Privacy Policy

GoMarble AI prioritizes user privacy and transparency regarding personal information collection and usage. This policy outlines how the company gathers, uses, and shares data.

Coverage & Scope

The policy applies to personally identifiable information collected through GoMarble AI services. The company does not knowingly collect data from users under 18 and will promptly delete such information if discovered.

Policy Updates

GoMarble AI may modify this privacy policy as services evolve. Users receive notice through website updates, email, or other means. Continued service use following changes indicates acceptance.

Personal Information Definition

Personal Information encompasses any data that directly or indirectly identifies individuals, including names, contact details, IP addresses, and online behavior. Data processing includes collection, storage, organization, and deletion operations.

Information Collection

User-Provided Data:

• Registration details (name, email, phone, username, password, location, timezone)
• Customer support communications
• Payment information (credit card, billing address) — processed via Stripe
• OAuth credentials and access tokens for connected advertising and analytics platforms (Meta Ads, Google Ads, Google Analytics, TikTok Ads, LinkedIn Ads, Microsoft Advertising/Bing Ads, and others as supported)
• Google Drive and Google Sheets access and refresh tokens, file content and metadata, spreadsheet data and structure, and Google assets retained in conversations when you connect these services
• Ad account connections, campaign data, and performance metrics from connected platforms
• Contact information for vendor/partner relationships

Automatically Collected Data:

• Log data (IP address, browser type, visited pages, search terms)
• Session cookies and authentication tokens
• Device identifiers
• Email interaction tracking
• Feature usage events collected via analytics tools (see Analytics & Tracking below)

The company notes: "Do Not Track signals do not currently affect service functionality."

Data Usage Purposes

GoMarble AI uses personal information for:

• Account creation and management
• Payment processing and inquiries
• Two-factor authentication
• Service-related communications
• Providing the advertising dashboard, analytics, and reporting features
• Enabling the AI Agent to analyze ad performance and take authorized actions on connected platforms
• Extracting and storing session summaries and user preferences to personalize the AI Agent experience (see AI Processing section below)
• Targeted advertising for GoMarble services
• Analytical aggregation and product improvement
• Customer support
• Security measures
• Legal compliance

For European Economic Area residents, processing occurs when users consent, services are requested, legal obligations exist, or legitimate business interests apply.

AI Processing of Customer Data

GoMarble AI operates an AI-powered agent that processes your data using third-party large language model (LLM) providers. By using the AI features, you acknowledge the following:

AI Providers Used:

• Anthropic (Claude models)
• Google (Gemini models)
• OpenAI (GPT models)

Data sent to these providers may include: your chat messages and conversation history, ad performance data and campaign metrics, account-level context, derived insights, and relevant Google Drive and Sheets content needed to generate your requested response. Google data is subject to the restrictions in the Google user data section.

We do not use your data to train or fine-tune any AI model. Data is sent to AI providers solely for real-time inference.

LLM Observability: GoMarble uses Langfuse, an LLM observability platform, to log and monitor AI interactions, subject to the exclusions below. Langfuse receives metadata about AI calls including prompts, completions, token counts, and latency for the purpose of monitoring quality, debugging, and cost management. Langfuse is bound by data processing agreements with equivalent security obligations. Google Drive and Sheets content is excluded from Langfuse prompt/completion logs and AI-provider logs.

Personalization Data: The AI Agent extracts and persistently stores two categories of information derived from your conversations:

• Session summaries — summaries of past problems, decisions, and outcomes from your sessions
• User preferences — your preferred reporting formats, communication style, review cadence, and workflow patterns

These records are stored in GoMarble's database associated with your user account and team, and are used to personalize future AI Agent interactions. You may request deletion of your stored records by contacting legal@gomarble.ai. Google-derived records are subject to the deletion timelines in the Google user data section.

Analytics & Tracking

GoMarble AI uses the following analytics and observability tools:

These tools may set cookies or use similar tracking technologies. You can manage cookie preferences through your browser settings.

Connected Ad Platform Data

When you connect advertising or analytics accounts to GoMarble AI, we access data from those platforms pursuant to your explicit OAuth authorization. This includes campaign data, ad performance metrics, audience insights, and account information. Such data is:

• Stored in our database to power the dashboard and reporting features
• Processed by our AI systems to generate insights and recommendations
• Not sold or shared with third parties for their independent commercial use

Your OAuth access tokens for connected platforms are stored securely in encrypted form. You can revoke GoMarble AI's access to any platform at any time through that platform's account settings.

Data Protection Measures

Security safeguards include encryption in transit (TLS) and at rest (AES-256-GCM for sensitive fields), role-based access with multi-factor authentication, environment segregation, audit logging, vulnerability management, and vendor due diligence. Contractual security details appear in the Data Processing Agreement.

Cloud Hosting

GoMarble AI's services are hosted on Amazon Web Services (AWS) in the United States. By using the Services, you acknowledge that your data may be processed in the United States.

Security Incidents

In breach scenarios, GoMarble AI investigates, mitigates impacts, and notifies affected users and authorities "without undue delay" per applicable laws.

