Privacy policy

1.Who is responsible

Mark2Form is a trade name of Upgraded Systems, registered with the Dutch Chamber of Commerce under number 42056807. We are responsible for personal data used to operate our website, manage accounts, provide support and administer our services.

When a business uses Mark2Form to process its customers' designs, files or requests, we process that content on the business's instructions. That business is responsible for its own customer relationship and privacy information. For questions or requests concerning data held by Mark2Form, contact support@mark2form.com.

2.Website, account and customer data

Contact and registration forms collect the information you enter, such as your name, email address, company and message, together with the page and language used. We use it to answer you, create or manage an account and provide support.

The portal processes account and company details, team permissions, software settings, connected services, subscriptions, billing details and usage records. Design tools process uploaded logos, text, selected design settings and generated production files. If a business enables a request or quotation form, it also receives the contact information and design that its visitor submits.

Our infrastructure processes technical request data such as IP addresses, browser information, timestamps and error information to deliver the service, investigate faults and prevent abuse. We do not sell personal data.

3.Google Drive: data we access

After you authorise Google Drive, we obtain the connected account's email address and account identifier to show which account is connected. We receive OAuth access and refresh tokens so that the selected automation can run without asking you to sign in for every file. We never ask for or receive your Google password.

The folder picker and background checks access file and folder metadata: names, identifiers, parent folders, file types, sizes, modification information, deletion status and change cursors. Google's Drive change feed can return metadata about changes elsewhere in the connected Drive; the automation filters those changes for the folders you selected. We do not download unrelated file contents for this automation.

Within a selected input folder, we download supported logo images for the test you request and for processing after you activate the folder rule. We generate one SVG and write it to your selected output folder, which may be the same folder. We may read back that file to verify it during testing or recovery. Source files are preserved; generated SVGs can be accessed by people who already have access to the destination folder in Google Drive.

4.Why we request these Google permissions

drive.readonly allows us to discover new files that you or your colleagues add to a selected folder, read their metadata and download the logo for conversion. This is a broad Google permission that technically permits reading Drive files beyond the selected folder; Mark2Form limits its automation to your configured folders. Selecting a folder does not narrow the underlying Google permission itself.

drive.file allows the app to work with files and folders you make available through Google's picker and with files it creates, including saving and checking the SVG output. Mark2Form's folder automation does not delete your source files or change their sharing permissions. We do not request Gmail, Calendar or Contacts access for this feature.

5.How we use Google data

We use Google data to establish and display the connection, let you choose folders, test a logo, detect new eligible files, convert them to SVG, deliver the result and show processing status. File identifiers, checksums, job identifiers and error states help us prevent duplicates and recover interrupted processing.

Google data is not used for advertising, profiling for advertisements, sale, credit assessment or unrelated data products. We do not use data obtained through Google Workspace APIs to develop, improve or train general-purpose or non-personalised artificial intelligence or machine-learning models.

The Google API Services User Data Policy governs our use of Google API data, including its Limited Use requirements. Transfers of that data are limited to providing the requested features, security needs, legal obligations or another purpose specifically permitted by that policy. Human access is restricted to authorised people when you request and consent to support, when needed for security, or when required by law.

Google API Services User Data Policy

6.What we store

We store the account identifier and email address, encrypted OAuth tokens, your folder rules and processing settings. Processing records contain source and output file identifiers and names, checksums, job status, timestamps and error information. These records let you view results and help us avoid processing the same file twice.

Logo processing also uses our server infrastructure and object storage for source images, designs and output files. The SVG copied into Google Drive remains in your Google account. Disconnecting Google does not automatically erase processing records or copies already held by Mark2Form; see the retention and deletion sections below.

7.Service providers and disclosure

Vercel hosts the website, portal and processing endpoints and provides Blob storage for diagnostic archives where enabled; Supabase provides the application database and authentication; Cloudflare R2 stores source and production files; and Trigger.dev runs background jobs. Those providers process the data needed for their part of the requested service. Google receives the requests needed to authorise the connection, choose folders and read or write Drive files.

Resend delivers service emails, Stripe processes subscription and payment information, and Sentry supports error monitoring where enabled. Optional website analytics use PostHog after consent. Connecting Google Drive does not itself authorise sending your Drive file contents to advertising or analytics services, or to another customer's account.

Other destinations, such as Notion or email recipients, are used when you configure those features. We may disclose information where legally required or necessary to investigate abuse and protect the service. Providers may process data outside your country, including outside the European Economic Area. Contact us for information about the providers involved in your processing and the applicable transfer safeguards.

