Privacy Policy

Account and authentication data

• Name, email address, and password when you register directly.
• OAuth identity and profile metadata when you connect supported third-party platforms.

Billing and usage data

• Subscription status, selected plan, billing profile, legal name, GSTIN where provided, billing address, city, state, PIN code, invoice records, credit-note records, refund records, and product usage records.
• Razorpay subscription IDs, payment IDs, refund IDs, webhook delivery records, and payment status metadata needed to operate billing, invoices, refunds, dispute handling, accounting, and fraud prevention.
• Razorpay processes card, UPI, bank mandate, and other payment credentials. Marvyn does not store full card numbers, CVV, UPI credentials, or bank account details.

Workspace and brand data

Brand profile information, competitor lists, generated content, campaign notes, SEO data, analytics preferences, alert settings, and any content you create or upload inside Marvyn.

Connected platform data

When you connect Google, Meta, LinkedIn, Microsoft Clarity, or other supported services, we store access tokens, refresh tokens where applicable, and operational metadata such as account IDs, page IDs, customer IDs, site URLs, and GA4 property IDs.

Usage, logs, and support data

• Feature usage, request logs, diagnostics, browser/device data, timestamps, and IP-related logs.
• Support communications and account-related notifications.
• Session and behavior analytics on Marvyn’s own website and app, as described below.

Google

Marvyn uses the following Google scopes when authorized by you:

• Read Google Ads performance and selected customer-account data.
• Read Google Search Console site and query performance data.
• Read GA4 property, session, channel, conversion, and landing-page analytics.
• Read and manage authorized Google Business Profile location data that you connect to Marvyn.

This may include customer-account identifiers, site URLs, GA4 property identifiers, Google Business Profile location identifiers, campaign performance metrics, query and landing-page performance data, sessions, channels, conversions, business profile data, and related reporting fields exposed by the Google APIs you authorize.

Marvyn's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Meta

Marvyn uses these Meta permissions when authorized by you:

• Read Meta ad accounts, campaign structure, campaign insights, and related advertising performance data.
• Manage authorized Meta ad-account connection operations required to maintain the integration, including webhook or account-subscription setup where enabled.
• Read Meta Business account and asset metadata needed to identify the ad accounts, Facebook Pages, and Instagram business accounts you choose to connect.
• List Facebook Pages you administer and read Page engagement or Page metadata for reporting inside Marvyn.
• Publish Facebook Page posts only when the publishing feature is enabled and you initiate the action inside Marvyn.
• Read Instagram business account profile information and Instagram insights for connected accounts.

LinkedIn

Marvyn uses these LinkedIn scopes when authorized by you:

• Identify your profile and save basic profile metadata.
• Fetch LinkedIn ad accounts where available.
• Publish LinkedIn UGC posts when you initiate publishing in Marvyn.

Shopify

When you connect your Shopify store to Marvyn, we access the following data via the Shopify Admin API using these scopes:

• Order data (read_orders): Order IDs, order dates, revenue, subtotal, shipping, tax, discounts, refunds, order source, financial status, cancellation status, and shop currency.
• Product and line-item data (read_products): Line item IDs, product IDs, product titles, quantities, line revenue, and line discounts, used for product performance reporting.
• Checkout data (read_checkouts): Checkout IDs, checkout dates, checkout value, and whether a checkout was completed or abandoned, used to report abandoned-checkout leakage and recovery opportunity.
• Customer analytics (read_customers): Order counts, lifetime spend, first and last order dates, and country, used for new-versus-returning, repeat purchase rate, and cohort/LTV reporting.
• Customer and storefront event data (read_customer_events): Aggregate daily counts of storefront events such as product viewed, added to cart, checkout started, and purchase, used to report the conversion funnel.
• Discount and price rule data (read_discounts, read_price_rules): Discount and price rule names, types, values, status, schedule, and usage counts, used to report promotion performance and discount leakage.
• Return data (read_returns): Return IDs, return dates, status, quantities, refund amounts, and Shopify's return reason codes, used to report return rate and returned products.
• Analytics data (read_analytics): Aggregate store sessions, visitors, and conversion rate reported by Shopify.
• Store metadata: Shop domain, shop name, and store currency needed to display Shopify reporting inside Marvyn.

Protected Customer Data. The read_customers and read_customer_events scopes are classed by Shopify as Protected Customer Data, and we hold them on a deliberately restricted basis. We do notstore Shopify customer names, email addresses, phone numbers, street addresses, or raw Shopify customer IDs. A customer's identity is converted into a salted, irreversible hash at the point we receive it, before anything is written to our database, so that we can count repeat purchases and build cohorts without holding a record of who your customers are. That hash cannot be reversed by us or by anyone who obtained our data, and it cannot be used to contact a customer. Geography is retained only at country level, never as an address. Storefront events are stored as aggregate daily counts, never as an individual person's browsing history.

Shopify data is used solely to generate store performance reporting, marketing insights, attribution analysis, and recommendations within Marvyn. We do not share, sell, or use your store data to train AI models or for any purpose beyond delivering the product features you have authorised. You can disconnect your Shopify store at any time from Settings, which removes Marvyn's access token. You may also revoke access directly from your Shopify admin under Apps & sales channels. On disconnection, or on a Shopify shop-redact request, we delete the store's data keyed by shop domain; customer-redact requests are honoured against the hashed identity.

Slack

When you connect a Slack workspace to Marvyn, Slack becomes a place to talk to Marvyn — it is never used as a marketing data source. We receive only the messages that mention Marvyn (and, if enabled, direct messages sent to the Marvyn app), and we use those messages solely to generate a reply from your connected Marvyn data. We do not read or store your other channel messages, and we do not read channel history.

We store installation metadata for the connection (workspace ID and name, the connecting account, granted scopes), the workspace access token encrypted at rest, and the minimal per-question trace (the question asked and a preview of the answer) that we keep for every Marvyn conversation to operate and debug the service. You can disconnect Slack at any time from Integrations, which deactivates the connection; you can also remove the app from your workspace in Slack's admin.

Microsoft Clarity

If you connect Clarity, Marvyn reads project-level behavioral analytics including sessions, scroll depth, dead clicks, rage clicks, and device/browser breakdowns.

DataForSEO

Marvyn uses DataForSEO for SEO crawl, keyword, competitor, and SERP-related analysis. Domains, URLs, and search-analysis inputs you submit may be sent to DataForSEO for processing.