Privacy Policy

1 Information We Collect

We only collect what we actually need. Depending on which app you use, this may include:

• Account information: Name, email address, and password when you choose to create an account.
• Usage data: How you interact with our apps — features used, session duration, and crash reports. This helps us fix bugs and improve the experience.
• Device information: Device type, operating system version, and unique device identifiers. Used to diagnose technical issues and understand which platforms to support.
• Content you create: Any content you upload, generate, or store within our apps (e.g. recordings, notes, invoices, photos). This data belongs to you.
• Payment information: Subscription purchases are processed entirely by Apple App Store or Google Play. We do not receive, store, or have access to your card details.
• Location data: Only where expressly required by app functionality (e.g. EV charger finder), and only with your explicit permission. You can revoke access at any time in your device settings.
• Install attribution: Anonymous install source and launch counts, used to understand which marketing channels are working. No personally identifiable information is linked to this data.

2 How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain our apps and services
• Improve, personalise, and expand our services
• Understand and analyse how you use our apps so we can build better features
• Send you service-related communications — account confirmations, security alerts, and important updates
• Detect and prevent fraud, abuse, and security issues
• Comply with legal obligations

We do not use your data for advertising, profiling, or to make automated decisions that significantly affect you.

3 Data Storage & Security

Your data is stored securely using industry-standard encryption. We use Supabase (PostgreSQL) for database infrastructure, with row-level security policies that ensure users can only access their own data. All data in transit is protected by TLS/HTTPS.

We take reasonable and proportionate steps to protect your personal information from unauthorised access, disclosure, alteration, or destruction. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority as required by UK GDPR.

4 Third-Party Services

Our apps use the following third-party services to operate. Each has its own privacy policy and data practices:

• Supabase: Database, authentication, and file storage infrastructure. The region where an app's data is stored is stated in that app's notice below.
• Apple App Store / Google Play: All in-app purchase and subscription billing. We never receive your payment details.
• Stripe: Payment processing for web-based purchases where applicable. Stripe is PCI-DSS compliant.
• OpenAI and other AI providers: AI-powered features such as writing assistance, transcription, and content generation. Content sent to these services is processed to generate a response and is not used to train their models under our enterprise agreements.
• Anthropic, PBC: Used only by Imago's optional AI suggestion tools, and only when you ask for a suggestion and have agreed in the app. What is sent, why, and how permission works is set out in the Imago notice (section 14), which applies to Anthropic instead of any general statement in this section.
• Attribr by MRVL: Our own install attribution and retention analytics SDK. This collects anonymous install counts and launch events — no personally identifiable information is collected or linked to individual users.

5 Data Sharing

We do not sell, trade, or rent your personal information to third parties. We may share information only in the following limited circumstances:

• Service providers: Companies that help us operate our services (e.g. hosting, analytics), under strict data processing agreements that prohibit them from using your data for any other purpose.
• Legal requirements: Law enforcement or regulatory authorities when required by law, court order, or to protect the safety of our users or the public.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you with at least 30 days' notice before any such transfer takes effect, and you will have the option to delete your account.

6 Your Rights (UK GDPR)

Under UK GDPR, you have the following rights regarding your personal data. We will respond to all requests within 30 days.

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of any inaccurate or incomplete data.
• Right to erasure: Request deletion of your data — the "right to be forgotten." For most apps, you can do this directly in-app under Settings → Account → Delete Account.
• Right to restriction: Request that we limit how we process your data in certain circumstances.
• Right to portability: Receive a copy of your data in a structured, machine-readable format.
• Right to object: Object to our processing of your data where we rely on legitimate interests as the legal basis.

To exercise any of these rights, contact us at support@mrvltechnologies.com. If you believe we have not handled your data correctly, you also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

7 Data Retention

We retain your personal data for as long as your account is active or as needed to provide our services. If you delete your account, we will delete or anonymise your personal data within 30 days, except where we are required to retain it by law (for example, financial records for HMRC compliance).

Crash reports and anonymous usage analytics are retained for up to 12 months, after which they are automatically deleted.

8 Children's Privacy

Our apps are not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us immediately and we will delete that information promptly.

For apps specifically designed for younger audiences or educational use, we provide additional protections and parental controls as described within those apps.

Guard by MRVL includes an optional Family Protection feature that a parent or guardian uses to manage a child's device. It is set up and paid for by the parent or guardian, and its data is handled as described in section 12.

9 Cookies & Tracking

Our mobile apps do not use cookies.

Our websites may use essential cookies required for the site to function (e.g. remembering your preferences). We do not use third-party advertising cookies or cross-site tracking. You can control cookie settings through your browser preferences at any time.

10 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of significant changes by updating the "Last updated" date at the top of this page.

For material changes — those that meaningfully affect your rights or how we use your data — we will provide at least 14 days' notice via in-app notification or email before the changes take effect. Continued use of our services after that period constitutes acceptance of the updated policy.

