Privacy Policy

1.Data controller

The data controller responsible for the processing described in this Privacy Policy is:

For privacy-related questions and requests, write to [email protected].

2.Personal data we collect

Depending on how you use Marzi, we may process the following categories of personal data.

Account information

email address; password credentials in protected form; account identifiers; authentication information; information provided through Google authentication. If you fill them in, your account settings also hold your full name, company name, phone number, time zone, interface language and the e-mail notifications you chose to receive.

Billing information

Stripe Customer ID; Subscription ID; payment status; invoice information; billing country; transaction identifiers; subscription plan; billing period. Marzi does not store your full payment card number or card security code.

Content you submit

the marketplace links you ask Marzi to analyse or track; product codes such as EAN or GTIN; your own marketplace seller login where you provide it; the competitors, offers and search phrases you track; cost figures you enter for price recommendations; the monitors you create; and the contents of support messages. This is mostly business information, but it may contain personal data — for example where a marketplace seller trades as an individual.

Technical information

IP address; browser and device information; operating system; timestamps; authentication and security events; server logs; error information; information necessary to protect the security and reliability of the Platform.

Usage events

which sections of the Platform you open and which steps you complete, recorded in our own service log so that the product can show you where you are and so that we can see which features are used. This log is ours, it is tied to your Account, and it is separate from the website analytics described below, which run only if you allow them.

Website analytics

only if you allow it in the cookie notice: the pages you open on marzi.ai and on the sign-in page, the page you arrived from, the approximate location derived from a shortened IP address, your browser, device and operating system, and a random identifier kept in a cookie so that two visits can be recognised as one visitor. This is collected through Google Analytics 4 and is described in the Cookie Policy. If you refuse, none of it is collected and Google is not contacted at all.

Advertising measurement

only if you allow it in the cookie notice, as an answer separate from analytics: whether you reached us from one of our advertisements and which one it was, whether you went on to create an Account, and an identifier Google keeps in a cookie for that purpose. This is collected through Google Ads and is described in the Cookie Policy. If you refuse, none of it is collected and Google is not contacted at all.

Communications

your email address; contents of your communication; support-related information; technical information necessary to respond to your request.

3.Google authentication

If you choose to register or sign in using Google, Google provides Marzi with information necessary to authenticate your Account.

Depending on the permissions and configuration applicable to the Google authentication flow, this may include your email address, name, Google account identifier and related authentication information.

We use this information to create and authenticate your Marzi Account.

Marzi does not receive your Google password.

4.How we use personal data

We process personal data to provide the Service, create and maintain Accounts, authenticate users, provide requested features, maintain Subscriptions, provide customer support, process billing, maintain billing records, provide invoices, detect and prevent unauthorised access, protect Accounts, investigate security incidents, prevent abuse, maintain system integrity, monitor system health, diagnose technical errors, maintain infrastructure, improve reliability and performance, and send account, authentication, security, billing and service-related communications.

Some features are produced with the help of an artificial-intelligence provider — for example translating a support message between your language and the language of our support team, interpreting a search phrase, or judging which offers belong to the same product. The section on AI service providers says what is sent.

We do not profile you to decide what the Service shows you, we make no automated decisions about you with legal or similar effects, and we do not sell personal data.

We do measure how the website is used, with Google Analytics 4, and only if you allow it in the cookie notice: how many people visit, which pages they read and where they arrived from. That measurement is not used for advertising — on the Analytics side Google Signals and ad personalisation are switched off.

We also advertise Marzi on Google. If you allow advertising in the cookie notice — a separate answer from analytics — the Google Ads tag records whether one of our advertisements brought you here and whether you went on to create an Account, so that we can tell which advertisements are worth paying for, and it allows our advertisements to be shown again to someone who has already visited us. It carries no name, no email address and nothing you typed into the Platform. Refuse, and the tag is not loaded at all.

5.Legal bases for processing

Depending on the circumstances, we process personal data on one or more of the following legal bases:

Performance of a contract

where processing is necessary to provide Marzi, maintain an Account, process a Subscription or perform contractual obligations.

Legal obligation

where processing is necessary to comply with applicable legal, tax, accounting or other legal requirements.

