Privacy Policy for Marby.ai

Effective date: September 9, 2026
Data controller: Marby AI Inc. (doing business as Marby.ai)
Address: Calgary, Alberta, Canada T2G 4J6
Privacy contact: support@marby.ai

Marby AI Inc. (doing business as Marby.ai) (“Marby,” “we,” “us,” or
“our”) provides an AI-assisted marketing platform that helps businesses
understand their brand, plan marketing, create content, connect eligible social
media accounts, schedule and publish posts, and review available performance
information.

This Privacy Policy explains what personal information and other data we
collect, why we use it, when we disclose it, how long we retain it, and the
choices available to you. It applies to the Marby website, public discovery
tools, member application, communications, and connected social-platform
features (collectively, the “Service”).

We handle personal information in accordance with applicable Canadian privacy
law, including the Personal Information Protection and Electronic Documents
Act (PIPEDA) and applicable provincial private-sector privacy legislation.

1. Information We Collect

Account and membership information

We may collect:

your name, email address, username, encrypted or hashed authentication
credentials, and account identifiers;
your membership, subscription, transaction, renewal, cancellation, and
account-status information;
your business name, website, location, industry, contact details, and other
business-profile information; and
your settings, preferences, timezone, language, and communication choices.

Payment-card information is collected and processed by the payment provider
made available during checkout. Marby does not intentionally store your full
payment-card number or security code.

Business, marketing, and content information

We collect information you enter, upload, create, approve, or direct Marby to
use, including:

business and brand information, questionnaire responses, goals, customer and
market information, promotions, and marketing preferences;
captions, post ideas, calls to action, hashtags, links, schedules, notes,
images, videos, logos, and other media;
marketing plans, analyses, drafts, generated content, revisions, approvals,
and publishing instructions; and
support requests, feedback, and communications with Marby.

Public website discovery information

When you request a public MAI Discovery report, we collect the website address
and email address you provide, verification and delivery information, and the
resulting report. We may review publicly available content from the submitted
website and other public sources to prepare the report. We also retain records
needed to enforce report limits, prevent abuse, protect the Service, and reopen
an existing private report for the verified recipient.

When you connect a supported social platform, we may collect and process:

the name and platform identifier of the person authorizing the connection;
OAuth access tokens, Page access tokens, token expiry information, and the
permissions granted or declined;
eligible Facebook Page names, identifiers, pictures, and access information;
eligible Instagram professional-account names, usernames, identifiers,
pictures, and the Facebook Pages to which they are linked;
selected social channels and their connection status;
the content, media, links, schedules, and publishing instructions you direct
Marby to send;
platform post, media, and publishing-container identifiers and statuses; and
performance information made available by the platform, such as reach,
views, impressions, reactions, comments, shares, saves, clicks, and other
engagement or insight metrics.

Marby does not receive or store your Facebook, Instagram, LinkedIn, or other
social-platform password.

Technical and usage information

We may collect IP address, browser and device information, operating system,
referring pages, session and cookie information, application activity, feature
usage, error records, security events, and diagnostic logs. We use this
information to operate, secure, troubleshoot, and improve the Service.

2. How We Use Information

We use information to:

create, authenticate, administer, and secure accounts and memberships;
provide public Discovery reports and member-requested analyses;
understand your business and produce the marketing plans, content, images,
recommendations, and other results you request;
connect eligible social accounts and let you choose publishing destinations;
schedule, publish, confirm, and troubleshoot content you approve;
retrieve and display available post status, engagement, and performance
information;
provide support, service notices, verification messages, transactional email,
and account communications;
process subscriptions and maintain financial and transaction records;
monitor performance, prevent fraud, abuse, unauthorized access, and service
disruption;
diagnose errors and improve the reliability, accessibility, and usability of
the Service; and
comply with legal obligations and enforce our agreements and policies.

We do not sell personal information or Meta Platform Data. We do not use social
access tokens for advertising profiles or purposes unrelated to providing and
securing the Service.

3. Artificial Intelligence Processing

MAI uses external artificial-intelligence services, including OpenAI services,
to help produce requested analyses, plans, written content, and images. The
information sent for a request may include relevant business-profile answers,
website content, brand information, marketing instructions, promotions,
content, and media supplied or approved by you.

