Privacy Policy

We collect:

• Account info (Email, Name; profile picture when you sign in with Google).
• Usage data (Logs, Feature interaction).
• Input data (App Store URLs, connected integrations) to build your AppWiki.

Providing your account information (email and name) is necessary to create an account and use the Service; without it we cannot provide the Service. Analytics and marketing data are optional and, where required, based on your consent — declining does not affect your access to core features.

Sign in with Google. When you sign in with Google (including the Google One Tap prompt), Google processes the sign-in as an independent controller under its own privacy policy and provides us with your email address, name and profile picture, which we use to create, identify and secure your account. Google is not a Marlvel sub-processor for this sign-in.

The data controller responsible for your personal data is MARLVEL.AI. For any privacy-related request, contact us at [email protected]. Full company details are set out in our Legal Notice.

We process your personal data for specific purposes, each under a defined GDPR Article 6 legal basis:

• Account creation, authentication & delivery of the Service — performance of a contract (Art. 6(1)(b)).
• Billing, payments & tax / accounting records — legal obligation (Art. 6(1)(c)) and performance of a contract (Art. 6(1)(b)).
• Security, rate-limiting & abuse prevention — legitimate interests (Art. 6(1)(f)) in protecting the platform and its users.
• Product analytics & session recording — usage analytics collected in your browser are anonymous and cookieless and rely on our legitimate interests (Art. 6(1)(f)); the browser-side analytics profile that identifies you when you are signed in, and session recording, rely on your consent (Art. 6(1)(a)) in regulated jurisdictions, and run on an opt-out basis where consent is not legally required. Separately, our servers record the account events that make up the Service — sign-in, account and organisation creation, subscription and billing milestones, apps added, AI answers delivered — and send them to PostHog under your account identifier, whatever your cookie choice; PostHog builds a profile of your account from them (see Section 4). These server-side events are produced by us, not by your device, and nothing is written to or read from your device to produce them: they rely on performance of the contract (Art. 6(1)(b)) for the events that record the Service itself, and on our legitimate interests (Art. 6(1)(f)) in measuring and operating it. You may object at any time under Art. 21 (Section 7).
• Service & account communications and customer support — transactional and lifecycle emails, email you send to your app's Marlvel inbox address, in-product messaging, and Slack / WhatsApp where you connect them — performance of a contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)) in operating the Service and providing support. When you follow an app, publisher or ranking, we email you about changes to it (performance of a contract, Art. 6(1)(b)); you can stop these emails at any time from Settings → Notifications or the unsubscribe link in every such email. Lifecycle emails (welcome, subscription and trial updates) can be stopped the same way. Essential account emails (sign-in, security, billing) are always sent.
• AI features (building your AppWiki, answering in-product queries, transcribing voice messages you send through WhatsApp) — performance of a contract (Art. 6(1)(b)).
• Marketing & product communications — consent (Art. 6(1)(a)), which you may withdraw at any time.

We use a geo-aware two-level consent model. Whether you see a cookie banner on your first visit depends on your jurisdiction:

Where the banner is shown (opt-in)

• EU 27 + EEA (Iceland, Liechtenstein, Norway), United Kingdom, Switzerland: GDPR / UK GDPR / FADP require explicit opt-in before non-essential analytics.
• Visitors whose browser sends the Global Privacy Control signal (Sec-GPC: 1, default in Brave / DuckDuckGo, opt-in in Firefox 110+) regardless of jurisdiction.

Where the banner is not shown (opt-out)

• United States and the rest of the world: enhanced analytics fire by default. You can opt out at any time using the "Cookie Settings" link in the footer.
• This satisfies California CCPA / CPRA, Virginia CDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, and similar US state privacy laws, which require an opt-out mechanism rather than pre-tracking consent.

Level 1 — Always on (no consent required)

• PostHog — Usage analytics collected in your browser, anonymous and cookieless for all visitors, including signed-in users: no analytics cookies or local storage are written, and nothing your browser sends identifies you at this level. The browser-side analytics profile linked to your account (e.g. account ID, plan and organisation role) is only created at Level 2 — with your consent, or by default in opt-out jurisdictions. Session recording remains off at this level. This level governs your browser only; the events our own servers send to PostHog are described at the end of this section.
• Sentry — Error monitoring and crash reporting (legitimate interest). No personal data is collected beyond technical error details.

Level 2 — Enhanced analytics (consent required in regulated jurisdictions, default elsewhere)

• PostHog — Identified user profiles for personalized analytics, including session recording with input masking (see §6 below for details).
• Sentry Session Replay — A masked replay of a small sample of sessions (all text masked, media blocked) to diagnose errors (see §6 below for details).
• Amplitude — Product analytics to understand feature usage.
• Google Analytics 4 — Event tracking for app performance insights.

