Privacy policy

1. Data controller

Multomato Systems, Jozef Van Esschestraat 38, 2860 Sint-Katelijne-Waver, Belgium · company registration no. 1039331640 · VAT BE1039331640 · privacy enquiries: support@multomato.com.

2. What data do we process through this website?

• Contact form and lead data: name, email address, company name, VAT number (optional), subject, message and your consent. Purpose: to respond to and follow up on your enquiry. Legal basis: performance of a contract or steps prior to entering into a contract, and legitimate interest.
• Purchase and account setup: when you confirm a Marketomato subscription, you are directed to a secure payment environment. Payment and billing data is processed there and in our administration system. Full card details do not reach our servers.
• Free trial request: your chosen plan, company details (registered name, any trading name, company registration or VAT number, address), account administrator details (first name, surname, email address and optional telephone number), the versions of the legal documents you accepted or acknowledged, and the time of that acceptance as recorded by our server. Purpose: to process your trial request, create your trial workspace and register your company as a contact. Legal basis: performance of a contract at your request. No payment details are required for a trial.
• Source of your request: the campaign source and campaign parameters (UTM values), the first page you landed on within our site and the time of that visit may be stored with your request. Purpose: to understand which channels generate requests and to follow up on your request correctly. Legal basis: legitimate interest. This source data is separate from optional GA4 statistics: we never send form contents or contact details to GA4.
• Anonymous QR counts: when a QR link on our business cards, brochures or letters is opened, our server increases a daily counter for that type of printed material. This counter does not store IP addresses, browser details or visitor identifiers, and does not set or read cookies. Known automated previews and bots are excluded where possible. It measures link openings, not unique people; repeat visits may count again. The aggregate totals are publicly available and are separate from optional GA4 statistics.
• Technical data: browser and device information, log files and your cookie preference. Your IP address is temporarily processed as technical data, primarily to limit requests and prevent automated abuse of forms; we do not use it to build a visitor profile.
• Advertising measurement and retargeting (optional): only after your separate marketing consent and on public marketing pages where the Meta Pixel is enabled. This concerns your IP address, browser and device information, page visit data and pseudonymous cookie identifiers. Purpose: measure the results of our ads and reach previous website visitors again on Facebook and Instagram. Legal basis: consent. We only send a PageView event for this measurement; completed form or contact fields, passwords and activation tokens are not sent to Meta.
• Marketing (optional): if you sign up for updates, we process your email address until you unsubscribe.

3. Who do we share data with?

We only share data with service providers needed to run this website and our sales and administration processes. These are: Lovable Labs Incorporated for hosting and deployment of this website and its basic project analytics; Odoo S.A. (Belgium) for administration, invoicing and the follow-up of contact and trial requests; Stripe Payments Europe, Ltd. (Ireland) for processing payments, which takes place in the secure payment environment and not on this website; Google Ireland Ltd. for Google Tag Manager and Google Analytics 4 — Google Tag Manager loads after your consent to statistics or marketing, Google Analytics 4 only after your consent to statistics; and Postmark (Wildbit LLC) together with Google Workspace for sending transactional email. If the Meta Pixel is enabled on a public marketing page and you separately consent to marketing, Meta Platforms Ireland Ltd. receives data about your page visit for advertising measurement and retargeting via Facebook and Instagram. We do not sell your data.

Meta may link the visit data it receives to a Meta account and combine them with other data to personalise ads. You can withdraw your marketing consent at any time via Cookie preferences in the footer. From then on, we do not send new Meta page events. For further processing by Meta and your rights in relation to Meta, please see the Meta privacy policy.

Once your workspace has been created in Marketomato, the application itself processes data using other service providers, including for AI processing, media storage and the connection to Facebook and Instagram. These are described in full in the Marketomato privacy notice at marketomato.multomato.com/privacy.

4. Odoo (administration, invoicing and following up on contact requests)

We use Odoo for our administration, invoicing and following up on contact requests. When you complete the contact form on this site, the details you enter — your name, email address and, if provided, your company name, telephone number and message — are sent to our Odoo environment and stored there as a contact request.

We process this data on the basis of our legitimate interest in responding to your enquiry and following up with you as a potential business customer. If you also tick the newsletter box, we process your email address for marketing messages on the basis of your consent. You can withdraw that consent at any time using the unsubscribe link in each newsletter or by contacting us.

