Privacy policy

Who we are and our role

• Extoris LLC (“we”) makes the MarketMage plugin for Claude and publishes the CleanPull actors on the Apify Store.
• The plugin and the actors run on services you have an account with: Anthropic’s Claude and Apify. Each of them is responsible for the data you give it under its own privacy policy: Anthropic, Apify.
• For the requests our actors send to our data providers (below), for support emails and for this website, we are the controller.

Why we may use personal data (lawful basis)

Where the EU or UK GDPR applies to the personal data we handle as a controller, these are our purposes and the lawful basis for each:

Where we rely on legitimate interests, you can object, and we will stop unless we have a compelling reason that overrides yours. The data in your own Apify account (your inputs, results, watches and notebook) is yours to control there; for any personal data in it, you decide the purpose and the basis.

What the plugin does with your data

You connect the plugin with Apify’s sign-in. That is the only account it needs.

If you choose to use your own Google credentials for Sheets exports (a service account key, or an OAuth client and refresh token, in Google Sheets Sync’s optional fields), they are handled the same way: added only in the Apify Console, stored encrypted by Apify, sent only to Google, and never written to a log, a result or a run summary. No other source needs a key of yours.

The plugin doesn’t read your Claude memory or other conversations. Apify’s sign-in gives the connector access to your Apify account (full API access, as Apify defines its scope); the plugin’s skills use it only to run CleanPull actors, read their results, read or change the watchlists they created, named cw-…, and keep your notebook if you turn it on.

Notebook (opt-in)

The plugin keeps nothing between chats unless you say yes to its notebook. If you do, the MarketMage Notebook actor writes the entries above to the marketmage-notebook key-value store in your own Apify account. It refuses amounts of your own money, email addresses, phone numbers and keys. It is kept until you delete it: ask Claude to delete it, or delete the store in the Apify Console (Storage → Key-value stores). With Apify’s default settings we can’t open it; the settings under “What we can see” that share your runs with us apply to the notebook actor’s runs too.

Our data providers (sub-processors)

For some sources, a data provider we hold an agreement with is the source of the data rather than our actors. For those, our actors send the job’s search terms to that provider, on our account, so you never need a key of your own. The provider reads the public pages and returns the data to the actor run in your account.

• The requests carry only what the job needs to find the data. We don’t add your name, email address or Apify account details to them.
• The providers keep request logs and results under their own terms; Bright Data keeps delivered results for up to 30 days. Our accounts with them let us see the requests made through them, which we use only to run, bill for and fix the service.
• The provider keys are held as encrypted secrets on Apify and are never placed in your input, logs or results.
• We also rely on Apify (the platform the actors run on), Google (the service account behind Sheets exports, below), Vercel (this website) and Google Workspace (our email). We will list any new provider here before we use it.

International transfers

We are based in the United States. Personal data we handle is processed in the United States, by us and by the services named above: Apify, Google (Google Workspace and Sheets exports), Vercel, Bright Data and ScrapeCreators. Each provider’s own terms govern its processing. Questions about this go to privacy@marketmage.io.

Business customers

Business customers with data-protection questions can write to privacy@marketmage.io.

What we can see

• By default, not your inputs or results. Runs of our actors belong to your Apify account, and with Apify’s default settings we can’t open them. Apify gives actor publishers usage statistics, such as the number of runs and events charged.
• If you turn on “Share run data with developers” (Apify Console → Settings → Login & Privacy), Apify gives us access to your runs of our public actors: their logs, input and output (datasets and key-value stores). That includes everything in them, for example the product lists you watch, the recipient email addresses and sender address in a watchlist’s input, and the results, including any review text, marketplace seller names and ad data in them. Secret fields (API keys, access tokens, passwords, webhook addresses) stay encrypted. You can turn sharing off at any time in the same place.
• If your account’s general resource access is “Anyone with ID can read” (Apify Console → Settings), anyone who has a run’s ID or link, including us, can read that run’s log, input and default storages without signing in. Apify’s default is “Restricted”. We never ask you to change either setting; when we need a run’s details, we ask you to send only what is needed.
• If you report an issue on one of our actors in Apify and include a run’s link, Apify shares that one run with us automatically, whatever your settings: its log, input, status and default storages (dataset, key-value store, request queue). Leave the link out if you would rather not share it.
• Our data providers’ logs. As described above, we can see the search terms sent through our provider accounts, without your identity attached.
• Google Sheets exports. With the default setting, Google Sheets Sync writes to a spreadsheet through a Google service account that we operate. Sharing a spreadsheet with that address gives it edit access to that spreadsheet. We use that access only when your own export run writes to it, and we don’t read or keep your spreadsheets otherwise. The first export also adds a small hidden tab, _cleanpull, holding your Apify user ID, so that runs from other Apify accounts can’t write to your spreadsheet; you can delete it, and the next export adds it again. The edit access lasts until you remove the address from the spreadsheet’s sharing (Share, then Remove access next to it); it doesn’t end when an export finishes. To avoid this, use your own Google credentials in the actor’s settings, or remove the address from the spreadsheet’s sharing.
• Delivery. Digests stay in your Apify account, and your Claude briefing reads them. If you ask for them by email, Slack, Discord, Teams or webhook, they are sent through your own email provider, SMTP server or channel. Messages don’t pass through us.

What the actors collect from the web

The actors read public product information: product pages, store catalogues, Amazon listings, search results and rankings, Google Shopping and Google Trends, TikTok Shop listings, public website technology signals, the promotions stores show, public supplier offer pages, product reviews, marketplace listings and the platforms’ public ad libraries. They are built to collect product and business data, not personal data. Where a result can include personal data, it is stored only in your Apify account, and you are responsible for how you use it:

• Reviews. Review rows carry the review’s rating, title, text, date and verified flag as the shop or marketplace shows them publicly. Review text is written by shoppers and can occasionally mention personal details. Reviewer names are off by default; the actor adds the public display name only if you turn that setting on yourself, and you should only do so with a lawful reason to process it.
• Marketplace searches. eBay results carry the seller’s username and feedback, and Etsy results the shop name. A market watchlist keeps eBay seller usernames only as salted hashes in your Apify storage between runs (to tell new sellers from ones seen before), and Etsy shop names as they are; one-off scans keep nothing between runs.
• Ads. Ad rows carry what the platforms’ public ad libraries publish: advertisers (pages and business accounts), ad text, dates, countries, reach ranges and links to the ad and its creative. Creatives are linked, never downloaded or stored.
• Catalogue matching reads only the datasets you choose for it and fetches nothing from the web.

Support emails and this website

• When you email us, we keep your email address, name, message and any attachments to answer you, for up to three years after the conversation ends, unless you ask us to delete them sooner. Our email is hosted by Google Workspace.
• This website sets no cookies, loads nothing from other servers and uses no analytics. It remembers your light or dark choice in your own browser’s storage, which never leaves your device. Our web host, Vercel, keeps standard server logs (IP address, page requested, time) for security, for a short period.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict its use, and to complain to a data protection authority. Data in your Apify account is under your control there; you can delete runs, storages, tasks and schedules at any time. For anything we hold, see data requests or email privacy@marketmage.io. We answer within 30 days. We don’t sell or share personal data for advertising.

Children

MarketMage is a business tool and isn’t meant for anyone under 18.

Changes

We will post any change here with a new effective date.

Contact

Extoris LLC, Florida, United States. Email privacy@marketmage.io.