Privacy, explained in plain English

Marcenta is the data controller for account, billing, website, and relationship data that we collect directly from you. For customer source data that you connect to the Service, Marcenta generally acts as a processor or service provider on your organisation's behalf.

Marcenta is currently operated by the founding team under the Marcenta brand unless a specific Marcenta legal entity is identified in your order form, invoice, or other commercial agreement.

Customers retain ownership of data they connect, upload, and generate through the Service, including source data, configuration data, and AI-assisted outputs.

For customer data processed through connected sources and workspace activity, Marcenta acts as a processor or service provider on the customer's behalf and processes that data to provide and secure the Service.

Customers control what integrations, workspaces, and datasets are connected to Marcenta and can disconnect integrations or remove data according to available product controls.

Where GDPR applies, we rely on the following legal bases:

We use personal data to:

• Create and manage accounts, workspaces, and permissions
• Authenticate users and maintain secure sessions
• Connect to third-party sources and process source data on your behalf
• Generate analytics, reports, anomaly detection, and AI-assisted insights
• Provide billing, subscriptions, plan enforcement, and customer support
• Send transactional messages, invitations, alerts, and report emails
• Monitor reliability, abuse, fraud, and platform security
• Maintain internal records and comply with legal obligations

We do not: sell personal data, share personal data with third parties for their own direct marketing, or use your customer source data to train third-party AI models for general-purpose model improvement without your explicit consent.

We do not use customer data for advertising profiling or cross-context behavioural advertising.

Authorised Marcenta personnel may access account, billing, diagnostic, and customer source data when reasonably necessary to operate the Service, respond to support requests, investigate incidents, enforce our terms, or comply with law.

We limit that access to authorised personnel and to the information reasonably required for the task at hand. We do not access customer data for resale or unrelated commercial exploitation.

Marcenta uses AI models to help generate insights, summaries, charts, anomaly explanations, diagnostic prompts, and other AI-assisted outputs. To provide those features, we may send prompts and structured source data or metric summaries to API-based model providers that are necessary to generate the requested result.

• We use a data minimisation approach and aim to send only the minimum data reasonably necessary for the requested feature.
• We do not intentionally send raw sensitive personal data to AI providers.
• Our AI providers state that API-submitted content is not used for model training by default, subject to their terms and policies.
• AI conversation context and outputs may be stored for a limited period to support feature quality, continuity, debugging, and user experience.
• Customers may request deletion of stored AI conversations or outputs where technically feasible and subject to applicable legal, security, or operational retention requirements.
• AI outputs can be inaccurate or incomplete, are not professional advice, and should not be treated as automated business decisions.

We share personal data only with service providers and subprocessors that help us operate the Service, such as infrastructure providers, authentication and database providers, AI providers, email providers, billing providers, and monitoring providers.

Current details are available in our Subprocessor List.

We may also disclose personal data if required by law, regulation, court order, or valid governmental request, or where necessary to protect rights, safety, and the security of the Service.

If Marcenta is involved in a merger, acquisition, financing, reorganisation, bankruptcy, asset sale, or similar business transfer, customer and user data may be transferred as part of that transaction, subject to this Privacy Policy and applicable law.

Marcenta uses providers that may process data in multiple countries, including India and the United States. If you are located in a jurisdiction that restricts international transfers, we rely on appropriate transfer mechanisms such as contractual safeguards and, where available, recognised adequacy or certification mechanisms.

Deleted data may remain in encrypted backups or disaster recovery systems for a limited retention period before permanent removal.

Marcenta uses cookies and similar technologies that are necessary for authentication, session continuity, security, and core application functionality.

We may also use limited diagnostic or analytics technologies to understand service performance and product reliability. Where applicable law requires consent for non-essential cookies or similar technologies, we will obtain that consent before using them.

We do not sell personal data to advertising networks.

To exercise applicable rights, contact us at legal@marcenta.ai. We may need to verify your identity before acting on a request.

We may send marketing communications where permitted by law. You can opt out at any time using the unsubscribe mechanism in the message or by contacting legal@marcenta.ai. Transactional and service-related messages are not marketing opt-in dependent.

We use technical and organisational safeguards designed to protect personal data, including encryption in transit and at rest, organisation-scoped tenant isolation, role-based access controls, infrastructure and vendor controls, and operational monitoring. Access is restricted to authorised personnel who need it for legitimate service operations.

We maintain operational and activity logging for key product and system events, monitor systems for misuse and security events, and maintain incident handling processes designed to investigate, contain, and remediate material incidents. Marcenta infrastructure is hosted through trusted cloud providers. No system is completely secure, and we cannot guarantee absolute security.

Customers are responsible for managing workspace access permissions, protecting account credentials, and maintaining appropriate internal access controls.

Marcenta is not directed to children, and we do not knowingly provide the Service to children under 13, or under 16 where a higher local age applies.

The Service connects to third-party platforms and data providers such as Google Analytics 4, Google Search Console, Google Ads, LinkedIn Ads, HubSpot, CRM systems, analytics platforms, advertising platforms, and related business tools. Their privacy practices are governed by their own terms and policies, not this Privacy Policy.

Connecting third-party integrations may permit Marcenta to access, import, process, and analyse data made available by those services according to your configuration, permissions, and account settings.

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the date above and, where appropriate, by providing in-product or email notice.