting receipts and de-identified job records may remain to reconcile incurred costs, unresolved provider work or legal claims; they are not a copy of your private report.
• Sessions normally expire after seven days unless renewed through use. Time-limited verification and recovery records expire according to their purpose. Hashed rate-limit counters expire after their stated window and are cleared during subsequent requests.
• Browser-saved catalog notes, filters and request drafts remain on your device until cleared. Account deletion does not remotely erase those browser records.
• Hosting logs, provider records and backup copies follow their configured retention. The operator must confirm and document those windows before commercial launch. Deletion from a live database does not imply instant erasure from every provider backup.

We do not promise a backup-erasure period that has not been verified.

Depending on the applicable basis and circumstances, you may request access, correction, deletion, restriction, portability, object to legitimate-interest processing, or withdraw consent. Export your account from Settings and delete it there where available. Use the contact details below or an account support request for other rights, including an objection to shared-feedback processing. We may need proportionate identity verification. We respond within one month, subject to the extensions and exceptions allowed by law. You may complain to the Bulgarian Commission for Personal Data Protection (cpdp.bg) or the competent supervisory authority where you live or work.

We use essential authentication, security and two-factor challenge cookies. We also save requested catalog preferences and draft research in browser storage. No advertising trackers are installed. Adding non-essential tracking requires a separate assessment and appropriate controls before activation. Material changes to this notice will show a new date/version; where required we will give additional notice.