Privacy policy

What we collect

• Your account: your email address and a scrambled (hashed) version of your password. We never store your actual password.
• Your restaurant: its name, description, menu, prices, story and anything else you type into Marlo.
• Your photos: food photos you upload, and photos from guests that you choose to add.
• Your posts: the captions and images Marlo writes, your edits, ratings and schedule.
• Your social accounts: when you connect Instagram or Facebook, an account reference from our posting partner and your public handle. We never see your Instagram or Facebook password.
• Payments: your subscription status and invoices. Your card details go straight to Stripe and never reach us.
• Emails we send you, and basic technical information needed to keep your account secure (such as sign-in attempts).

Why we use it

To provide the service you signed up for: writing your posts, posting them when you approve them, showing your results and taking your subscription payment. The legal basis is our contract with you.

To keep Marlo secure and working, for example limiting repeated sign-in attempts. The legal basis is our legitimate interest in running a safe service.

To keep financial records, as the law requires.

We don't sell your information, and we don't use it for advertising.

Who helps us

We use these providers to run Marlo. Each only gets what it needs for its part:

• Zernio: posts your approved posts to Instagram and Facebook, and reads their likes and comments.
• Meta (Instagram and Facebook): receives the posts you approve, under Meta's own terms and privacy policy.
• Stripe: takes your subscription payments.
• Anthropic (Claude): writes captions from your restaurant details and menu.
• Google (Gemini): makes new angles of your dish photos, if you switch that on.
• Resend: sends our emails to you.
• Hosting: Railway, where the app and your data are stored.

Outside the UK

Some of these providers are based in, or store data in, the United States or the EU. Where that happens, the transfer is protected by UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.

How long we keep it

We keep your information while your account is open. When you delete your account (Account page, Delete account), your restaurant, menu, photos and posts are deleted straight away and backup copies expire within 30 days. Posts already published on Instagram or Facebook stay there until you delete them on those apps.

Payment records are kept for six years, because UK tax law requires it.

Cookies

Marlo uses one cookie, to keep you signed in, and remembers your light or dark theme on your device. Both are strictly necessary for the site to work, so we don't ask for consent. There are no advertising or tracking cookies.

Your rights

You can ask for a copy of your information, ask us to correct it, delete it (you can do this yourself on the Account page), move it elsewhere, or object to how we use it. Email [email protected] and we'll reply within a month.

If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office at ico.org.uk. We'd appreciate the chance to put it right first.

Changes

If we change this policy in a way that matters, we'll email you before the change takes effect.