Privacy Policy

Who we are

Marcelo is a marketing automation service operated by Marcelo AI Inc, a California corporation at 4654 Columbus Ave, Sherman Oaks, CA 91403, United States, reachable at support@meetmarcelo.ai. It is used by businesses, and by marketing agencies acting for the businesses they represent, to plan, draft and publish marketing work.

This policy covers meetmarcelo.ai and the Marcelo application. It does not cover the websites, listings and social accounts Marcelo publishes to — those belong to our customers and their own policies apply. Nor does it cover the websites Marcelo builds and hosts for a business: the business is their publisher, and what a visitor gives such a website is given to the business, under the business's own notice.

For the data you give us about your own account, we decide how it is used — we are the “controller”. For the data you give us about a business and its customers so that Marcelo can work on it, we act on your instructions — we are your “processor” — and our Data Processing Addendum sets out the terms. The cookies the site and the application use are described in the Cookie Policy.

What we collect

Four kinds of data, for four different reasons.

• Account data. Your name, email address and sign-in credentials, handled by our authentication provider. We use this to know who you are and to contact you about the service.
• Content you give us. Business details you enter, photographs you upload, website addresses you ask us to analyse, and the drafts and approvals that follow. This is the material the service works on. A business may share a Brand DNA Media link so people without an account can see its Brand DNA photos and people and add photos, names and roles directly. Uploads are recorded against the shared link; it does not verify the sender's identity. The business can replace the link to stop access through the old one.
• Data from services you connect. If you connect a Google account, a website or a social profile, we read the data those services expose to us. What we read from Google is set out in the next section.
• Data about a business's own customers. The reviews people leave on a connected listing and the replies to them; comments and messages on a connected social account; enquiries a visitor submits through the contact form of a website Marcelo hosts; and people who appear in photographs you upload. We process this only so Marcelo can do the work you asked for — reply to a review, pass an enquiry to the business — and never for any purpose of our own. A business's review page, which its customers reach from a review request or a QR code, drafts a review from the choices that customer makes on the page and copies it to their own clipboard; nothing they choose or write is sent to us or stored, and the page counts only how many times it was opened and how many times a review was copied.

If an account owner adds you as a team member, we hold your name and email address so you can sign in, and the record of what you approved or changed. The account owner is responsible for having told you so.

We also record which features were used and what each piece of work cost, so that usage can be billed and attributed to the right business. When you tell Marcelo which of the pictures and posts it made you like or don't like, that answer is kept with the business under the name of whoever answered, only to shape how Marcelo writes and draws for that business. During an account's first 30 days we also record which screens of the application its signed-in user opened and when — the screen's address only, never what is typed or shown on it — so we can see where new customers get stuck and improve Marcelo. In the same days we also note whether the account was opened from an advertising or campaign link and on what kind of browser and device, in a few words from a fixed list and never the link itself, and how the first Brand DNA question, whether the business has a website, was answered: read, refused and why, or which other way was chosen, never the address typed. Only Marcelo administrators see it. For every signed-in user we keep the time they last opened a screen, one date and nothing about the screen, to scan an account nobody opens less often. Payments are handled by our payment processor, Stripe; we receive the status of each payment and the last digits of the card, and never the full card number. When something in the application fails, a report of the error — what went wrong and the state of the screen, with personal details excluded by default — goes to our error monitoring provider, so we can fix it. Visits to our public home page are counted with Google Analytics, as the Cookie Policy describes; it does not run inside the application. To measure our own ads on Facebook and Instagram, the public home page also carries the Meta Pixel, and when an account is created our server tells Meta that a sign-up happened, with Meta's own cookies, the IP address and browser, and a scrambled form of the account's id — never the email address or name. It tells Meta the same way when a free trial starts and when a plan's first payment is made, with the amount paid, without the IP address and never with card details; so that it can, those cookies and the browser's description are kept on the subscription at our payment provider. Neither runs for a browser that sends a Global Privacy Control signal; neither runs inside the application. We do not sell data to anyone. For signed-in users, we may also save an image of the displayed error panel, its page path, time and reporting email so Marcelo administrators can investigate. This captures the error panel, not your forms or the rest of the page. These screenshots are encrypted in storage and are available only to Marcelo administrators, including through links in operational alert emails.

Where European or UK data protection law applies, we rely on these legal bases: performing our contract with you, for everything the service does at your request; our legitimate interests, for security, error monitoring, preventing abuse and improving the service in ways that do not override your rights; our legal obligations, for billing and tax records; and your consent, where we ask for it. You can withdraw consent at any time without affecting what was done before.

