This Privacy Policy explains what personal data MarvX collects, why we collect it, how we use and protect it, who we share it with, and the choices and rights you have. It applies to the MarvX website at marvx.io, the dashboard at app.marvx.io, the MarvX API and command-line tools, and any related services (together, the "Service").
We have tried to write it in plain English. If anything is unclear, contact us using the details in Contact us.
1. Who we are#
MarvX is a cloud deployment platform operated by [Company legal name], a company registered at [Registered address] ("MarvX", "we", "us" or "our").
For the personal data described in this policy about our own customers and website visitors, MarvX is the data controller. You can reach us about privacy at [Contact email: privacy@marvx.io].
2. Our two roles: controller and processor#
MarvX handles personal data in two different capacities, and it is important to understand which one applies:
- As a controller — for information about you as a MarvX account holder, team member or website visitor (for example your name, email address, sign-in details, billing information and how you use the Service). This policy covers that data.
- As a processor — for the code, applications, databases, files and runtime data that you deploy and store on MarvX, which may include personal data about your end users. For that data, you (our customer) are the controller and MarvX processes it only on your instructions to provide the Service. Your own privacy notice governs how you use your end users' data, and you are responsible for having a lawful basis to collect and process it.
We offer a Data Processing Agreement (DPA) to customers who need one. To request it, email [Contact email: privacy@marvx.io].
If you are an end user of an application hosted on MarvX and you have a question about your data, please contact the operator of that application first. We will assist our customers in responding to your request where we are able to.
3. The data we collect#
3.1 Account data#
When you create an account we collect your name, email address and a password (stored only as a salted, one-way hash — we never store your password in readable form). If you turn on two-factor authentication we store the secret needed to verify your codes. We also record which version of our Terms of Service you accepted and when.
3.2 Sign-in with GitHub or Google#
If you sign in with GitHub or Google, we receive basic profile information from that provider: your name, email address, profile picture URL, and your account identifier (and, for GitHub, your username). We do not receive your GitHub or Google password.
If you connect a GitHub account or organisation so that MarvX can deploy your repositories, we also store the access tokens GitHub issues for that connection and metadata about the repositories you choose to deploy. You can disconnect GitHub at any time from your dashboard or from your GitHub settings.
3.3 Workspace and application metadata#
To run the Service we store information about your workspaces and what you deploy, such as workspace and team member details, invitations and roles, application names and settings, repository and branch names, build and deployment history, custom domains, environment variable names and values (encrypted where marked as secret), database and storage bucket configuration, API tokens (stored as hashes), webhook and notification settings, and audit logs of important actions taken in your workspace.
3.4 Customer content and runtime data (we act as processor)#
This includes the source code we build, the container images we run, the contents of managed databases and object storage buckets, files and volumes, and any data your applications receive or generate while running — including personal data about your end users. We process customer content only to provide, secure and support the Service as you direct. We do not sell it, and we do not look at it except where necessary to operate the Service, investigate abuse or a security incident, provide support you request, or comply with the law.
3.5 Logs, metrics and usage information#
We automatically collect technical information when you use the Service, including IP addresses, browser and device type, request logs, timestamps, error reports, and pages or features used in the dashboard. For your applications we collect build logs, runtime logs, and resource metrics (such as CPU, memory and bandwidth usage) so that we can show them to you, bill usage-based charges, detect problems and protect the platform.
3.6 Billing data#
Payments are processed by our payment providers, Stripe and Paystack. When you pay, your card or bank details are sent directly to the payment provider. We never receive or store your full card number or security code. We store the information needed to manage your subscription: your plan, add-ons and credit packs, billing country, invoices and payment history, payment status, and limited card details the provider returns to us (such as card brand, last four digits and expiry month and year).
3.7 AI build debugger#
When a build or deployment fails, MarvX can analyse it with AI and suggest a fix. To do this, we send the relevant build logs, error messages, configuration and short snippets of your code to Anthropic, our AI provider, for analysis. Please avoid printing secrets or personal data in your build output. Under our agreement with Anthropic, this data is used to provide the analysis to us and is not used to train Anthropic's models. AI suggestions are stored in your workspace so you can review them.
3.8 Emails and communications#
We send transactional emails — such as password resets, workspace invitations, deployment and billing notifications — using Amazon Simple Email Service (SES) or another SMTP email provider. If you contact us, we keep a record of the conversation so we can help you.
3.9 Website visitors#
When you visit marvx.io our servers keep short-lived technical logs needed to deliver and secure the site. We also measure how the site is used with our own first-party analytics: cookieless aggregate counting for everyone, and a first-party analytics cookie only if you consent. We do not use advertising trackers or third-party analytics. See Cookies, local storage and analytics for details.
