Privacy Policy

Account Information. When you create an account, we collect your name, email address, and password. If you create a workspace, we also collect your business name and branding preferences.

Client Data. As an agency user, you may store information about your clients, including their names, email addresses, company names, project details, files, messages, and payment records. You are the data controller for your client data, and we process it on your behalf.

Usage Data. We automatically collect information about how you interact with the Service, including pages visited, features used, browser type, device information, and IP address.

Payment Information. If you use our paid plans or payment features, payment processing is handled by Stripe. We do not store your full credit card number. Stripe’s privacy policy governs the handling of your payment information.

• To provide, maintain, and improve the Service
• To create and manage your account
• To process transactions and send related information
• To send transactional emails (account verification, password resets, status updates, client notifications)
• To respond to your inquiries and provide customer support
• To monitor and analyze usage patterns to improve user experience
• To detect, prevent, and address technical issues and security threats

We do not sell your personal information to third parties. We do not use your data for advertising purposes.

We use the following third-party services to operate the platform:

• Supabase — Database hosting and user authentication
• Stripe — Payment processing (only if you enable payments)
• Resend — Transactional email delivery
• Vercel — Application hosting
• Sentry — Error monitoring and performance tracking

Each third-party service has its own privacy policy governing its use of your data. We only share the minimum information necessary for each service to function.

We use essential cookies to maintain your authentication session and preferences. We do not use third-party advertising cookies or cross-site tracking. You can configure your browser to refuse cookies, but some features of the Service may not function properly without them.

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required by law to retain certain information. Client data stored within workspaces is retained until the workspace owner deletes it or closes their account.

We implement industry-standard security measures to protect your data, including encryption in transit (TLS/SSL), secure authentication, and access controls. However, no method of electronic transmission or storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee its absolute security.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — Request a copy of the personal data we hold about you
• Correction — Request that we correct inaccurate or incomplete data
• Deletion — Request that we delete your personal data
• Portability — Request a machine-readable copy of your data
• Objection — Object to the processing of your personal data

To exercise any of these rights, please contact us at the email address below. We will respond to your request within 30 days.

If you are located in the European Economic Area (EEA), we process your personal data based on the following legal bases: (a) your consent, (b) the performance of a contract with you, (c) compliance with legal obligations, or (d) our legitimate interests that do not override your rights. You have the right to lodge a complaint with your local data protection authority.

Under the California Consumer Privacy Act (CCPA), California residents have the right to know what personal information is collected, request deletion of personal information, and opt out of the sale of personal information. We do not sell personal information. To exercise your CCPA rights, contact us at the email address below.

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that information.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the “Last updated” date. Your continued use of the Service after any changes constitutes your acceptance of the updated policy.

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us at:

Email: privacy@marcavo.com
Website: marcavo.com/contact