What these levels do not cover. Levels 1 and 2 govern what runs in your browser. Events our own servers record about your account — sign-in, account and organisation creation, subscription and billing milestones, apps added, AI answers delivered, and the automatic deletion of an account that was never activated — are sent to PostHog under your account identifier regardless of the level you choose, because they are produced by our servers and neither write to nor read from your device. PostHog holds them as a profile of your account. Before an account exists, a small number of sign-up events are sent the same way, keyed to a one-way hash of the email address you entered rather than to the address itself — a pseudonym, not anonymous data: it cannot be read back as your address, but a party holding both the hash and your address could match them; when you then sign in, we tell PostHog that this code and your account are the same person, so that the two sets of events are joined. These events never carry your raw email address (we send its domain only), your name, or the content of your messages or of the AI answers. They are kept as analytics data under Section 9, and you may object to them at any time under Art. 21 by writing to [email protected] (Section 7).

You can change your consent at any time via the "Cookie Settings" link in the page footer. Clicking it re-opens the consent banner regardless of your jurisdiction so you can choose again.

We protect our authentication endpoints and platform against automated abuse (bots, credential stuffing, spam) using network-level protection, a privacy-preserving bot check on sign-in, and rate-limiting and abuse-detection measures.

• Network-level protection at our edge provider (Cloudflare): all traffic to the Service passes through Cloudflare's edge network, which provides DDoS protection, bot mitigation and rate-limiting before requests reach our infrastructure.
• Network-level rate limiting at our cloud provider (Google Cloud Armor) further throttles abusive request volumes before they reach the application.
• Bot check on sign-in: the sign-in form runs a Cloudflare Turnstile challenge instead of a traditional CAPTCHA. It is privacy-preserving and mostly invisible; it may occasionally show a short interactive check. The challenge token is verified with Cloudflare together with your IP address.
• Application-level rate limiting and same-origin request validation further restrict automated and cross-origin abuse of sensitive endpoints (sign-in, sign-up, account actions).
• These controls process technical request metadata such as your IP address and user agent for the sole purpose of security.
• Legal basis: Legitimate interest (security of our platform and users' accounts).
• No separate consent is required as this is a strictly necessary security measure.

Session recording is enabled only at Level 2 consent (when you click "Accept" on the cookie banner, or are auto-granted in non-regulated jurisdictions). It is delivered by PostHog and masks sensitive inputs by default.

• What is recorded: page-level interactions (clicks, scrolls, navigation, viewport changes) for product improvement.
• What is masked: all <input> values, with stricter masking on password and email fields. Form submissions are not captured.
• What is excluded: recording is disabled at Level 1 (browser analytics stay anonymous there).
• Storage: recordings are stored on PostHog's EU cloud (Frankfurt, Germany; https://eu.i.posthog.com). PostHog, Inc. is a US company: where it accesses recordings from outside the EU, for example to provide support, the transfer is covered by Standard Contractual Clauses / the EU-US Data Privacy Framework. Recordings are deleted automatically after 30 days (see §9); those made before the effective date of this version stay on PostHog's US cloud until that deletion.
• Opt-out: use the "Cookie Settings" link in the footer at any time to downgrade to Level 1, which disables session recording for the remainder of the session and on all future visits.

Sentry Session Replay is likewise enabled only at Level 2. It is sampled (about 1% of sessions, and 10% of sessions in which an error occurs), all text is masked and media is blocked, and the replay is stored by Sentry in the European Union (Germany) solely to diagnose errors. It is turned off when you downgrade to Level 1.

We retain your data for as long as necessary to provide our services:

• Account data — Retained for the lifetime of your account. Deleted upon account deletion request.
• Incomplete signups — If you start creating an account but never accept the Terms, the account is never activated. We delete it automatically 60 days after it was created, together with the organisation created for it — unless that organisation has other members, in which case it is handed over to one of them, and the apps, publishers and rankings it follows stay with that organisation. No reminder is sent before this deletion. You can ask us to delete the account sooner at any time by writing to [email protected].
• Analytics data — Retained for up to 24 months, then automatically aggregated or deleted.
• Session recordings — PostHog recordings are automatically deleted after 30 days; Sentry Session Replay recordings after 90 days.
• Server logs — Retained for up to 90 days for security, debugging and reliability.
• Billing, payment & tax / accounting records — Retained for the period required by applicable accounting and tax law (up to 10 years in France).
• Security & abuse-prevention logs (IP address, user agent) — Retained for up to 12 months.
• Email delivery log (recipient address, template, subject line, delivery status) — 90 days, and anonymised immediately when you delete your account.