AI-generated material may be incomplete or inaccurate and should be reviewed
before it is approved, published, or used to make a business decision.

Marby does not send social-platform passwords to AI providers. Meta OAuth access
tokens and Page access tokens are used for account discovery, publishing,
status, and metrics operations and are not included in ordinary MAI content-
generation prompts.

4. Meta Permissions and Their Purposes

Marby’s current Facebook-based Meta connection may request the following
permissions:

public_profile — identify the Facebook account authorizing the
connection and provide the connected experience;
pages_show_list — discover Facebook Pages the authorizing person may
make available to Marby;
pages_read_engagement — read Page and post information needed to confirm
publishing state and retrieve available engagement information;
read_insights — retrieve available Facebook Page and post insights;
pages_manage_posts — publish and manage content you approve for a
selected Facebook Page;
instagram_basic — identify eligible Instagram Business or Creator
accounts linked to available Facebook Pages;
instagram_content_publish — publish content you approve to a selected
Instagram professional account;
instagram_manage_insights — retrieve available Instagram account and
media insights; and
business_management — discover eligible business assets and Page
assignments needed to present the accounts Meta permits the authorizing
person to use.

The authorizing personal Facebook profile is used as the connection identity;
Marby does not publish to personal Facebook profiles. Marby displays only the
Pages and professional Instagram accounts Meta makes available under the
permissions and asset access granted by the authorizing person.

We use Meta Platform Data only to provide, secure, support, and improve the
connected features described in this policy and as permitted by Meta’s terms.

5. Cookies and Similar Technologies

Marby and its service providers may use cookies and similar technologies to
keep you signed in, preserve settings, protect forms and accounts, understand
Service performance, and support essential website and checkout functions.
You can manage cookies through your browser. Disabling necessary cookies may
prevent parts of the Service from working.

Where applicable law requires consent for non-essential cookies, we will seek
that consent through the controls made available on the website.

6. How We Disclose Information

We disclose information only as reasonably necessary for the purposes described
in this policy:

Hosting and infrastructure providers, including Hosting.com (operated by
A2 Hosting, LLC), that host and support the Service;
Security providers, including Imunify360 services provided by CloudLinux
Software, Inc. through our hosting environment;
AI service providers, including OpenAI, when processing a request for an
AI-assisted feature;
Payment providers that process membership purchases, recurring payments,
refunds, and payment-method updates;
Email and communications providers that deliver verification,
transactional, support, and report messages;
Social platforms, including Meta and LinkedIn, when you connect an
account or direct Marby to publish, retrieve status, or collect available
performance information;
Professional advisers and business service providers subject to
appropriate confidentiality obligations; and
Public authorities or other parties when disclosure is required by law,
legal process, or reasonably necessary to protect the rights, safety, and
security of Marby, our users, or others.

Service providers are authorized to process information only for contracted
services and are expected to protect it appropriately. Marby remains
accountable for personal information under its control, including information
transferred to a service provider for processing.

We may disclose information as part of a proposed or completed financing,
merger, acquisition, restructuring, sale, or transfer of all or part of the
business, subject to appropriate confidentiality and legal safeguards.

7. Security

Marby uses administrative, technical, and organizational safeguards appropriate
to the nature and sensitivity of the information. These include access
controls, encrypted communications, security monitoring, and encryption at
rest for stored OAuth and Page credentials.

Access to personal information and platform credentials is limited to systems
and authorized personnel that require it to operate, secure, support, or
maintain the Service. No internet transmission or storage system is completely
secure, and we cannot guarantee absolute security.

If a privacy or security breach creates a real risk of significant harm, Marby
will investigate and provide notices to regulators and affected individuals as
required by applicable law.

8. Retention

Marby retains personal information only for as long as reasonably necessary to
fulfil the purposes described in this policy, maintain appropriate business and
security records, resolve disputes, enforce agreements, and meet legal,
accounting, and regulatory obligations.

