1. Who we are
Marshi is an AI creative partner that helps teams structure, use and improve brand context across projects, Marshi, Studio, Content and Sites surfaces.
Marshi is operated by Holmkvist Primestreak ENK, Havreveien 59, 0680 Oslo, Norge, org.nr. 937 021 801. Holmkvist Primestreak ENK is a Norwegian sole proprietorship. The registration is public in the Brønnøysund Register. Holmkvist Primestreak ENK is the controller for the processing described in this policy, except where section 2 says the customer is the controller.
Privacy requests go to support@marshi.ai. We have not appointed a data protection officer. The service is not directed at children. In Norway the age for consent to an information-society service is 13 (personopplysningsloven § 5). We do not knowingly collect personal data from a child under that age.
The GDPR text used in this policy is Regulation (EU) 2016/679, as it applies in Norway.
2. Controller and processor
We are the controller for accounts, billing of Marshi, security of the service, our own analytics and error monitoring, support mail, and the free tools and public brand scan when those are available.
For content a customer puts in a workspace about their brand, staff, customers or anyone else, the customer decides the purpose. We process that content to provide Marshi, so we are the processor. That split, and the Article 28 terms, are on the Data Processing page. A signed data processing agreement is available on request to support@marshi.ai. This policy does not replace that agreement.
3. Purposes, categories, lawful basis and retention
Article 6 is the lawful basis. Article 13 asks us to state the purpose, the categories, the basis and how long we keep the data. Where a row says consent, you can withdraw it without affecting processing that happened before the withdrawal (Article 7(3)).
| Purpose | Categories | Lawful basis | Retention |
|---|---|---|---|
| Account and workspace | Name, email, sign-in identifiers, workspace membership and role, and the brand, project, asset, draft, instruction and feedback content you add. | Article 6(1)(b), to perform the service you signed up for. Where a business customer decides why content about other people is in the workspace, that customer is the controller and we are the processor. | For as long as the workspace exists. After a verified deletion request we delete it within one month, apart from the billing records below and a host backup that lives only until the host overwrites it. This codebase does not set a separate backup period. |
| The AI task you ask for | The prompt, the brand context the task needs, files you attach, and the output. The cost ledger stores the model, token counts and price. It does not store the prompt text. | Article 6(1)(b), because the task is what you asked us to do. The same controller and processor split applies as for workspace content. | Prompt and output stay with the workspace content, for the same period. The cost row keeps model, usage and price after the account is gone, with the user link removed. How long the model provider keeps a copy is that provider’s own term. This notice does not describe that term. |
| Billing and accounting | Plan, subscription status, invoices, and the billing details you enter at Stripe Checkout. Payments there are for plans and credits. Checkout creates a Stripe Customer for the workspace when it does not already have one. We do not store the card number. | Article 6(1)(b), to take payment, and Article 6(1)(c), to keep the accounting record the Bookkeeping Act requires. | Accounting records are kept for five years after the end of the financial year (bokføringsloven § 13). Stripe keeps the Customer under Stripe’s own schedule. |
| Security and abuse limits | An HMAC-SHA-256 hash of the IP address, and of a random device identifier. The raw IP is not written to the rate-limit table. Security and audit events that record an action without the prompt. When email sign-up protection is switched on, Cloudflare Turnstile runs on that form. It is strictly necessary security, it does not wait for analytics consent, and Google or GitHub sign-in does not load it. The token, and the IP address sent with the check, are not stored. | Article 6(1)(f). The interest is keeping the service up and stopping abuse. You can object under Article 21. The device cookie tells browsers apart for that limit. It is not an advertising cookie. | The hash is kept until one day after its rate-limit window ends. A scheduled job then deletes the expired counter. The device cookie (pp-lead-device) lasts 24 hours, the same length as the daily abuse window, and is set only when a new device id is issued. It is a random identifier we set, not a hardware fingerprint. A Turnstile token is not stored. |
| Product analytics | Page and product usage in PostHog, and page usage and performance in Vercel Web Analytics and Speed Insights. Loaded only after you accept analytics. | Article 6(1)(a), consent, which you can withdraw. The cookie itself follows ekomloven § 3-15. | New events stop when you withdraw consent. Events already stored stay for the life of the analytics project. This codebase does not set a shorter fixed period. |
| Errors and reliability | Error reports and a sample of performance traces in Sentry. Secrets, cookies and email addresses are scrubbed before send. Session replay, when it is switched on, is sent only after you accept analytics. | Article 6(1)(f), to find and fix failures. Replay follows the analytics consent above. | Sentry keeps events for the period configured on the project. This codebase sets a five percent performance-trace sample in production and does not set that storage period. |
| Transactional email | The address we send to, and the account, invitation or billing message itself. | Article 6(1)(b), to deliver a message about the account or the purchase. | Resend keeps its delivery logs under its own terms. We do not run a mailing list, and we do not email people from the brand-scan log. |
| Free tools, when they are switched on | Text you submit: a CV, a job ad, a name brief, a caption brief, or an image prompt. A web address you give us, including a public profile URL, which our servers fetch and send to the model as extracted text. Draft cookies for a palette, a logo, a signature and a card. | Article 6(1)(b), steps you ask us to take to produce the draft. Article 6(1)(f) for the abuse limits in the security row. | The draft cookies last two hours. They are httpOnly. The profile cookie is signed. That text is not written to our database. It is sent to the model that produces the draft. A guest can make up to three CV applications without an account, and then needs an account. In the app, importing a CV, composing a CV, and writing a job application use credits. |
| Public brand scan | The URL, the domain, the scan result, and the visitor’s IP address stored in client_key. That IP is not hashed. The table has no email address. | Article 6(1)(b) to run the scan you asked for. Article 6(1)(f) to reuse a recent result, limit abuse, and see which sites were scanned. | Rows are not deleted on a timer. A successful scan can be reused for the same domain for 24 hours. We delete a row when you ask, or when we prune the log. |
| Accounts you connect | The access token for Facebook, Instagram, LinkedIn or X, the account identifiers the platform returns, and the post you ask us to publish. | Article 6(1)(b), to publish or sync on the connection you set up. | The token is removed or invalidated when you disconnect. Drafts you already made stay in the workspace until that content is deleted. See the data-deletion page. |
The five-year accounting period is bokføringsloven § 13. Cookies are also covered by ekomloven § 3-15. The Cookie Notice describes the banner. Sign-in cookies are what keep an account signed in. Draft cookies hold a free-tool draft for two hours. Analytics cookies are separate: PostHog, Vercel Web Analytics and Speed Insights load only after you accept analytics.