Google user data

Connecting a Google account grants Marcelo access to a specific, limited set of Google data. We ask for the narrowest scopes that let the features work:

• Search Console (read, adding a site, and its sitemap). The list of properties you can access, and search performance data — queries, impressions, clicks and average position — for the property you map to a brand. We use it to report what a site already ranks for and which terms are close to the first page. It also lets us add a site as a property once ownership has been proved, which is the step that makes that data readable at all — so that a client with no Google account never has to add one themselves. Once a site is a property, we send Google the address of the site's own sitemap, again whenever the site changes or Marcelo publishes a page on it, and we ask Search Console what Google knows about each page Marcelo published — whether it is in Google search yet — to show you. What we send is public addresses on your site and nothing else. We do not remove properties.
• Analytics (read-only). The list of properties you can access, and aggregate traffic figures for the property you map to a brand. We use it to report how many people visited and where they came from. We do not read individual user identifiers.
• Analytics (create and configure). Permission to create a Google Analytics property and its web data stream, and to read the measurement ID of one. We use it mainly for one thing: setting measurement up for a brand that has none, so that nobody has to be walked through the Analytics interface. We do not delete properties. The one change we make to a property that already exists is marking one of its own events as a conversion, and only on a step a person has approved.
• Tag Manager (read-only). The list of containers you can access, and the tags published live in the one you map to a brand. We use it to tell “this site has no visitors” apart from “nothing is measuring them” — two findings that look identical in an empty Analytics report and mean opposite things. We cannot change a container.
• Site verification. Permission to prove ownership of a website in Search Console. We use it so that a client with no Google account never has to make one in order for their site to be measured. It grants nothing but proving ownership — it cannot read a site, a report or a profile.
• Google Ads. The advertising accounts you can access, their campaigns, and what those campaigns spent and returned. We use it to report on paid performance and to propose changes — a budget, a bid, a keyword, a campaign's status. Google grants Ads as a single permission that also allows changing an account; every change Marcelo makes is written down first, checked with Google without being applied, and applied only after a named person has approved it. Nothing is spent, paused or started automatically.
• Blogger. The list of blogs on the account, so that a brand whose website is a Blogger blog can be connected to it. Reading that list is all Marcelo does with it today. Google grants Blogger as a single permission that also allows posting, and grants permissions at the sign-in screen and never afterwards, so it is asked for once rather than again the first time somebody approves a post. Nothing is ever posted that a person has not approved.
• Google Drive (files Marcelo creates). Permission to create documents in your Google Drive, and to see and manage only those documents. We use it for one thing: building a set of public Google documents about the business — an about page, a services list, an areas list — that link to the website, when somebody presses the button that makes them. This permission cannot see anything else in your Drive. Files Marcelo did not create are invisible to it, including files somebody shared with you, and it cannot list, read, change or delete them.
• Google Business Profile. The Business Profile listings you manage, and for the one you choose for a brand: its details, its reviews, and replies to those reviews. We use it to report on the listing and its reviews, to reply to reviews, and to add photos and publish posts on it. Google grants the Business Profile as a single permission that also allows changing the listing itself; every reply, photo and post Marcelo adds is approved by a person first, and nothing is published to the listing automatically.

Marcelo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we use Google user data only to provide and improve the features described above; we do not transfer it to others except as needed to provide those features, for security purposes, or to comply with applicable law; we do not use it for advertising; and we do not allow humans to read it except with your explicit consent, for security purposes, to comply with applicable law, or where the data is aggregated and anonymised.

We never train AI models on your Google data, and we do not use it to train models of our own.

If you connect Marcelo to ChatGPT

You can connect Marcelo to ChatGPT (or another assistant that speaks the same protocol), so that you can work with Marcelo from inside the chat: read what Marcelo measured about your business, start a Marketing Scan or an AI Search Lab check, start Marcelo Fix and Marcelo Write work, have Marcelo Write create a page, start a website with Marcelo Build, talk to Marcelo Write, Marcelo Build and Marcelo, manage Marcelo Daily, have Marcelo Media plan, produce and fix videos and choose their takes, read and correct your Brand DNA, manage reviews, Autopilot and your listings, undo a change Marcelo made, and approve, publish or discard the work waiting for you. The connection is yours to make and to remove: you make it by signing in to Marcelo from inside ChatGPT, and removing it there ends it. Marcelo Media is offered in ChatGPT and not in Claude.