Retention depends on the type of information:

Account, business, and content information is generally retained while
the account is active and until it is deleted or no longer required for the
Service or an applicable legal obligation.
Social credentials and channel information are retained while needed to
maintain the connection and provide publishing and metrics features.
Disconnecting disables Marby’s use of the connection. A request to delete
the associated stored connection data may be made as described below.
Discovery information is retained to deliver and protect the private
report, enforce the one-report rule, prevent abuse, and support the verified
recipient. Following a valid deletion request, Marby may retain a one-way
derived suppression value where reasonably necessary to enforce usage limits
and prevent abuse without retaining the report content.
Transaction and financial records are retained for the period required by
tax, accounting, payment, and other applicable laws.
Security and diagnostic records are retained for the period reasonably
needed to investigate incidents, prevent abuse, and maintain Service
reliability.
Backups may contain residual copies until they are overwritten through
the normal secured backup cycle. Such copies remain protected and are not
restored for ordinary business use after a deletion request.

Information may be retained longer when required by law, subject to litigation
or an investigation, or reasonably necessary to establish, exercise, or defend
legal claims. When information is no longer required, it is deleted,
de-identified, or securely disposed of.

9. Your Choices and Privacy Rights

Depending on where you live, you may have the right to:

request access to personal information Marby holds about you;
ask how that information has been used and disclosed;
request correction of inaccurate or incomplete information;
withdraw consent to optional processing, subject to legal and contractual
restrictions and reasonable notice;
request deletion or de-identification of personal information that Marby is
not required to retain;
disconnect a social account or revoke platform permissions; and
ask questions or make a complaint about Marby’s privacy practices.

Send privacy requests to support@marby.ai with enough information for us to
identify the account and understand the request. We may need to verify your
identity before providing access, making a correction, or deleting information.
We will respond within the period required by applicable law and will explain
any lawful restriction that prevents us from fulfilling all or part of a
request.

You may also have the right to contact the Office of the Privacy Commissioner
of Canada or the applicable provincial privacy regulator.

Disconnect or revoke access

You can stop future social-platform activity by:

using Disconnect in Marby’s Social Media Settings; or
revoking Marby’s access through the connected platform’s settings, such as
Facebook’s Business Integrations or Apps and Websites controls.

Disconnecting or revoking access prevents Marby from making new authorized
platform requests. It does not by itself constitute a request to delete your
entire Marby account, content history, transaction records, or all stored
connection records.

Request deletion

To request deletion of personal information associated with your Marby account
or Meta connection:

disconnect the applicable social connection in Marby, if you still have
access to the account;
email support@marby.ai with the subject Data Deletion Request;
identify the Marby account and connected platform involved; and
complete any reasonable identity-verification step we provide.

After verification, Marby will delete or de-identify the information covered by
the request unless it must be retained for a legal obligation, transaction
record, fraud or abuse prevention, security investigation, dispute, or legal
claim. We will explain any applicable exception.

Public deletion instructions are available at
https://marby.ai/data-deletion/.

11. International Processing

Marby is based in Canada. Our service providers and connected platforms may
process information in Canada, the United States, and other countries where
they or their subprocessors operate. Information processed outside your
province or country may be subject to the laws and lawful-access requirements
of that jurisdiction.

Marby uses contractual, organizational, and technical safeguards appropriate
to the information and remains accountable for personal information transferred
to service providers for processing.

12. Children’s Privacy

The Service is intended for businesses and is not directed to children under
13 or under the minimum age required to use the Service in their jurisdiction.
We do not knowingly collect personal information from children in violation of
applicable law. If you believe a child has provided personal information to
Marby improperly, contact support@marby.ai.

13. Third-Party Services and Links

The Service may contain links to websites and services operated by other
organizations. Their privacy practices are governed by their own policies.
Connecting a social platform or using a payment provider also remains subject
to that provider’s terms and privacy policy.

14. Changes to This Policy

We may update this Privacy Policy when our Service, providers, legal
obligations, or information-handling practices change. We will post the revised
policy with a new effective date. Where required, we will provide additional
notice or obtain consent for a material new use of personal information.

Marby retains prior versions of this policy as required for governance,
compliance, and platform-review purposes.

15. Contact Marby’s Privacy Officer

Questions, access or correction requests, deletion requests, and privacy
complaints may be directed to:

Privacy Officer
Marby AI Inc. (doing business as Marby.ai)
2228 Alexander Street SE
Calgary, Alberta, Canada T2G 4J6
support@marby.ai

If you submit a complaint, Marby will investigate it and communicate the result
and any appropriate corrective action.