4. Free tools and the brand scan
The free tools (CV draft, job-ad tailoring, names, captions, stills, logo drafts, email signatures and cards) run only when they are switched on. Text you submit is sent to a language or image model so we can return the draft. That includes a CV and the job ad you paste. If you give the CV tool a web address, our servers fetch that page and send the extracted text to the model. Send a page only if you are allowed to. The text can name someone other than you.
The color palette does not call a model. A starting color or an image is read in your browser and is not uploaded. If you paste a website, our servers fetch that page and read colors from it. Send a page only if you are allowed to.
Abuse limits use the hashed IP and the pp-lead-device cookie from the security row. A guest can make up to three CV applications without an account, and then needs an account. The CV text itself stays in the two-hour draft cookie and is not written to our database. In the app, importing a CV, composing a CV, and writing a job application use credits. Stripe Checkout is for plans and credits.
The public brand scan stores one row per scan in marketing_brand_scans: URL, domain, result, and the visitor IP in client_key. There is no email column, and we do not send mail from that log. A page you ask us to read can contain other people’s personal data. We use it to answer the scan. We cannot practicably notify every person named on that page (Article 14(5)(b)).
5. AI providers
A task sends the context that task needs, not a full copy of the workspace. Language-model calls go first through the Vercel AI Gateway, with a direct call to Anthropic or OpenAI if that Gateway leg fails. Image, video, speech, search and embeddings go to the provider named for that lane on the subprocessor list.
How long a provider keeps a prompt, and what it may later do with it, is that provider’s contract with us. This policy states what we send and where. It does not state a provider training rule.
Avoid sending special-category data (health, religion, trade-union membership and the other categories in Article 9) unless you have a basis of your own for it. We do not ask for it.
6. Recipients and transfers outside the EEA
The named processors, the data they receive, their country and the Chapter V tool (Articles 44 to 46) are listed at /privacy/subprocessors. The tools we rely on are the EU-US Data Privacy Framework where that row says so, and the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914). A row that does not name the Framework does not claim it.
Facebook, Instagram, LinkedIn and X receive data only when you connect them and ask us to publish or sync. They are separate controllers of what is then published on their service. Details are on the same list.
We do not sell personal data. We do not send marketing email.
7. Your rights
You can ask us to:
- Access the personal data we hold about you, and for a copy (Article 15).
- Correct inaccurate data (Article 16).
- Delete data, where Article 17 applies. Accounting records can be kept for the five-year period.
- Restrict processing (Article 18).
- Receive data you provided, in a machine-readable format, and ask us to send it to another controller where Article 20 applies.
- Object to processing based on legitimate interests, including the security, brand-scan and error-monitoring rows (Article 21). We stop unless we show compelling grounds.
- Object to direct marketing. We do not send any.
Article 19 requires us to tell recipients about a correction, deletion or restriction unless that is impossible or disproportionate.
We do not make a decision based solely on automated processing that produces a legal effect, or a similarly significant effect, about you (Article 22). Generating a draft, choosing a model and applying an abuse limit do not decide your legal rights. There is no profiling for that kind of decision, so the Article 22 safeguards are not engaged.
Email support@marshi.ai from the address on the account, or from the address you want us to use if you have no account. Say which right you are using, and whether you want a copy, a correction or deletion. The steps for deletion, including connected Meta and Instagram data, are on the data-deletion page. There is no self-serve export or deletion button in the product yet. A manual request is the way to exercise the right.
We reply within one month of receiving the request (Article 12(3)). If the request is complex, or you have made many, we can extend that by two further months. If we do, we tell you within the first month and say why. We may ask for enough information to be sure it is you. The reply and the copy are free unless a request is manifestly unfounded or excessive (Article 12(5)).
8. Complaints
You can complain to the Norwegian Data Protection Authority, Datatilsynet, which is our supervisory authority: datatilsynet.no. How to lodge the complaint is described at Klage til Datatilsynet. You can also complain to the authority where you live or work. We ask that you write to us first so we can fix it, but that is not a condition of complaining.
9. Changes
When this policy changes, we change the date at the top. Continued use of Marshi after that date is not a consent to the policy. Where a change needs consent, we ask for it.
Related pages: Terms of Service, Data Processing, Cookie Notice, Subprocessors.
