LEGAL

Privacy Policy

Effective October 28, 2026

1. Information we handle

• Account and team details: name, email address, password hash, email verification and reset records, workspace membership, roles, and account activity.
• Workspace content: business and brand details, documents, media, campaigns, drafts, approvals, schedules, conversations, and other information you or your team add.
• AI information: prompts, context you provide, generated text or images, and usage records needed to deliver and monitor AI features.
• Connected accounts: identifiers, permissions, and credentials needed for optional social or other integrations you choose to connect.
• Billing records: plan, subscription status, Stripe customer and transaction references, invoices or payment events, and billing support messages. Stripe collects payment card details during checkout; Marge does not ask you to enter card numbers into the app.
• Technical and support details: session cookies, IP address and browser or device details in server and security logs, error records, and messages sent to our contact, support, billing, privacy, or security addresses.

We receive this information from you, your workspace team, connected services you authorize, and providers that deliver payment, email, hosting, and other functions.

2. Why we use it

We use information to create and secure accounts; operate workspaces; generate, store, and publish content as you instruct; connect services you authorize; manage subscriptions and payments; send account, service, and billing messages; answer requests; detect abuse and errors; maintain records; and meet legal obligations. We do not sell personal information or private workspace content. We do not use private workspace content to train our own general-purpose AI models.

If we send promotional email, we will use any consent and unsubscribe process required by law. Account verification, password reset, service, and billing messages are operational messages.

3. AI and connected services

When you use AI features, Marge sends the prompt and relevant workspace context to OpenAI to generate a response or image. Do not include information you lack permission to use. OpenAI's API data policies apply to that processing; OpenAI says API inputs and outputs are not used to train its models by default. If you connect a social platform, we send the information needed to perform the action you approve, and that platform's terms and privacy policy also apply.

4. Providers and processing locations

We use service providers for hosting, billing, email, and AI. Current providers include Railway for website and app hosting and database services, Cloudflare for website delivery and security, Google Fonts for website typography, Stripe for payments, Resend for app email, Zoho for business email, and OpenAI for AI features. We may use a configured object storage service, including Supabase, for uploaded files. We share only the information needed for each function.

Our Zoho business mailbox is hosted in Canada. The Marge app is deployed in Railway's EU West region, in the Netherlands; Railway also processes logs in the United States. Cloudflare, Google, Stripe, Resend, and OpenAI may process information in the United States. Provider personnel and subprocessors may also access information from India or Ireland for support, payment, and related operations. If Supabase storage is enabled, its configured project region determines where stored files reside. To obtain our current provider list, processing locations, and the applicable provider policies, or to ask about a transfer outside Canada, contact the Marge privacy contact at [email protected]. The privacy contact is responsible for answering questions about our use of providers outside Canada.

We may also disclose information when required by law, to protect rights or safety, or as part of a business transaction, subject to applicable law.

5. Cookies and website technology

The app uses essential session and workspace cookies to keep you signed in and maintain security. Our website and hosting providers may use technical identifiers or logs to deliver pages and protect against abuse. The current public site does not intentionally run advertising pixels or behavioral advertising cookies. You can manage cookies in your browser, but disabling essential cookies may prevent sign-in.

6. Retention, export, and deletion

We keep information while it is reasonably needed to provide the service and for legitimate security, accounting, dispute, or legal purposes. Workspace owners can export workspace data through account settings. They can request deletion through the app's workspace controls or by contacting [email protected]. Deletion removes active workspace records and queues related stored files for cleanup. Limited deletion receipts, billing records, audit evidence, and backup copies may remain for applicable retention periods or legal holds. A workspace deletion receipt can be retained for up to seven years. We securely delete or de-identify information when it is no longer needed.

7. Security

We use access controls, session protections, and other technical and organizational measures intended to protect information. No online service can guarantee absolute security. Report a suspected security issue to [email protected].

8. Your choices and rights

You can update some account and workspace details in the app and request an export. Email [email protected] to request access, correction, deletion, or withdrawal of consent where applicable, or to make a privacy complaint. Depending on where you live, you may also have rights to object to or restrict processing or receive a portable copy of information. We may verify your identity and may need to retain or withhold information where law permits or requires it. We will respond in accordance with the law that applies to your request.

9. Children and changes

Marge is for people able to enter a binding agreement and is not directed to children. If you believe a child has provided us personal information, contact us. We may update this policy and will post the revised version with a new effective date and any notice required by law.

10. Contact

Peradigm Inc., Calgary, Alberta, Canada. Privacy requests and questions: [email protected].