Draft — pending lawyer review. Not legal advice.
Privacy
This privacy note is a draft for a platform that expects users in North Macedonia, the European Union and the United States. It must be reviewed against the EU GDPR and North Macedonia’s Law on Personal Data Protection before launch. It is not legal advice.
1. Who is responsible
The intended controllers are RIS Group DOOEL, Bitola, North Macedonia, and a US entity to be named. Until counsel confirms the split, treat both as jointly responsible for account, verification and deal records on this preview.
2. What we store
Account data (name, email, password hash), organisation profile, EMBS, uploaded registry extracts and IDs, listings and bids you write, messages, NDA acceptances (time, IP address, browser string, text version), document-access logs, deal and fee fields, and advertising inquiries. Sponsor statistics are counts of impressions and clicks, not a profile of you sold to advertisers.
3. Why
To run the marketplace and administer an account (contract). To check companies, keep an audit trail of introductions and protect confidential files (legitimate interests and, where a law requires a record, legal obligation). To answer a partnership inquiry you send us (contract or steps before a contract). We do not sell personal data.
4. Processors
Hosting may be Vercel. The database may be SQLite on a single server in development, or Postgres (for example Neon or Supabase) in production. Files may be on that server or in Cloudflare R2. Email, when enabled, may go through Resend. Card payments, when enabled in a later phase, may go through Stripe. Each vendor needs a processing agreement before production use. This preview stores files locally when R2 keys are not set.
5. How long, and your rights
Account data is kept while the account is open and for a limited period afterwards so deals and the non-circumvention record can be shown. You can ask for access, correction or deletion, subject to records we must keep. You can complain to the Agency for Personal Data Protection in North Macedonia, or to an EU supervisory authority if the GDPR applies to you. Email the address on the inquiry form and mark the message “privacy”.
6. Transfers
Reviewers and buyers may be outside North Macedonia, so profile text you publish is visible across borders. Private documents are not. Infrastructure may sit in the US or the EU. Cross-border transfer tools (such as standard contractual clauses) are to be confirmed with counsel before launch.
7. Intake assistant
If you tick the consent box, MostMK stores the chat, your email, attached files and the extracted application so it can match services and example funding calls. In demo mode the replies are scripted on this server and are not sent to a model. If OPENAI_API_KEY or ANTHROPIC_API_KEY is set, the conversation text may be sent to that provider to draft a reply. Prices still come from the MostMK service menu. You can ask for access or deletion, subject to records we must keep.