Data Retention

• Account/profile data: deleted or de-identified within 24 months post-closure; this general period does not override the Google-specific deletion timelines below
• Billing/transactional records: 7 years
• Service/security logs: up to 12 months; Google Drive and Sheets content is excluded from Langfuse prompt/completion logs and AI-provider logs
• Backups: approximately 35 days rolling retention
• Marketing communications: suppression records maintained indefinitely; related profile data deleted within 30 days of unsubscribe
• Ad platform OAuth tokens: retained for the duration of your account; revocable at any time via the platform's permission settings
• AI-extracted session summaries and user preferences: retained for the duration of your account; deletable on request to legal@gomarble.ai
• Google Drive and Sheets access and refresh tokens: revoked and deleted immediately on disconnect
• Google-derived conversations, retained assets and summaries/preferences: retained until separately deleted or subject to a deletion request; deletion from active systems completed within 30 days, with remaining copies expiring through the approximately 35-day rolling backup cycle. Disconnecting does not delete source files in your Google Drive or assets retained in GoMarble chats

Users may request deletion at legal@gomarble.ai.

Consent Management

Users may withdraw consent anytime without affecting prior lawful processing. Preferences can be managed through email unsubscribes, browser cookie settings, or connected platform account permissions.

Response Timelines

Privacy requests receive acknowledgment within 2 business days, with resolution targeted within 30 days. Deletion requests for Google-derived data are completed from active systems within 30 days; remaining copies expire through the approximately 35-day rolling backup cycle.

Data Sharing

Service Providers: GoMarble AI shares data with trusted third-party service providers who process data on our behalf under equivalent privacy obligations. Current key sub-processors include:

Legal Compliance: GoMarble AI discloses information to government/law enforcement when necessary for legal processes, property protection, safety, or preventing illegal activity.

Business Transfers: In mergers, acquisitions, or insolvency events, personal information may transfer. Users can opt out if the acquiring entity's practices differ materially. Google user data may transfer in a merger, acquisition or asset sale only after your explicit prior consent, as described in the Google user data section.

Google user data (Google Drive and Google Sheets)

This section explains how GoMarble accesses, uses, stores, shares and deletes Google user data. These Google-specific restrictions take precedence wherever another section describes broader uses or transfers.

Permissions we request

• drive.readonly permits viewing and downloading Drive files accessible to your account. We use it to search, list and read file content and metadata in My Drive and shared drives
• drive.file permits creating and managing files created by GoMarble or opened or shared with GoMarble through its supported file-selection flow. It does not narrow access granted by broader permissions
• spreadsheets.readonly permits reading spreadsheet data and structure
• spreadsheets permits viewing, editing, creating and deleting spreadsheets accessible to your account

How we use it

We use Google data to provide the features you request: searching, reading and analyzing files and spreadsheets, working with Google assets in conversations, creating files or spreadsheets, editing spreadsheets, and deleting files or spreadsheets. These actions execute on your explicit request, with review after execution. We do not sell Google user data, use it for advertising or build profiles for unrelated purposes.

AI processing and logging

Relevant content may be sent to Anthropic, OpenAI or Google Gemini to generate your requested response. We do not use Google Workspace API data to develop, improve or train generalized or non-personalized AI or machine-learning models. Google Drive and Sheets content is excluded from Langfuse prompt/completion logs and AI-provider logs.

Storage, revocation and deletion

Access and refresh tokens are encrypted at rest and revoked and deleted immediately when you disconnect. Disconnecting does not delete files in your Google Drive or assets retained in GoMarble chats. Conversations, retained assets and derived summaries/preferences remain until separately deleted or subject to a deletion request.

You can revoke access at https://myaccount.google.com/connections. To request deletion of Google-derived data stored by GoMarble, email legal@gomarble.ai. We complete deletion from active systems within 30 days. Remaining copies expire through the approximately 35-day rolling backup cycle. Service and security logs are retained for up to 12 months, subject to the Google-content logging exclusions above.

Sharing and human access

Transfers are limited to providing disclosed, appropriate user-facing features with your consent, security purposes, applicable legal requirements, or a merger, acquisition or asset sale after your explicit prior consent. Our hosting, database, storage and inference providers are identified in the Data Sharing section. Staff may read specific Google data only with your documented explicit consent, for necessary security purposes or to comply with applicable law.

Limited Use

GoMarble’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy

Email Communications

Purpose: Product updates, newsletters, and account alerts sent based on opt-in consent.

Unsubscribe Options:

1. Click unsubscribe links in emails
2. Contact support@gomarble.ai

Unsubscribe requests process within 2 business days. Transactional emails for account functionality continue post-unsubscribe.

User Rights

Depending on jurisdiction (EU, California, etc.), individuals may request access, correction, deletion, processing restrictions, data portability, and complaint filing with supervisory authorities. These rights may have limitations under local law. Consent withdrawal is available anytime at no cost.

To exercise rights or update preferences, contact legal@gomarble.ai.

Contact Information

For privacy questions, requests, or rights assertions, email legal@gomarble.ai.