While it is connected, what ChatGPT asks Marcelo for on your behalf — your businesses, your scan and AI Search Lab results, the work on offer and the work waiting for you, your Marcelo Daily calendar, your conversations with Marcelo’s experts and your videos, your confirmed Brand DNA facts, your Google reviews and the replies to them, the customers you add to ask for reviews, what Marcelo did recently, your Credits and plan, which accounts are connected, and the names and addresses of your team — is sent to OpenAI as the answer to that question, and OpenAI handles it under its own terms. Marcelo sends ChatGPT nothing you did not ask it for, and never sends your tracking or advertising account numbers.

Nothing is published, discarded or charged through ChatGPT until you have said yes to that exact item in the chat: Marcelo first answers with what would happen and its price, and acts only on a second request carrying your confirmation, recorded as your own decision under your sign-in, exactly as your press in Marcelo is. Work started from ChatGPT costs the same Credits as the same work started in Marcelo, and is refused before it starts when your Credits cannot cover it. No money is ever paid through ChatGPT: plans and Credits are bought only on Marcelo’s own screens.

Who else processes it

We rely on a number of providers to run the service. Each receives only what it needs to do its job.

• Anthropic — generates text. Receives the prompts and business facts relevant to the piece being written.
• fal.ai — generates images and video. Receives your prompt and any reference image you supply, and the finished video itself when you ask for a sharper copy of it.
• OpenAI — generates text, and answers the questions the AI Search Lab asks. Receives the prompts and business facts relevant to the piece being written, and the questions asked about a business.
• Perplexity — answers AI Search Lab questions. Receives the question asked about a business, which usually names it.
• Google — the services described above, when you connect them. Also Gemini, where it is set up to answer AI Search Lab questions. And Google Analytics, which counts visits to our public home page.
• Meta — measures our own ads on Facebook and Instagram. Receives visits to our public home page through the Meta Pixel, and a message when an account is created, a free trial starts or a plan's first payment is made, as the Cookie Policy describes; never an email address, name or card details.
• DataForSEO — the licensed route to what ChatGPT Search and Google AI Overviews answer, and the source of backlink data and search volumes. Receives the question asked, or the website address being looked up.
• BrightLocal — directory listings: the free check of where a business is listed, and listings you order. Receives the business details approved for listing — name, phone, website, category, a description written only from approved details, and the address, which is not shown on listings for a business that goes to its customers. Its progress emails about an order go to Marcelo’s own operations inbox, not to the business’s public email.
• Meta — where an Instagram account or a Facebook Page is connected, so that approved posts can be published to it. For a Facebook Page this includes reading which Pages the account manages, so the right one can be posted as. The Marketing Scan also reads the connected account's own recent posts, their like, comment and share counts and its follower count, to report on them; it reads no comment text and no messages.
• CompanyCam — where connected, jobsite photographs and their captions.
• Atlas Cloud — generates video with the same models, where the first provider declines a request. Receives your prompt and any reference image you supply.
• A website-building service — where Marcelo builds a website for a business, the business's confirmed details and the pages of the website being built. It keeps its own copy of the website; see “How long we keep it”.
• Stripe — payments. Receives your billing name, email address and payment details, which it holds; we never see a full card number. Where a business connects its own Stripe account so a website Marcelo hosts can take payment, Stripe processes those payments for the business, under its own terms.
• Porkbun — domain registration, where Marcelo registers a web address for a business. Receives the registrant contact details the registration requires.
• Resend — sends email. Where Marcelo emails a business's customer on its behalf — a reply to an enquiry from a hosted website, for example — Resend receives the recipient's address and the message.
• Sentry — error monitoring. Receives reports of failures in the application, with personal details excluded by default.
• Clerk — authentication. Holds your sign-in credentials.
• Neon and Cloudflare R2 — database and file storage.
• Vercel — hosting.

Each provider is bound by a contract that limits what it may do with the data to the job named above. Our AI providers are used on terms under which they do not train their models on what we send them. We tell you by email at least 30 days before adding a provider that will process personal data on your behalf, and our Data Processing Addendum gives you the right to object.

These providers process data in the United States and, in some cases, elsewhere — including the European Union. Where personal data leaves the European Economic Area, the United Kingdom or Switzerland for a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses and the UK Addendum, as set out in the Data Processing Addendum. We do not sell personal data. The only data that goes to an advertising company is what reaches Meta to measure our own ads, described above; data you or the businesses you represent give us inside the application never does.

How long we keep it

Content and reports are kept for as long as your account is active, because the value of a report is largely in comparing it with the last one. Delete a brand and its content, media and reports are deleted with it. Scan results older than a year are deleted on their own, whatever else happens; the record of what Marcelo did — each change it made and who approved it — is kept for as long as the account is.

