1. Who we are and what this policy covers

Marlo Today, Ltd. ("Marlo," "we," "us") handles personal information in two roles, and this policy explains both. "Services" means our website, our applications and related services.

Signed agreements come first. If your organization has a signed agreement with Marlo, including our Data Processing Addendum ("DPA"), that agreement governs how we process your organization's data. Where this policy and a signed agreement differ, the signed agreement controls. Our commitments on Google user data in Sections 4 to 6 apply in every case.

If you appear in a customer's account. The customer's own privacy notice also applies to you, and requests about that information go to the customer (see Section 10).

2. Information we collect

Most of what Marlo holds comes from the email and calendar accounts our customers connect; the rest is account, usage and public information.

Sensitive information. Connected accounts can contain sensitive information, such as banking details in an invoice. We don't ask for it, and we process it only as part of providing the Services.

3. How we use information

We use customer data only to provide, secure and improve the Services on the customer's instructions and to meet legal obligations. We don't sell personal information, and we never use connected account data for advertising.

Customer data (connected accounts and what we derive from them) is used to:

• Provide the Services as the customer and its users direct, such as finding brand deals and partnership requests, organizing them by priority and suggesting replies
• Personalize Marlo for that customer, such as drafting replies in a user's own voice based on their past emails
• Create aggregated and anonymized statistics to operate and improve Marlo's features (Section 5)
• Follow the customer's other reasonable instructions, within the limits in Section 4
• Monitor for, detect and prevent fraud, abuse, security incidents and illegal activity
• Comply with the law

Marlo's own records are used to:

• Create and run your account and sign you in
• Answer your questions, provide support and follow up on calls with our team
• Send service messages, such as security alerts and product updates
• Understand how people use our website and app so we can improve them
• Give customers market insights from public social media content, such as which brands are running creator campaigns
• Keep the Services secure and comply with the law

4. Google user data

We use Google user data only to provide and improve the features you see in Marlo, as Google's Limited Use rules require.

Domain-wide delegation. If your organization's Google Workspace administrator connects Marlo through domain-wide delegation, the administrator authorizes Marlo for the organization's domain and chooses in Marlo which accounts to connect. Those users don't see Google's consent screen and can't remove access from their own Google Account; the administrator can. Your organization authorizes this access and is responsible for telling its users about it.

What we don't do with Google user data:

• Use it for advertising
• Sell it, or transfer it except to provide the Services (through the sub-processors in Section 7), for security, to comply with the law, or in a business transfer after you give explicit consent
• Let people at Marlo read it, except in the cases listed in Section 6
• Use it to train AI or machine learning models

How long we keep it. Only as long as needed to provide the Services or as the law requires (see Section 8).

Where it is stored. With our hosting and database providers, mainly in the United States, encrypted in transit and at rest (see Sections 7, 9 and 13).

Disconnecting. You can disconnect your Google account at any time in Marlo's settings or from your Google Account permissions. Administrators can remove domain-wide delegation in the Google Admin console.

Limited Use statement. Marlo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. AI and model training

We don't use customer data to train AI models; it is used only to run and personalize Marlo for that customer.

How Marlo uses AI. Marlo sends connected account content to AI model providers to sort and summarize messages, pull out deal details and suggest replies. These providers are listed with our other sub-processors on our Trust Center.

What providers can do with it. Their terms prohibit them from using this data to train their models. They may keep it for a limited period to detect abuse.

Personalization stays with the customer. We may use a customer's own data to tailor Marlo for that customer, such as matching a user's writing style. This never involves training a model, and it is never shared with or used for other customers.

Anonymized statistics. We may create aggregated and anonymized statistics, such as how often suggested drafts are accepted, to operate and improve Marlo's features. We take reasonable measures so this data can't be linked back to a person, and we don't use it to train AI models.

You stay in control. AI suggestions can be wrong. Unless you turn on automatic sending, you review drafts before they are sent, and you are responsible for what you send. Marlo's AI organizes and drafts; it doesn't make decisions with legal or similarly significant effects on anyone.

6. Who at Marlo can see your data

People at Marlo don't view data from connected accounts, including what we derive from it, except in the four cases Google allows.

1. You ask or agree. You have asked us to look at specific messages, for example to fix a problem you reported. If our team needs to see specific messages to help you, we will ask for your written OK first.
2. Security. It is needed to investigate a bug, abuse or a security incident.
3. Legal. It is needed to comply with the law.
4. Aggregated data. The data has been aggregated and anonymized and is used for internal operations, such as measuring how well a feature works.