Your data may be processed by our sub-processors in different regions:

• EU-based — Amplitude, PostHog (EU cloud, Frankfurt) and Sentry (EU data region, Germany).
• US-based — Google Cloud Platform, Cloudflare, Google Analytics 4, Google Workspace, Anthropic, Google, OpenAI, ElevenLabs, Stripe, Resend, Slack (Salesforce), Meta / WhatsApp Cloud API, LangSmith (LangChain), Firecrawl, QuickChart.

PostHog analytics data collected before the effective date of this version remains on PostHog's US cloud, under Standard Contractual Clauses and the EU-US Data Privacy Framework, and is deleted within twelve months of that date.

Where data is transferred outside the EU/EEA, we rely on Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework where applicable to ensure adequate data protection. QuickChart is the exception: the chart data sent to it for rendering is not covered by SCCs or the Data Privacy Framework (see Section 11).

We use the following trusted sub-processors:

• Google Cloud Platform — Hosting (Cloud Run), database (Cloud SQL), storage, and infrastructure (United States; SCCs / DPF).
• Cloudflare, Inc. — Edge network, DDoS protection and bot mitigation (including the Turnstile challenge on our sign-in, sign-up and account-linking forms); processes technical request metadata such as IP address and user agent (United States; SCCs / DPF).
• PostHog — Product analytics and feature flags (European Union, Germany; hosted on PostHog Cloud EU, Frankfurt. Where PostHog, Inc., a US company, accesses the data from outside the EU, for example to provide support, the transfer is covered by SCCs / DPF. Data collected before the effective date of this version remains on PostHog's US cloud, under SCCs / DPF, and is deleted within twelve months of that date).
• Amplitude — Product analytics (with consent) (European Union; processed in the EU).
• Sentry — Application error monitoring, performance tracking and masked session replay (Level 2 consent) (European Union, Germany; processed in the EU).
• Google Analytics 4 — Event tracking (with consent) (United States; SCCs / DPF).
• QuickChart (quickchart.io) — Rendering of chart images for reports delivered to Slack, WhatsApp and email. Full chart definitions (titles, labels and numeric series from your reports, such as app names, downloads, ratings and revenue) are posted to a public rendering endpoint that we call without an account or a written contract; no Standard Contractual Clauses or other written data-protection terms are in place with this provider (United States; no SCCs).
• Anthropic / Google / OpenAI — Large language model providers for AI features; Google (Gemini) also transcribes voice messages sent through WhatsApp and generates embeddings from conversation topics (titles, summaries and recent message content) and from in-product queries (United States; SCCs / DPF).
• ElevenLabs — Voice AI provider for speech-to-text and text-to-speech in voice features (United States; SCCs).
• Google Workspace — Company e-mail and office suite, including messages you send to [email protected] and [email protected] (such as data-protection requests), and internal documents and calendars (United States; SCCs / DPF).
• Resend — Transactional and account email delivery, and receipt and storage of inbound email sent to your app's Marlvel inbox address (United States; SCCs).
• Stripe — payment processing and billing (United States; SCCs).
• Slack (Salesforce, Inc.) — workspace messaging integration and operational alerting (United States; SCCs).
• Meta Platforms, Inc. / WhatsApp Cloud API — messaging delivery for users who connect via WhatsApp (United States; SCCs).
• LangSmith (LangChain, Inc.) — AI tracing and observability (the prompts sent to and outputs returned by the language models, when tracing is enabled) and user feedback on AI answers (your ratings, comments and suggested corrections), for debugging and quality improvement (United States; SCCs).
• Firecrawl (Mendable, Inc.) — web content retrieval and web search to answer in-product queries (United States; SCCs).

With the exception of QuickChart (a public rendering endpoint used without a written contract, as stated in its entry above), all sub-processors adhere to strict security standards (SOC2/GDPR where applicable).

Third-party tools you connect

When you or your organisation connect an integration or an AI tool server to Marlvel (for example PostHog, Amplitude, Stripe, Intercom, Mixpanel, AppsFlyer or RevenueCat), the credentials you provide for that tool and the requests generated from your conversations with the AI (for example a query for your own app analytics) are transmitted to that provider. That provider processes them on your instruction and under your own agreement with it, as your provider: it is not a Marlvel sub-processor, and this is distinct from our own use of PostHog, Amplitude and Stripe listed above.

The Service is not directed to children under 16, and we do not knowingly collect their personal data; contact [email protected] to request deletion.

For privacy inquiries, data access, or deletion requests: [email protected]