The processor is Odoo S.A., Chaussée de Namur 40, 1367 Grand-Rosière, Belgium. The data processing agreement with Odoo forms an integral part of the Odoo Enterprise Subscription Agreement.

Odoo documents its primary production and backup locations within the European Economic Area: production in France and Belgium, and backups in France, the Netherlands and Sweden, through OVH S.A.S. and Google Cloud EMEA Ltd. The safeguards in section 6 apply to support, sub-processors and any transfers outside the EEA.

We retain contact requests that do not lead to a customer relationship for a maximum of 24 months after the last contact. They are then deleted.

5. Data during a free trial

Once the connection to the Marketomato backend is operational, your trial request uses your details to create a contact record in our Odoo administration system and a workspace in the Marketomato application. No Odoo login, order or invoice is created, and no payment details are required.

To check that each company receives no more than one free trial within the applicable three-year period, we derive a limited, pseudonymous verification value from your normalised company registration or VAT number. We use it solely to recognise a new request for the same company and refuse it if necessary, and do not share it with third parties for that purpose. The legal basis is our legitimate interest in protecting our service against repeated free use and automated registrations.

The VAT number provided is submitted to the European Commission’s VIES service (VAT Information Exchange System) for verification. This allows us to establish that the applicant is a registered business and prevent the same company from taking multiple free trials. Only the VAT number is transmitted for this purpose, with no other data.

We retain this verification value for a maximum of three years from the end of your trial if no paid subscription follows, or a maximum of three years from the end of the customer relationship if you become a customer. It is then deleted automatically, allowing a new request to be made.

We limit the number of requests per visitor. To do this, the website proxy uses your IP address solely as a key for that rate limit, briefly in the server’s working memory and for no longer than the one-hour technical rate-limit window. We do not store it in a database or use it to profile or track you. The Marketomato backend and our security systems have their own log retention periods, which are described in the Marketomato privacy notice.

What happens to your data during and after the trial, and which processors are involved — including the AI processors that process your images and text — is described in the Marketomato privacy policy at marketomato.multomato.com/privacy. That policy applies as soon as your workspace has been created.

6. Transfers outside the EEA

Odoo processes data within the European Economic Area: production in France and Belgium, and backups in France, the Netherlands and Sweden. Stripe Payments Europe is based in Ireland. Google Ireland Ltd. is our contracting data controller for Analytics within the EU; Google may also process data in the United States under the EU-US Data Privacy Framework. Where Lovable Labs Incorporated processes personal data outside the EEA, this is based on the standard contractual clauses in the data processing agreement that forms part of our agreement with Lovable.

Meta may also process visit data it receives outside the EEA. Its privacy policy describes its international transfers and the safeguards it uses for them.

The core hosting and storage of the Marketomato application are provided by Hetzner Online GmbH in Germany. AI processing of images and text is carried out by specialist providers that process some data outside the European Union; the providers concerned and the applicable safeguards are set out in the Marketomato privacy notice.

7. Retention periods

• Lead data and contact records in Odoo: a maximum of 24 months after the last contact if no customer relationship is established.
• Workspace and content from a trial without a paid subscription: for the thirty-day trial period and up to ninety calendar days afterwards, to allow restoration. We then delete them automatically.
• The pseudonymous verification value used to prevent duplicate trials: a maximum of three years from the end of your trial, or a maximum of three years from the end of the customer relationship if you became a customer.
• IP address in the website proxy: only briefly in working memory, for no longer than the one-hour rate-limit window.
• Billing and accounting data: the statutory retention period.
• Server, hosting and security logs for this website: in accordance with our hosting provider’s retention periods. The Marketomato privacy notice applies to logs from the Marketomato application.
• Data for email updates: until you unsubscribe.
• Meta cookies on our domain: up to 90 days each time they are set or renewed, only after marketing consent. The Meta privacy policy governs retention periods for data already received by Meta.

8. Your rights

Rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent. Email support@multomato.com. We will respond to your request within one month of receipt. If your request is complex or you make several requests, we may extend this period by up to two months; we will let you know within the first month. You can also lodge a complaint with the Belgian Data Protection Authority.

9. Cookies

See our Cookie policy.

10. Changes and contact

We may update this policy; the current version is always available on this page with its date. Questions? support@multomato.com.