Access to customer data is limited to the people who need it for their role, requires multi-factor sign-in and is logged. Everyone at Marlo with that access is bound by confidentiality obligations.

7. How we share information

We share personal information only as described below, and Google user data only as Section 4 allows. We don't sell personal information or share it for advertising.

Sub-processor list. Our current sub-processors are listed on our Trust Center. We update the list, and notify customers, at least 15 days before a new sub-processor starts processing customer data.

8. Retention and deletion

We delete customer data within 30 days after a user disconnects or a customer's agreement ends, and customers can ask us to delete it sooner.

We keep customer data longer only where the law requires it, and then only for that purpose. Anonymized statistics (Section 5) may be kept because they can't be linked to a person.

How to delete your data

1. Disconnect your Google account in Marlo's settings or from your Google Account permissions, and we delete the data we received from it within 30 days. If your organization connected you through domain-wide delegation, your administrator can disconnect you.
2. Ask us to delete your data at any time by emailing privacy@marlo.today. If you use Marlo through an organization, we delete the data from your own Google account and let your organization know.

9. Security

We protect data with the measures in Annex 4 of our DPA, including encryption in transit and at rest and an annual SOC 2 Type II audit.

• Encryption in transit (TLS 1.2 or higher) and at rest (AES-256)
• Multi-factor authentication and single sign-on for access to our systems
• Daily backups
• Event logging and monitoring
• Annual SOC 2 Type II audit by an independent auditor
• Written data protection terms with every sub-processor

Details are in Annex 4: Security Measures and on our Trust Center.

If something goes wrong. If we confirm a security breach affecting customer data, we notify the affected customer without undue delay. No system is perfectly secure, so please keep your sign-in credentials safe.

10. Your choices and rights

Anyone can ask to access, correct or delete the personal information Marlo keeps for its own records, wherever they live.

How to ask. Email privacy@marlo.today. We verify your identity, usually by confirming the request from the email address on your account. We respond within 30 days, or tell you if the law allows us more time. Someone you authorize can ask for you with proof of that authority. If we decline a request, you can appeal by replying to our decision. We won't treat you differently for using these rights.

If your information is in a customer's account. Marlo processes it for that customer, so please send your request to the customer. If you contact us instead, we will tell the customer and point you to them, and we help the customer respond.

11. Cookies and analytics

We use a few cookies to keep you signed in and remember your settings, and PostHog to see how people use our website and app, including session recordings. We don't use advertising cookies or pixels.

Your choices. Where the law requires, we ask for your consent before using analytics or session recordings. You can also block or delete cookies in your browser settings, though essential cookies are needed to sign in. Our Services don't respond to browser "Do Not Track" signals.

12. Children

Marlo is a business tool for adults and is not directed to children. You must be 18 or older to create an account, and we don't knowingly collect personal information directly from children.

Customers' accounts can include information about minors, such as young creators they represent. Customers are responsible for any permission they need from a parent or guardian, and we process that information only on the customer's instructions. If you believe a child has given us personal information directly, email privacy@marlo.today and we will delete it.

13. International users and transfers

Marlo is based in the United States and processes data mainly there, with safeguards for data that comes from other regions.

Transfer safeguards. Our sub-processors process data mainly in the United States. For customer data from the EU, UK and Switzerland, the Standard Contractual Clauses and the UK and Swiss addenda in DPA Annex 2 apply. For Marlo's own records, we use appropriate safeguards where the law requires them.

EU and UK legal bases for Marlo's own records. For customer data, the customer decides the legal basis and gives any required notices.

Complaints. If you are in the EU, UK or Switzerland, you can also complain to your local data protection authority.

Representatives. People in the EU and UK can contact Marlo directly at privacy@marlo.today.

Canada. Canadian residents have the rights in Section 10. Our Chief Technology Officer is responsible for protecting personal information and can be reached at privacy@marlo.today.

14. Changes and contact

We post changes here with a new effective date and notify customers by email or in Marlo before material changes take effect. Earlier versions are available on request. If we want to use Google user data in a new way, we will tell you and ask for your consent first.

Contact us

• Company: Marlo Today, Ltd.
• Privacy questions and requests: privacy@marlo.today
• Security issues: security@marlo.today
• Mail: 2261 Market Street STE 46190, San Francisco, CA 94114