4. How we use your data and our legal bases#
If you are in the European Economic Area, the United Kingdom or another place with similar laws, we must have a legal basis for each use of your personal data. We rely on the following:
| Purpose | Examples | Legal basis |
|---|---|---|
| Providing the Service | Creating your account, signing you in, building and running your apps, storing your data | Performance of our contract with you |
| Billing | Charging for plans, add-ons, credit packs and usage; handling failed payments | Performance of contract; legal obligation (tax and accounting records) |
| Security and abuse prevention | Detecting malware, crypto-mining, spam, fraud and attacks; rate limiting; audit logs | Legitimate interests (keeping the platform and our customers safe) |
| Support and service communications | Answering questions; telling you about failed deploys, incidents, billing problems or changes to our terms | Performance of contract; legitimate interests |
| AI build debugging | Analysing failed builds and suggesting fixes | Performance of contract (a feature you choose to use); legitimate interests |
| Improving the Service | Understanding which features are used and fixing bugs, using aggregated or de-identified data where we can | Legitimate interests |
| Website statistics without cookies | Counting visits and unique daily visitors to marvx.io with a daily-rotating hash (no cookies, no stored IP addresses) | Legitimate interests |
| Analytics cookies | Recognising returning visitors to marvx.io and attributing sign-ups to the page, campaign or referrer that brought them | Consent — you can withdraw it at any time in Cookie settings |
| Marketing about MarvX | Occasional product news, if you have not opted out | Legitimate interests or consent, as required by law — you can unsubscribe at any time |
| Legal compliance | Responding to lawful requests; keeping records we are required to keep | Legal obligation |
Where we rely on legitimate interests, we have balanced those interests against your rights. You can object at any time (see Your rights).
Nigeria#
If you are in Nigeria, we process your personal data in line with the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation (NDPR), relying on the lawful bases they provide — principally the performance of our contract with you, compliance with legal obligations, our legitimate interests, and your consent where it is required.
5. How we share your data#
We do not sell your personal data, and we do not share it with third parties for their own advertising.
We share personal data only:
- With our subprocessors and service providers who help us run the Service (listed below), under contracts that require them to protect it and use it only to provide services to us.
- Within your workspace — other members of a workspace can see your name, email address and the actions you take in that workspace.
- When you ask us to — for example when you connect GitHub, or deploy an app that talks to a third-party service.
- For legal reasons — if we are required to by law, court order or a valid request from a public authority, or where necessary to protect the rights, property or safety of MarvX, our customers or others.
- In a business transfer — if MarvX is involved in a merger, acquisition or sale of assets, in which case we will tell you before your data becomes subject to a different privacy policy.
6. Subprocessors#
We currently use the following subprocessors to provide the Service:
| Subprocessor | What they do for us | Location |
|---|---|---|
| Amazon Web Services (AWS) | Hosting of the platform, your applications, databases and storage; backups in Amazon S3; email delivery through Amazon SES | European Union — Stockholm, Sweden (eu-north-1) |
| Stripe | Card payments and subscription billing | United States and other locations |
| Paystack | Payments for customers in Africa | Nigeria and other locations |
| Anthropic | AI analysis of failed builds (AI build debugger) | United States |
| GitHub | Sign-in with GitHub; access to repositories you choose to deploy | United States |
| Sign-in with Google | United States and other locations |
We will update this list when we add or replace a subprocessor. Customers with a DPA can ask to be notified of changes in advance.
7. International transfers#
MarvX hosts the platform and your applications in the European Union, in the AWS Stockholm region (eu-north-1). Some of our subprocessors (for example Stripe, Anthropic, GitHub and Google) may process personal data in other countries, including the United States, and you may access the Service from anywhere in the world.
When personal data is transferred out of the EEA, the UK or Nigeria, we make sure an appropriate safeguard is in place, such as an adequacy decision, the European Commission's Standard Contractual Clauses (and the UK addendum), or another mechanism permitted by applicable law. You can ask us for more information about these safeguards.
8. How long we keep data#
We keep personal data only for as long as we need it for the purposes described in this policy:
- Account data — for as long as your account is open. When you delete your account, we delete or anonymise your personal data within a reasonable period, except where we must keep it for legal reasons.
- Customer content (apps, databases, files) — until you delete it or your workspace is closed. After a workspace is closed or terminated, we delete customer content within a reasonable period, subject to the backup cycle described below.
- Logs and metrics — for a limited period needed to show them to you, debug problems and protect the platform, after which they are deleted or aggregated.
- Website analytics — raw analytics events for 13 months; aggregated statistics that don't identify anyone may be kept longer. The daily salt used for cookieless counting is deleted every day.
- Consent records — your cookie choice, the policy version, the time and a random consent ID, kept as proof of consent for as long as we need to demonstrate it.
- Billing records — for as long as tax and accounting laws require (this is often several years).