11 Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please get in touch:

12 Guard by MRVL — App-Specific Notice

This section applies to Guard by MRVL (bundle ID com.mrvltechnologies.guard) and adds to, and where different takes priority over, the general sections above for that app.

Your App Privacy Report

Guard analyses the App Privacy Report you import entirely on your device. Your report, the apps, domains and sensor events in it, and Guard's findings about them are stored on your device and are never uploaded to MRVL or to any third party.

What Guard sends to MRVL

Guard has no account system. After you give analytics consent in onboarding (you can withdraw it at any time in Settings → Privacy & Analytics), Guard sends the following to our own analytics and crash-reporting services:

• Device and install identifiers: a hashed device identifier and a hashed app-install identifier (pseudonymous, not your name or Apple Account), used to count installs and launches.
• App and device details: app version, iOS version and the country from your device's region setting.
• In-app events: which screens or flows were used (for example "import completed"), never the contents of your report or the names of the apps in it.
• Subscription events: the plan purchased, amount and Apple's transaction identifier, so we can measure revenue. We never receive your payment details.
• Crash and diagnostic reports: technical data about a crash, sent together with the same hashed app-install identifier and used to fix bugs. Guard blocks report evidence and email addresses from being included.
• Email address (optional): only if you choose to enter it in Settings to receive MRVL updates, and only for the purposes you tick. You can unsubscribe at any time.

We do not use this data for advertising or tracking, and we do not share it with data brokers. Analytics and crash data are kept for up to 12 months. You can ask us to delete the analytics data associated with your device from Settings → Privacy & Analytics, or by contacting us. Analytics stay off on a device until consent has been given on that device.

Community

The Community tab uses our Shpd service. Voting, following the roadmap and reading help articles use a random identifier generated on your device, and Shpd records basic usage events against it (for example which Community screens you open). No account is required, and these events are kept separate from the analytics identifiers described above.

Family Protection

Family Protection is an optional feature, available with the paid Family plan, that helps a parent or guardian manage screen time on a child's iPhone. It uses Apple's Screen Time frameworks (Family Controls, Managed Settings and Device Activity).

• App and category choices are made with Apple's own picker. Apple represents your choices as opaque tokens that stay on the device; Guard and MRVL cannot see which apps were chosen and they are never sent to us.
• Family details — the family and child names or labels you enter, routines, chores and their status, rewards, and the pairing details needed to link the two devices — are stored in your family's own iCloud (Apple CloudKit), in a private container shared only with the Apple Account the parent invites. MRVL does not run a server for this data and cannot read it. Apple processes it under Apple's terms and privacy policy.
• The child's Apple Account (email address or phone number) is entered by the parent solely so Apple can send the iCloud invitation. It is resolved by Apple on the device and is not sent to MRVL.
• The child's device does not need its own purchase. Family data is kept out of Guard's analytics and crash reporting.
• Children: Family Protection is designed to be set up and controlled by a parent or guardian, who is responsible for using it in line with the law where they live and for any consent needed for their child. We do not knowingly collect personal information from children on our own servers. A parent can remove a child from Guard at any time, and can revoke Guard's Screen Time access in iOS Settings or delete the shared data through their iCloud settings; deleting Guard from a device removes its local data.

Your choices

• Withdraw analytics consent or request deletion of analytics data: Settings → Privacy & Analytics.
• Unsubscribe from MRVL emails using the link in any message, or contact support@mrvltechnologies.com.
• Cancel or manage your subscription in your Apple Account settings.
• Remove a child at any time from within Guard, or revoke Guard's Screen Time access in iOS Settings.

Your UK GDPR rights (section 6) apply to the data MRVL holds about you. Contact us at support@mrvltechnologies.com.

13 DropPilot by MRVL — App-Specific Notice

This section applies to DropPilot by MRVL (bundle ID com.mrvltechnologies.droppilot) and adds to, and where different takes priority over, the general sections above for that app.

Which version this describes

The version of DropPilot currently on the App Store (3.4.0) stores optional-account data with Supabase in the United States (Amazon Web Services, US East). Version 3.5.0 is in testing and is configured to use Supabase in the United Kingdom (Amazon Web Services, London). Until 3.5.0 is released and existing accounts have been moved, the United States statement applies to the live app. We will update this notice when that changes.

Your deliveries stay on your device

Rounds, stops, notes, route order, proof-of-delivery photos and signatures are stored on your device and are not uploaded by the app. There is no cloud backup, cloud proof-of-delivery, customer tracking link or live tracking of drivers in this version.

Optional account

You can use DropPilot without an account. If you create one we store your name, email address and optional business name with Supabase (region above). Passwords are handled by Supabase Authentication and are not readable by us. You can delete your account in Settings → Account.

Location

DropPilot uses your location on your device, only while the Map tab is open, to show your position on the route map. Your location is not sent to MRVL, and DropPilot does not use background location. Address look-up uses Apple's mapping services.

