Privacy Policy

For account, billing and website-visitor data we are the controller. For the data a business stores in its workspace about its own customers ("Customer Data") the business is the controller and we act as its processor, following its instructions and our Terms & Conditions.

If you are a customer of a business that uses Marlon Labs, please contact that business first about your data; we will support it in answering your request.

• Account data: name, email address and profile picture from Google sign-in, your role and workspace.
• Verification data: your date of birth is used once to confirm you are old enough to use the platform and is not stored; we keep the date and time of the check.
• Consent records: which version of each legal document you accepted, when, a hashed IP address and your browser’s user-agent.
• Billing data: subscription and top-up history, invoices and payment status (card details are handled by our payment processors).
• Usage data: features used, AI-credit usage and technical logs needed for security and support.
• Customer Data that businesses add: contacts, messages, bookings, orders, files and similar records.

• to provide, secure and support the platform and the workspaces in it (contract);
• to bill subscriptions and AI credits and keep accounting records (contract, legal obligation);
• to prevent fraud and abuse and to keep the platform secure (legitimate interests);
• to send service messages, and marketing email only if you opted in — every marketing email has a one-click unsubscribe link (consent);
• to improve the product with aggregated statistics, and with analytics cookies only after you allow them (consent).

We do not sell personal data and do not use Customer Data to advertise to anyone.

Essential cookies keep you signed in and remember your privacy choice. Analytics cookies — including session replay, in which form inputs and workspace content are masked — load only after you select "Allow analytics" in the privacy banner. Cookie-free, aggregated page statistics may be collected without cookies.

You can change your choice at any time through the "Privacy choices" link in the footer. Withdrawing consent stops future collection.

We share data only with service providers that help us run the platform, in these categories: cloud hosting, database and storage; content delivery and domains; email delivery; messaging-channel connectivity; payment processing; AI language, speech, image and video processing; error monitoring; and analytics (with consent). They may use the data only to provide their service to us.

We may disclose data when required by law, to protect rights and safety, or as part of a merger or acquisition with continued protection.

Iraq: personal data of workspaces in Iraq is processed in line with applicable Iraqi law, including the constitutional protection of privacy and of the confidentiality of communications.

United Arab Emirates: we comply with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL). Personal data leaves the UAE only for jurisdictions or under conditions permitted by the PDPL, with contractual safeguards where required.

Data may be stored in data centres outside your country; the protections in this policy apply wherever it is processed.

We keep account data while your account is active and afterwards only as long as needed for legal, tax and dispute purposes. Businesses decide how long Customer Data is kept; after a workspace is closed we delete its Customer Data within a reasonable period. Temporary uploads (for example raw video and import files) are purged automatically.

The platform is not directed to children. We do not knowingly create accounts for people under 13; if a sign-up shows the person is younger, the account is closed and its data deleted immediately.

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict processing, and to withdraw consent at any time. You may also complain to your data-protection authority.

To exercise a right, email legal@marlonlabs.com. We answer within the time the applicable law requires.

Workspaces are isolated at the database level, secrets are encrypted at rest, sensitive files are served through short-lived signed links and analytics never records workspace content. No system is perfectly secure; we will notify affected customers and authorities of a breach as the law requires.

We will post updates here and ask signed-in users to accept material changes. This policy is governed by the laws of [JURISDICTION].

Contact: [MARLON LABS LEGAL ENTITY], [REGISTERED ADDRESS] · legal@marlonlabs.com.