- Backups — our platform backups are stored in Amazon S3 and are overwritten or deleted on a rolling schedule. Deleted data may remain in backups until they expire.
- Audit and security logs — for as long as reasonably necessary to investigate security incidents and abuse.
9. Security#
We use technical and organisational measures designed to protect personal data, including encryption in transit (TLS), encryption of sensitive settings and stored credentials, hashed passwords and API tokens, optional two-factor authentication, role-based access for our staff, isolation between workspaces, audit logging and regular backups.
No system is perfectly secure. You are responsible for keeping your password and API tokens safe, for the security of the applications you deploy, and for configuring access to your databases and storage appropriately. If we become aware of a breach that affects your personal data, we will notify you and the relevant authorities where required by law.
10. Cookies, local storage and analytics#
We do not use advertising or cross-site tracking cookies, we do not use third-party analytics (such as Google Analytics), and we do not sell data to advertisers. When you first visit marvx.io we show a cookie banner so you can choose whether to allow analytics cookies.
10.1 Essential cookies and storage#
These are strictly necessary for the Service to work, so they don't need your consent:
| Name | What it does | Where | How long |
|---|---|---|---|
| Sign-in tokens (browser local storage) | Keep you signed in to the dashboard, and remember your selected workspace and display preferences (such as light or dark theme) | app.marvx.io | Until you sign out (sign-in tokens) or clear your browser storage |
mvx_consent (cookie) | Remembers your cookie choice and a random consent ID | .marvx.io | 12 months |
The providers we use for sign-in and payments (GitHub, Google, Stripe and Paystack) may also set strictly necessary cookies on their own sites during sign-in or checkout, for example for security and fraud prevention.
10.2 Analytics without cookies (always on)#
Whether or not you accept analytics cookies — including if you click "Reject" — we count visits to marvx.io in a cookieless, aggregate way. To count unique visitors per day, we combine your IP address and browser user agent with a secret salt that rotates every day and create a one-way hash. The salt is deleted daily, so visits cannot be linked across days, and raw IP addresses are never stored. We use this only for aggregate statistics such as how many people visited a page.
10.3 Analytics cookies (only with your consent)#
If you click "Accept" (or turn analytics on in Cookie settings), we also set a first-party cookie:
| Name | What it does | Where | How long |
|---|---|---|---|
mvx_vid (cookie) | A random visitor ID used to recognise returning visitors and to attribute sign-ups to the page, campaign or referrer that brought them | .marvx.io | 13 months |
With your consent we record the pages you view, the referring site, campaign (UTM) tags, your approximate country (estimated from your browser's timezone and language — not from your IP address), your device, browser and operating system type, and time spent on each page.
10.4 Where analytics data goes#
Analytics run on MarvX's own servers in the AWS Stockholm region (eu-north-1). Analytics data is not shared with or sold to third parties. Raw analytics events are kept for 13 months; aggregated statistics that don't identify anyone may be kept for longer.
10.5 Your choices#
- You can change your choice at any time using Cookie settings in the footer of marvx.io. Withdrawing consent stops analytics cookies from then on.
- We honour the Global Privacy Control (GPC) signal as a refusal of analytics cookies.
- You can also block or delete cookies in your browser settings. Blocking essential storage may stop the dashboard from working.
- We keep a record of your consent choice — the choice itself, the version of this policy, the time and the random consent ID (but not your IP address) — as proof of consent.
11. Your rights#
Depending on where you live, you may have the right to:
- Access the personal data we hold about you and get a copy of it;
- Correct data that is inaccurate or incomplete;
- Delete your data ("right to be forgotten");
- Restrict or object to certain processing, including processing based on legitimate interests and direct marketing;
- Data portability — receive your data in a structured, machine-readable format;
- Withdraw consent at any time, where we rely on consent;
- Complain to a data protection authority.
You can update most account information yourself in the dashboard, and you can delete applications, databases and files at any time. To exercise any other right, email [Contact email: privacy@marvx.io] from the address linked to your account. We may need to verify your identity before acting on a request. We will respond within the time required by law (usually one month).
If you are unhappy with how we handled your data, please contact us first so we can try to put it right. You also have the right to complain to your local supervisory authority — for example a data protection authority in the EU, the Information Commissioner's Office in the UK, or the Nigeria Data Protection Commission (NDPC) in Nigeria.
12. Children#
The Service is intended for developers and businesses and is not directed at children. You must be at least 16 years old (or the age of digital consent where you live, if higher) to create an account. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.
13. Changes to this policy#
We may update this Privacy Policy from time to time. Each published version has a version number and a "Last updated" date shown at the top of this page. If we make material changes, we will let you know by email or through the dashboard before they take effect.
14. Contact us#
If you have any questions about this policy or how we handle personal data, contact us:
- Email: [Contact email: privacy@marvx.io]
- Post: [Company legal name], [Registered address]