Purchases

Subscriptions are handled by Apple. We receive confirmation of your plan, not your payment details. If you allowed analytics, plan changes are reported to our attribution service using Apple's transaction identifiers.

Analytics and crash reports — your choice

On first launch DropPilot asks whether to allow optional analytics and diagnostics. If you allow, MRVL's attribution service (Attribr) and crash-reporting service (Crashr) receive app launches, features used, purchase events, crash reports and error codes, with a random install identifier and your device's notification token (used to tell whether the app was uninstalled). If you are signed in, a one-way hashed version of your account ID is linked to that identifier. They never include your stops, addresses, notes or photos. You can change your choice at any time in Settings → Analytics & Diagnostics; if you decline, DropPilot works fully.

Community and ideas

Reading help articles, voting and following the roadmap use a random identifier generated on your device; usage events are recorded against it only if you allowed analytics. If you submit an idea in the Community tab, the title and description you type are sent to MRVL's Community service (Shpd) and held for moderation before anything is published. Please do not include personal information in ideas.

Your choices and contact

Delete your account in Settings → Account; change analytics in Settings; or contact support@mrvltechnologies.com. Your UK GDPR rights (section 6) apply to the data MRVL holds about you.

14 Imago by MRVL — App-Specific Notice

This section applies to Imago by MRVL (bundle ID com.mrvltechnologies.imago) and adds to, and where different takes priority over, the general sections above for that app.

What Imago collects

Depending on what you use: your email address and name (account, Sign in with Apple, invitations and guest display names); audio and camera video you record in sessions, and photos or videos contributed to a Pool; the titles, notes and other content you create in projects, ideas, invitations and Community posts; your account identifier; a device identifier and push notification token used for analytics and to tell whether the app was uninstalled; purchase information (product, amount, currency and Apple transaction identifier); product-interaction and usage events; and crash reports. We use this to run Imago, to process purchases, and for analytics and diagnostics. We do not sell it or use it for advertising or cross-app tracking.

Who processes it

Supabase (account and database storage), a recording service hosted on Fly.io, LiveKit Cloud (real-time audio and video in sessions), Shpd (Community), our own Attribr and Crashr services, and Apple (purchases). Anthropic receives limited data only for the optional AI suggestions described below.

AI suggestions (optional) — Anthropic

Imago's "Develop" tools on an idea (Develop this idea, Find another angle, Adapt for another format, Turn into a series, Suggest next step) use an AI model provided by Anthropic, PBC. These tools are optional.

What is sent. When a suggestion is requested, Imago's servers send Anthropic: the idea's title, notes (up to 2,000 characters), audience, format, hook and state, and where the idea came from (for ideas from Discover, also the chart genre and storefront); the titles only (not their notes, recordings or files) of up to eight of the most recent projects in your workspace, which can include projects created by your collaborators; and simple numbers about your published work (how many releases there are and average views per release type). Anything typed into these fields is sent as typed, so it can contain names or other personal information if you or a collaborator wrote it there; please do not put personal information in them. Imago does not add your account name, email address, account identifier, contacts, payment details or recordings to the request.

Why, and who. To generate the suggestion you asked for and return it to Imago. Anthropic is our service provider for this; we use its API under Anthropic's own terms for API customers. Anthropic's published terms for those customers say that inputs and outputs are not used to train its models by default and are automatically deleted within 30 days of receipt or generation, with exceptions (for example content flagged by its safety systems is kept for longer, legal requirements, and optional services that store files or feedback you choose to submit). Those are Anthropic's terms and may change; see Anthropic's privacy policy. We have not established any different retention arrangement with Anthropic. The suggestion is saved in your Imago workspace like your other content.

Your permission. Before the first suggestion request, the Imago app asks for your permission, naming Anthropic and listing the data above, and asks again if the wording or the recipient changes. Your answer is saved to your Imago account (not only to the device) together with the version of this notice you agreed to, the time, and the type of device ("iPhone", "iPad"); we keep that record while your account exists and delete it with your account. Imago's servers check it for every suggestion request and do not send anything to Anthropic if it is missing, has been withdrawn, or was given for an earlier version of the notice. It applies on every device you use with the account.

Withdrawing. Turn it off in Imago under Settings → Privacy & permissions → Turn off AI suggestions. That takes effect for all your devices as soon as it reaches our servers; if your device is offline it stops sending immediately and completes the withdrawal when it reconnects. Withdrawing does not remove suggestions already generated and saved in your workspace, and does not recall data Anthropic has already processed, which it handles under the terms above. To ask us to delete saved suggestions, or with questions about this processing, contact us below. Imago also counts your suggestion requests to apply your plan's monthly limit.

Your choices and contact

Delete your account and its content in Imago under Settings → Account; or contact support@mrvltechnologies.com. Your UK GDPR rights (section 6) apply to the data MRVL holds about you.