8.Automated image processing and AI

Image conversion is automated. Where the configured image-processing route uses an AI-assisted step, image content may be processed by our AI service provider, Anthropic, to recognise text in the image and support the requested conversion. This is processing to provide your requested output, not permission to train a general-purpose model on your Google data.

Google Workspace data must not be used by Mark2Form or its service providers to develop, improve or train general-purpose or non-personalised AI or machine-learning models. Automated processing produces design files; it does not make decisions about your legal rights, creditworthiness or eligibility for services.

9.How data is protected

Connections to our services and Google use HTTPS. Google OAuth tokens are encrypted before being stored in the application database. Account and company permissions restrict access to connections and processing records; background services use server credentials. Application secrets and refresh tokens are not included in public website code.

Google's official folder picker receives a temporary access token in browser memory for the selection you request. It does not receive your refresh token. Download links to private production files are time-limited. Access controls, validation and operational monitoring help protect the service, but no online system can guarantee absolute security.

10.Retention

Connection tokens are retained while the connection is authorised and removed from our integration credential store when you disconnect it in Mark2Form. Folder rules, file references and processing history can remain after disconnection so that past results and interrupted work can be understood. They are not automatically erased by revoking Google access.

Source image copies are stored for processing and recovery. There is currently no uniform automatic deletion period for those copies; you can request their removal using the contact method below. Designs, generated files and processing history are stored to make past results available and support the customer's production workflow. Disconnecting a folder does not delete these categories. You can request removal of Google-derived content and associated records separately.

We keep account and support information for as long as needed to provide the service and resolve the relevant request. Records required for accounting, disputes or security may be retained for the applicable obligation or purpose after an account closes. Deletion from active systems does not necessarily remove a record immediately from existing provider backups; access to backup copies remains restricted until they expire under the provider's backup cycle.

11.Disconnecting Google and requesting deletion

You can pause a folder rule in the portal to stop new automatic processing. To disconnect the Google account, use the disconnect action under Koppelen / Connections. You can also revoke Mark2Form's access in your Google Account's third-party connections settings. Revoking access prevents subsequent authorised Drive access but does not delete the files in Drive or the data already stored by Mark2Form.

To request deletion of the connection records, Google-derived files or your account data, email support@mark2form.com with your account email and the company or folder rule concerned. Do not send passwords or tokens. We verify the request, identify the relevant records and remove data that no longer needs to be kept. We explain any legal retention exception. Files already delivered to Google Drive remain under your control and can be deleted there by you.

Manage access in your Google Account

12.Cookies and website analytics

The portal uses browser storage and session information needed for signing in and using the service. The website stores your cookie preference. Where website analytics are enabled, PostHog loads only after you accept the cookie notice; declining leaves analytics off.

With consent, analytics record page visits, clicks on links and buttons, browser context and fixed events such as a submitted form. Form field contents are not recorded by this measurement code; session recording and surveys are disabled. You can withdraw consent through Cookie settings in the footer. This stops future measurement and removes the analytics cookies and local analytics storage; it does not itself erase measurements already received by the provider.

13.Purposes and legal grounds

We process account, service and billing information to perform our agreement with you or to take steps you request before entering that agreement. We process required accounting records to meet legal obligations. Operating a secure service, handling support and preventing misuse serve our legitimate interests, taking your rights into account.

Optional analytics rely on consent. Google access requires the authorisation you give in Google's consent screen and remains limited to the service you configure; that authorisation can be revoked. Where we handle your customers' data on your instructions, you are responsible for establishing the appropriate legal basis for that customer processing.

14.Your privacy rights

You can request access to, correction or deletion of your personal data and, where applicable, restriction, portability or object to processing. You can withdraw consent without affecting processing that lawfully took place before withdrawal. Email support@mark2form.com; we may need information to verify your identity without requesting your password.

We respond within the period required by applicable privacy law and explain any permitted extension or reason why a request cannot be fully fulfilled. If your data was submitted to a business using Mark2Form, you can also contact that business. You may complain to your local data protection authority, including the Dutch Autoriteit Persoonsgegevens.

Dutch Data Protection Authority

15.Changes to this policy

We update this page when our data practices change and display the revision date above. If a change materially affects how connected Google data is used, we will notify affected users through the portal or email and obtain additional permission where required before using that data for a new purpose.

16.Contact

For privacy questions, deletion requests or details about a connected service, contact support@mark2form.com. Include enough information to identify your account or request, but do not include passwords, API keys or Google tokens.

support@mark2form.com