Privacy Policy

This policy covers makeitmarlow.com and the Marlow application ("Marlow", "we", "us"). For content you create inside a workspace, your organization is typically the data controller and Marlow acts as processor on its behalf. For your account and billing information, we are the controller. For any privacy question, contact security@makeitmarlow.com.

Your organization retains ownership of the maps, documentation, attachments, and other content you create in Marlow. We do not claim ownership of it, and we do not use it to train advertising or third-party models.

We access customer content only when necessary to operate, support, troubleshoot, secure, or improve the service, or when required by law.

We don't ask for special-category data (health, biometric, political, religious, or similar information) and Marlow is not designed to hold it. Please don't put it into your maps.

• Providing the service: authenticating you, storing and syncing your maps, and showing collaborators the right content.
• Collaboration features: invitations, mentions, comments, questions, and notification emails you can control in your settings.
• Security and abuse prevention: detecting unauthorized access, investigating incidents, and maintaining audit trails.
• Support: answering your questions and debugging problems you report.
• Billing: managing subscriptions, invoices, and tax records.
• Product improvement: understanding aggregate usage patterns and fixing errors. We do not build advertising or behavioural profiles.

• Contract — to provide the service you or your organization signed up for.
• Legitimate interests — to keep the service secure, prevent abuse, and improve reliability, balanced against your privacy.
• Legal obligation — to retain billing and tax records.
• Consent — where we ask for it explicitly, such as optional product-update emails. You can withdraw consent at any time.

We share personal data only with the subprocessors below, each bound by contract to process it on our instructions and only for the stated purpose.

We keep this list current and will update it when our subprocessors change. We may also disclose data if legally required by valid legal process, or in connection with a merger or acquisition — in which case this policy continues to apply to the transferred data. We do not sell personal data and do not share it for cross-context behavioural advertising, and selling customer data is not part of Marlow's business model.

Marlow does not use advertising cookies, third-party analytics, or tracking pixels. We use only strictly necessary storage — a session cookie or local session token that keeps you signed in, and preference storage that remembers interface choices. Because we set no non-essential cookies, we don't show a consent banner. If that changes we will update this policy and ask for consent where the law requires it.

Retention periods are targets for how long we keep each category of data, not guarantees of instant deletion at the moment a period ends. Where deletion happens on a schedule, data may persist briefly beyond the stated window before it is removed.

Marlow is hosted in the United States. If you are in the EU, UK, or Australia, your data is transferred to and processed in the US. For EU and UK transfers we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) with our subprocessors, together with the technical measures described on our Security page. You can request a copy of the relevant transfer terms by emailing us.

• Access — get a copy of the personal data we hold about you.
• Correction — fix inaccurate or incomplete data, most of which you can edit directly in your account.
• Deletion — delete your account and associated content, subject to the retention periods above.
• Portability — export your maps and receive your data in a machine-readable format.
• Objection and restriction — object to processing based on legitimate interests, or ask us to restrict it.
• Withdraw consent — for anything we process on the basis of consent.
• Complain — to your local data protection authority (in the UK, the ICO; in Australia, the OAIC).

Email security@makeitmarlow.com to exercise any of these. We respond as promptly as we can and within the time limits required by applicable law, and we never charge a fee or discriminate against you for asking. If your data sits inside an organization's workspace, we may need to route the request through that organization as controller — we'll tell you if so.

• EU / UK (GDPR, UK GDPR): legal bases, transfer mechanisms, and rights are described above. We can enter into a Data Processing Addendum with business customers where one is required.
• California (CCPA/CPRA): in the past 12 months we have not sold personal information and have not shared it for cross-context behavioural advertising, and we will not do so. We collect the categories of identifiers, commercial information, and internet activity described above. California residents have rights to know, delete, correct, and limit use of sensitive personal information; we do not use or disclose sensitive personal information for purposes beyond providing the service.
• Australia (Privacy Act, APPs): we handle personal information in line with the Australian Privacy Principles, disclose it overseas only to the subprocessors listed above, and will notify you and the OAIC of any eligible data breach.

All traffic is served over HTTPS with TLS, data is encrypted at rest, access to customer content is enforced at the database level by row-level security, and we run automated security and dependency scanning. Our full security posture, backup practice, and incident response approach are described on our Security page. If personal data is ever affected by a breach, we notify affected customers without undue delay and comply with applicable legal notification requirements.

Marlow is a business tool and is not directed at children. You must be at least 16 years old to create an account. If we learn we've collected data from someone under 16, we delete it.

We'll update this page when our practices change and revise the "last updated" date. For material changes — a new category of data, a new purpose, or a new subprocessor that processes customer content — we'll notify account holders by email.

Privacy and security questions, data requests, and DPA requests: security@makeitmarlow.com.