Privacy Policy

We collect:

• Account info (Email, Name).
• Usage data (Logs, Feature interaction).
• Input data (App Store URLs, connected integrations) to build your AppWiki.

Providing your account information (email and name) is necessary to create an account and use the Service; without it we cannot provide the Service. Analytics and marketing data are optional and, where required, based on your consent — declining does not affect your access to core features.

The data controller responsible for your personal data is MARLVEL.AI. For any privacy-related request, contact us at [email protected]. Full company details are set out in our Legal Notice.

We process your personal data for specific purposes, each under a defined GDPR Article 6 legal basis:

• Account creation, authentication & delivery of the Service — performance of a contract (Art. 6(1)(b)).
• Billing, payments & tax / accounting records — legal obligation (Art. 6(1)(c)) and performance of a contract (Art. 6(1)(b)).
• Security, rate-limiting & abuse prevention — legitimate interests (Art. 6(1)(f)) in protecting the platform and its users.
• Product analytics & session recording — anonymous, cookieless usage analytics (no profile, no identification) rely on our legitimate interests (Art. 6(1)(f)). Enhanced analytics — including the first-party analytics profile that identifies you when you are signed in, and session recording — rely on your consent (Art. 6(1)(a)) in regulated jurisdictions, and run on an opt-out basis where consent is not legally required.
• Service & account communications and customer support — transactional and lifecycle emails, in-product messaging, and Slack / WhatsApp where you connect them — performance of a contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)) in operating the Service and providing support.
• AI features (building your AppWiki, answering in-product queries) — performance of a contract (Art. 6(1)(b)).
• Marketing & product communications — consent (Art. 6(1)(a)), which you may withdraw at any time.

We use a geo-aware two-level consent model. Whether you see a cookie banner on your first visit depends on your jurisdiction:

Where the banner is shown (opt-in)

• EU 27 + EEA (Iceland, Liechtenstein, Norway), United Kingdom, Switzerland: GDPR / UK GDPR / FADP require explicit opt-in before non-essential analytics.
• Visitors whose browser sends the Global Privacy Control signal (Sec-GPC: 1, default in Brave / DuckDuckGo, opt-in in Firefox 110+) regardless of jurisdiction.

Where the banner is not shown (opt-out)

• United States and the rest of the world: enhanced analytics fire by default. You can opt out at any time using the "Cookie Settings" link in the footer.
• This satisfies California CCPA / CPRA, Virginia CDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, and similar US state privacy laws, which require an opt-out mechanism rather than pre-tracking consent.

Level 1 — Always on (no consent required)

• PostHog — Usage analytics, anonymous and cookieless for all visitors, including signed-in users: no analytics cookies or local storage are written, no personal profile is created and you are never identified at this level. The first-party analytics profile linked to your account (e.g. account ID, plan and organisation role) is only created at Level 2 — with your consent, or by default in opt-out jurisdictions. Session recording remains off at this level.
• Sentry — Error monitoring and crash reporting (legitimate interest). No personal data is collected beyond technical error details.

Level 2 — Enhanced analytics (consent required in regulated jurisdictions, default elsewhere)

• PostHog — Identified user profiles for personalized analytics, including session recording with input masking (see §6 below for details).
• Amplitude — Product analytics to understand feature usage.
• Google Analytics 4 — Event tracking for app performance insights.

You can change your consent at any time via the "Cookie Settings" link in the page footer. Clicking it re-opens the consent banner regardless of your jurisdiction so you can choose again.

We protect our authentication endpoints and platform against automated abuse (bots, credential stuffing, spam) using rate-limiting and abuse-detection measures, rather than a visible CAPTCHA.

• Network-level rate limiting at our infrastructure provider (Google Cloud Armor) throttles abusive request volumes before they reach the application.
• Application-level rate limiting and same-origin request validation further restrict automated and cross-origin abuse of sensitive endpoints (sign-in, sign-up, account actions).
• These controls process technical request metadata such as your IP address and user agent for the sole purpose of security.
• Legal basis: Legitimate interest (security of our platform and users' accounts).
• No separate consent is required as this is a strictly necessary security measure.

Session recording is enabled only at Level 2 consent (when you click "Accept" on the cookie banner, or are auto-granted in non-regulated jurisdictions). It is delivered by PostHog and masks sensitive inputs by default.

• What is recorded: page-level interactions (clicks, scrolls, navigation, viewport changes) for product improvement.
• What is masked: all <input> values, with stricter masking on password and email fields. Form submissions are not captured.
• What is excluded: recording is disabled at Level 1 (anonymous analytics only).
• Storage: recordings live in PostHog's EU infrastructure (https://eu.i.posthog.com) and are deleted automatically after 90 days (see §9).
• Opt-out: use the "Cookie Settings" link in the footer at any time to downgrade to Level 1, which disables session recording for the remainder of the session and on all future visits.

We retain your data for as long as necessary to provide our services:

• Account data — Retained for the lifetime of your account. Deleted upon account deletion request.
• Incomplete signups — If you start creating an account but never accept the Terms, the account is never activated. We delete it automatically 30 days after it was created, together with everything created for it (the organisation, any follows, and the account itself). You can also delete it immediately using the link in the reminder email we send.
• Analytics data — Retained for up to 24 months, then automatically aggregated or deleted.
• Session recordings — Automatically deleted after 90 days.
• Server logs — Retained for up to 90 days for security, debugging and reliability.
• Billing, payment & tax / accounting records — Retained for the period required by applicable accounting and tax law (up to 10 years in France).
• Security & abuse-prevention logs (IP address, user agent) — Retained for up to 12 months.

Your data may be processed by our sub-processors in different regions:

• EU-based — Amplitude and PostHog (EU server zone).
• US-based — Google Cloud Platform, Sentry, Google Analytics 4, Anthropic, Google, OpenAI, ElevenLabs, Stripe, Resend, Slack (Salesforce), Meta / WhatsApp Cloud API, LangSmith (LangChain), Brave Search, Firecrawl.

Where data is transferred outside the EU/EEA, we rely on Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework where applicable to ensure adequate data protection.

We use the following trusted sub-processors:

• Google Cloud Platform — Hosting (Cloud Run), database (Cloud SQL), storage, and infrastructure (United States; SCCs / DPF).
• PostHog — Product analytics and feature flags (European Union; processed in the EU).
• Amplitude — Product analytics (with consent) (European Union; processed in the EU).
• Sentry — Error monitoring and performance tracking (United States; SCCs).
• Google Analytics 4 — Event tracking (with consent) (United States; SCCs / DPF).
• Anthropic / Google / OpenAI — LLM providers for AI features (United States; SCCs / DPF).
• ElevenLabs — Voice AI provider for speech-to-text and text-to-speech in voice features (United States; SCCs).
• Resend — Transactional email delivery (United States; SCCs).
• Stripe — payment processing and billing (United States; SCCs).
• Slack (Salesforce, Inc.) — workspace messaging integration and operational alerting (United States; SCCs).
• Meta Platforms, Inc. / WhatsApp Cloud API — messaging delivery for users who connect via WhatsApp (United States; SCCs).
• LangSmith (LangChain, Inc.) — AI tracing and observability (debugging and quality monitoring) (United States; SCCs).
• Brave Search (Brave Software, Inc.) — web search to answer in-product queries (United States; SCCs).
• Firecrawl (Mendable, Inc.) — web content retrieval (United States; SCCs).

All sub-processors adhere to strict security standards (SOC2/GDPR where applicable).

The Service is not directed to children under 16, and we do not knowingly collect their personal data; contact [email protected] to request deletion.

For privacy inquiries, data access, or deletion requests: [email protected]