Close your account and everything in it is deleted straight away, in one go: every business, its content, media, reports and connections, the API keys you stored with us, and the record of what your usage cost. We keep billing records where tax law requires it.

Three things are kept on purpose, and none of them is deleted by that button. The email address you signed in with, so that signing in again works and lands you on an empty account rather than shut out. And any support request you had open, because a problem you asked us about does not stop being one when you leave. Ask us to remove either and we will — see “Your rights” below.

The third is the record of Marcelo Credits: how many a business was given each month and how many it used. It is kept when a business is deleted and when an account is closed, because it is the record of what was paid for. It holds no details about the business, its customers or its website — it is dates and numbers. Unlike the two above it cannot be removed on request: nothing can change or delete a line of it once it is written, which is what makes it a record rather than a note.

A fourth is kept where Marcelo bought a web address for a business: the address, what it cost, and the day it was bought. A registration is real property in our registrar account with a renewal date on it, so deleting the business here does not make it stop existing — and a record of what we spent on your behalf is one we have to be able to show you. It holds nothing about the business, its customers or its website beyond the address itself. Ask us to transfer the address to you, or to let it lapse at renewal, and we will.

A fifth is a website Marcelo built for a business. A website Marcelo built is also kept by the service that built it. Deleting the business here removes everything on Marcelo's side — that copy stays, and we have no way to remove it. It holds what the website itself shows — the business’s confirmed details and its pages — and nothing else about the business or its customers.

Questions you ask Marcelo in the chat panel are kept with the business you asked them about, along with the answer, so that a follow-up question makes sense to it. Only the most recent few are ever read back, and older ones are removed as you keep asking — we do not keep a history of everything you have ever asked. Where Marcelo went and looked something up in order to answer — your own website, your advertising figures, a web search — what it read back is kept on that same exchange, so that if you tell us an answer was wrong we can check it against what Marcelo was really looking at instead of asking your accounts all over again. It is never shown to another business and is removed exactly when the exchange is. They are deleted with the business, with your account when you close it, and in any case a year after the conversation was last opened.

Disconnecting a service deletes the stored token immediately, so we can no longer reach that account. Withdrawing the permission at the provider itself is separate and yours to do — for Google, the link below.

Your rights

You can ask us for a copy of your data, ask us to correct it, or ask us to delete it. Write to support@meetmarcelo.ai and we will respond within 30 days.

You can revoke Marcelo's access to your Google account at any time, without asking us, at myaccount.google.com/permissions. Doing so stops any further reading immediately.

Most of this you can do yourself, without asking: delete a business, close your account, or disconnect a service. Where each control is and what it does is on Deleting your data.

If you are in the EEA, the UK or Switzerland, you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable form, and to withdraw a consent you gave. You may also complain to the data protection authority where you live or work. We do not make decisions about you by automated means that have legal or similarly significant effects.

If you are a California resident, you have the right to know what personal information we collect, use and disclose, and the categories of sources and recipients; to have it deleted; to correct it; and not to be discriminated against for exercising those rights. The categories we collect are those listed under “What we collect”: identifiers, commercial information, internet activity in the form of error reports and visits to our home page, and the content you and the businesses you represent give us. We do not sell personal information. To measure our own ads we ask Meta to apply its Limited Data Use restrictions to California residents, under which Meta processes the visit, sign-up, trial and first payment described above as our service provider; and the Meta Pixel and those messages do not run at all for a browser that sends a Global Privacy Control signal, which we treat as your request to opt out of sharing. We do not use or disclose sensitive personal information for anything beyond providing the service. You may make a request yourself or through an authorised agent; we verify a request against the account it concerns, and we will tell you if we cannot act on it and why. You may appeal a decision by replying to it.

If you are a customer of a business that uses Marcelo — you left a review, sent an enquiry through its website, or appear in one of its photographs — the business decides how your data is used, and your request should go to it. If you write to us instead, we will pass your request to the business and help it respond. We will not respond on the substance ourselves unless the law requires it.

We send email about your account and the service — a receipt, a failed payment, a connection that stopped working, a draft waiting for approval. We do not send marketing email unless you asked for it, and any we send carries a way to stop it.

Security

Data is encrypted in transit and at rest. Access tokens and API keys are stored encrypted, and are never shown back to you in full once saved. Access to production data is limited to the people who operate the service.

No system is perfect. If a breach affects your data, we will tell you and the relevant authority as required by law.

Children

Marcelo is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children.

Changes

If we change this policy in a way that materially affects you, we will email you before it takes effect. The date at the top always reflects the current version.