Legitimate interests

where processing is necessary for legitimate interests such as protecting the Platform, preventing fraud and abuse, maintaining information security, troubleshooting, improving service reliability, or defending legal claims. We consider and balance these interests against your rights and freedoms.

Consent

where applicable law requires consent. Where processing is based on consent, you may withdraw consent at any time.

6.Payment processing — Stripe

Payments and subscription billing are processed through Stripe.

Stripe may process personal and payment-related information in accordance with its own privacy documentation and terms.

Marzi receives information necessary to manage your Account and Subscription, but does not store your full payment card details.

Stripe may process information in jurisdictions outside your country of residence subject to applicable data protection requirements and safeguards.

7.Email — Resend

We use Resend to provide transactional and service-related email functionality.

Resend may process information such as email address, sender and recipient information, email content, delivery information, and technical metadata necessary for email delivery.

Where a different delivery route is configured for reliability, a message may instead be sent through another email delivery provider or through our own mail server.

We use email services to send account, support, billing and service-related communications.

8.AI service providers

Some Marzi features are produced with the help of a third-party artificial-intelligence provider. We currently use OpenAI.

What is sent is limited to what the feature needs: the text of a support message when it is translated; the search phrase or product name you enter; titles, prices and public review text read from marketplace pages; the question you ask an AI-assisted feature; and the figures the feature is reasoning about.

We do not send passwords, payment card data or billing records to an AI provider. Under the business terms applicable to our account, the provider does not use the content we submit to train its models.

This processing takes place outside the European Economic Area; see International data transfers.

AI Integration works the other way round: when you connect your own AI client — for example Claude, ChatGPT or an agent you built — the data you ask for flows to the provider you chose, under your own agreement with that provider. We cannot control what that provider does with it.

9.Hosting and infrastructure

Marzi's application infrastructure is hosted using third-party infrastructure providers.

Our current infrastructure includes a server environment hosted by Vultr and a Supabase PostgreSQL database hosted in the European Union, with the primary database region located in Ireland.

We may also maintain separate technical infrastructure used to prepare and process large datasets before transferring the resulting information into the main application database.

These systems may process technical and service data necessary to operate Marzi.

Reading public marketplace pages on your behalf is carried out through third-party web data collection providers. They receive the address of the page to be read and the technical information needed to request it.

10.Data sharing

We may disclose personal data to service providers where reasonably necessary to operate Marzi.

Depending on the service, these providers may include payment and billing providers; hosting and infrastructure providers; database providers; email delivery providers; authentication providers; artificial-intelligence providers; web data collection providers; website analytics providers; advertising and advertising-measurement providers; and security and technical service providers.

Service providers process personal data on our behalf where applicable and are required to provide appropriate safeguards under applicable law.

We may also disclose information where required by law, legal process, or to protect the rights, property or security of Marzi, our users or others.

We do not sell personal data to third parties.

Website analytics are provided by Google Ireland Limited, which processes the data described in the Cookie Policy on our behalf and only while your consent is in force. Withdraw it and nothing further is sent.

Advertising and advertising measurement are provided by the same company, Google Ireland Limited, through Google Ads. Here Google does not act only on our instructions: under the terms it publishes for its advertising products it also processes part of this data as a controller in its own right. This too happens only while your consent is in force, and withdrawing it stops anything further being sent.

11.International data transfers

Some service providers may process personal data outside the European Economic Area. Our payment provider and our artificial-intelligence provider process data in the United States, and our website analytics provider may transfer data to the United States.

Where personal data is transferred outside the EEA, we will use appropriate safeguards required by applicable data protection law, such as an adequacy decision, Standard Contractual Clauses or another legally recognised transfer mechanism, where applicable.

12.Data retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, subject to legal, accounting, security and dispute-resolution requirements.

In general, Account data is retained while the Account remains active; Subscription and billing records may be retained for the period required by applicable tax and accounting laws; security and technical logs are retained for periods appropriate to their security and operational purpose; and support correspondence is retained for as long as reasonably necessary to resolve the matter and maintain appropriate records.

Website analytics data is kept for no longer than 14 months from your visit, and your answer to the cookie notice is kept for 180 days, after which you are asked again.

