Privacy Policy

Last updated: 30 September 2026

Marlow (“Marlow”, “we”, “us”) is operated by Milo Ghosh GbR, Strassburger Strasse 6a, 10405 Berlin, Germany (VAT ID DE320399388), the controller of your personal data under this policy. Marlow is an audience-research tool available at app.gomarlow.co. This policy explains what personal data we collect when you use Marlow, why, who we share it with, how long we keep it, and the rights you have. Questions go to giuseppe@gomarlow.co.

1. What we collect

Your account

• Name and email address, which you give us when you sign up.
• Password, if you choose one. We store only a salted scrypt hash, never the password itself.
• If you sign in with Google: your name, email address and Google account identifier. We ask Google for nothing else (only the openid, email and profile scopes).
• Account status, sign-up and last sign-in dates, and any promo code you redeem.

Your projects

• The website domains, competitors, social accounts, keywords and settings you enter, and the analyses Marlow builds from them.

Tools you choose to connect

• If you connect a tool (for example through an MCP connector) or upload a document, Marlow reads the content you make available so it can analyse it. Marlow only reads from connected tools: it never creates, edits, sends, moves, shares or deletes anything in them.
• Before this text is stored or sent to an AI model, personal details are removed automatically: email addresses, phone numbers, card and bank numbers, IP addresses, social handles and profile links, and names where the text indicates them.
• The keys that give Marlow access to your tools are encrypted at rest.
• This content is private to your account. It is never shown to another account and never used in demos.

Usage and technical data

• Your IP address and browser details when you use Marlow, for security and to keep you signed in.
• Product analytics and session recordings (via PostHog) so we can see how Marlow is used and fix problems. Screens showing your private content are masked in recordings.
• Messages you send us through “Message us” or by email.

2. How we use it

• To create and secure your account, sign you in and keep you signed in.
• To run the analyses you ask for and show you the results.
• To send you service emails: confirming your address, password resets, a welcome email and notices about your account.
• To understand usage, fix bugs and improve Marlow.
• To prevent abuse and keep the service secure.

We do not sell your personal data, and we do not use it for advertising.

Our legal bases (under the EU/UK GDPR) are: performing our contract with you (running your account and analyses), our legitimate interests (security, fixing and improving the service), and your consent where we ask for it.

3. Google user data

When you sign in with Google, we receive only your name, email address and Google account identifier. We use them solely to create your Marlow account and sign you in. We do not access your Gmail, Drive, contacts or any other Google data through sign-in. We do not share this data with third parties except the service providers listed below that host and run Marlow, and we do not use it for advertising. Marlow’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Who we share it with

We use these service providers to run Marlow. They process data on our behalf and only for that purpose.

To gather public market data about the domains, keywords and social accounts in your projects, Marlow queries data providers (for example DataForSEO, Apify, ScrapeCreators, Similarweb, LinkdAPI and public platforms such as Reddit and Bluesky). We send them those domains, keywords and handles, not your account details.

We may also disclose data if the law requires it, or to protect Marlow and its users from fraud or abuse.

Some providers are outside the EU. Where that is the case, transfers rely on the European Commission’s Standard Contractual Clauses or an adequacy decision such as the EU-US Data Privacy Framework.

5. How long we keep it

• Account data is kept while your account exists and deleted when you ask us to delete the account.
• Data from your connected tools and uploads is deleted when you disconnect the tool or delete your account, and automatically after 90 days if nothing has refreshed it.
• Sessions expire after 30 days of inactivity.
• Analytics are kept according to PostHog’s retention settings.

6. Cookies

• Essential cookies keep you signed in (tdb_session) and protect Google sign-in (g_oauth, deleted within 10 minutes). Marlow does not work without them.
• Analytics cookies and storage from PostHog measure how Marlow is used.

7. Your rights

Depending on where you live, you can ask us to access, correct, export or delete your personal data, and to restrict or object to how we use it. You can withdraw consent at any time. Email giuseppe@gomarlow.co and we will reply within 30 days. You can also complain to your local data protection authority.

8. Security

Data is encrypted in transit (HTTPS). Passwords are hashed, and the keys to your connected tools are encrypted at rest. Access to production systems is limited to the people who run Marlow. No system is perfectly secure, but we work to protect your data and will tell you promptly if a breach affects it.

9. Children

Marlow is a business tool and is not intended for anyone under 16.

10. Contact

Milo Ghosh GbR
Strassburger Strasse 6a, 10405 Berlin, Germany
VAT ID DE320399388
Email: giuseppe@gomarlow.co

11. Changes

If we change this policy, we will update the date above. If the change is significant, we will tell you by email or in the app.