Where personal data is no longer required, we will delete or anonymise it where reasonably practicable, subject to legal retention requirements.

13.Your GDPR rights

Subject to applicable legal conditions and limitations, you may have the right to request access to your personal data; request correction of inaccurate personal data; request deletion of personal data; request restriction of processing; object to certain processing; request data portability; withdraw consent where processing is based on consent; and lodge a complaint with a competent data protection supervisory authority.

To exercise your rights, write to [email protected].

Changing the email address of an Account and deleting an Account are handled at the same address: write to [email protected] and we will confirm the request with you.

We may need to verify your identity before responding to a request.

14.Cookies and similar technologies

A cookie is a small file a website asks your browser to keep. We use two kinds, and they are treated differently.

Strictly necessary

signing in sets a session cookie, the network in front of our site may set a short-lived security cookie, and your answer to the cookie notice is itself stored in a cookie. Without them the Platform cannot keep you signed in, so they are not optional and the law does not require consent for them.

Analytics

Google Analytics 4 on the website and the sign-in page, which counts visits and shows which pages are read. These are set only after you allow them in the cookie notice, the legal basis is your consent, and you can withdraw it at any time through the “Cookies” link in the footer of any page. Until you allow them, Google's script is not loaded and no analytics cookie exists.

Advertising

the Google Ads tag on the website, on the sign-in page and in the Platform, which records whether an advertisement of ours brought you here and whether an Account was created, and lets our advertisements be shown to you again elsewhere. This is a separate switch in the cookie notice, the legal basis is your consent, and you can withdraw it at any time in the same place. Until you allow it, the tag is not loaded and no advertising cookie exists.

Your session, the language you chose and the interface theme are kept in your browser's local storage rather than in cookies. They stay on your device and are needed for the Platform to work.

The Cookie Policy lists every cookie by name, says how long it lasts, who receives the data and how to change your answer. Apart from the Google Ads tag above we use no advertising technology: no Meta, TikTok or LinkedIn pixel, no session recording and no tag manager container.

Inside the Platform there is no third-party analytics: the sections you open are recorded only in our own service log, described above. The advertising tag is the one third-party tag that runs there, and only if you allowed it.

Where additional non-essential cookies or tracking technologies are introduced, we will update the Cookie Policy, ask for your consent again and not set them before you answer.

15.Security

We use reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration, disclosure or destruction.

These measures may include access controls, authentication mechanisms, restricted access to production systems, secure communications, backups and recovery procedures, and security logging.

No online system can be guaranteed to be completely secure.

16.Children's data

Marzi is a business software platform and is not intended for children.

Accounts are intended for adults acting in a business capacity, and we do not knowingly create an Account for a person under 18.

We do not knowingly collect personal data from children for the purpose of providing Marzi services.

If you believe that a child has provided personal data to us, please contact us so that we can assess and, where appropriate, delete the information.

17.Automated decision-making and profiling

Marzi does not currently make decisions producing legal or similarly significant effects on individuals based solely on automated processing of personal data.

Price recommendations, verdicts, scores and estimates shown in the Platform are information for you to act on or ignore. They are about offers and markets, not about people, and they do not decide anything on their own.

We may process technical information automatically for security, fraud prevention, service operation and diagnostics.

18.Data protection by design

We seek to collect and process only personal data that is reasonably necessary for the purposes described in this Privacy Policy.

We do not intentionally collect sensitive categories of personal data through ordinary Marzi registration and use.

19.Changes to this Privacy Policy

We may update this Privacy Policy when our services, infrastructure, processing activities or legal obligations change.

The updated version will be published on the Marzi website and will include a revised "Last updated" date.

Where required by law, we will provide additional notice or obtain consent.

20.Contact

For privacy questions or requests concerning your personal data, write to [email protected].

21.Supervisory authority

You may lodge a complaint with the data protection supervisory authority competent under applicable law.

For matters falling under the jurisdiction of Cyprus, the relevant supervisory authority is the Office of the Commissioner for Personal Data Protection.

This right does not prevent you from seeking other judicial or administrative remedies available under applicable law.