Legal
Privacy Policy
How we handle personal data in Marley. Issued in compliance with Regulation (EU) 2016/679 (GDPR) and Spain's Organic Law 3/2018 on Personal Data Protection and Digital Rights (LOPDGDD).
Last updated 2 September 2026
1. Data controller
PARROT PARTNERS, S.L.
NIF: B75733972
Registered office: Calle Cristofor Colom, 4-6, 43001 Tarragona, Spain
Commercial registry: Mercantile Registry of Tarragona
Data protection contact: [email protected]
Marley is a product operated by Parrot Partners, S.L. ("we", "the Controller"). This policy covers the Marley website and the Marley application.
2. Categories of personal data
2.1 Data you provide
| Category | Data elements |
|---|---|
| Identification | Name, work email address, company name, job title |
| Account | Credentials (passwords are stored only as a salted hash, never in readable form), workspace and team membership, plan and billing details |
| Configuration | The keywords, markets, brand domains and competitors you choose to monitor, and the cadence you set for them |
| Communications | Support requests, enquiries submitted through our forms, and correspondence with us |
2.2 Data collected automatically
| Category | Data elements |
|---|---|
| Technical | IP address, browser type and version, device type, operating system |
| Usage | Pages and features used, session duration, credits consumed, scans requested — including scans requested by an AI client over MCP |
| Security | Authentication events, access logs, and records of administrative actions |
2.3 Data obtained from third parties
Where you connect a Google Ads account, we receive the campaign, keyword and performance metrics you authorise, in order to provide the features that depend on them. You may disconnect the account at any time, which stops further collection.
2.4 Market observations
Marley records what publicly available search result pages showed for the keywords you ask it to monitor: which advertisers and results appeared, what they said, and how much of the visible page each occupied, together with screenshots of those pages. These observations describe businesses and publicly displayed advertising rather than individuals. Where such a record incidentally contains personal data — a personal name in an advertiser's trading name, for example — it is processed on the basis of our legitimate interest and yours in understanding your competitive market, and it is subject to the same rights set out in section 7.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR Art. 6(1)) |
|---|---|
| Providing the service: account management, monitoring the keywords you configure, producing the intelligence you subscribe to | Performance of contract, Art. 6(1)(b) |
| Billing, credit accounting and overage | Performance of contract, Art. 6(1)(b) |
| Responding to enquiries and providing support | Performance of contract, Art. 6(1)(b) |
| Service improvement, analytics, error correction and feature development | Legitimate interest, Art. 6(1)(f) |
| Security, abuse prevention and protecting the integrity of the service | Legitimate interest, Art. 6(1)(f) |
| Usage and limit notifications, including upgrade suggestions when a change of plan would cost you less | Legitimate interest, Art. 6(1)(f) |
| Marketing communications | Consent, Art. 6(1)(a) |
| Compliance with legal, accounting and tax obligations | Legal obligation, Art. 6(1)(c) |
Where processing relies on legitimate interest, we have carried out a balancing assessment to confirm those interests are not overridden by your rights and freedoms. You may object at any time (section 7).
4. Recipients
We disclose personal data to the following categories of recipient, each bound by a data processing agreement under Article 28 GDPR:
| Category | Purpose |
|---|---|
| Infrastructure providers | Hosting, content delivery, databases and object storage |
| Data collection providers | Retrieval of the public search result pages we measure on your behalf |
| AI service providers | Structuring and interpreting captured pages |
| Email service providers | Transactional email: sign-in, password reset, alerts and usage notices |
| Payment providers | Subscription and usage billing |
| Analytics providers | Understanding service usage, aggregated or anonymised where possible |
| Third-party platforms | Integrations you authorise, such as Google Ads or Slack |
| Authorities | Where required by law or to establish, exercise or defend legal claims |
We do not sell personal data. We do not use your configuration, your connected advertising data or your observations to provide intelligence to another customer about you.
5. International transfers
Personal data may be transferred outside the European Economic Area, including to the United States. Such transfers are made under Chapter V GDPR, relying on an adequacy decision (Art. 45), Standard Contractual Clauses adopted by the European Commission (Art. 46(2)(c)), or a recipient's certification under the EU–US Data Privacy Framework. You may request a copy of the safeguards that apply by writing to [email protected].
6. Retention
| Data | Retained for |
|---|---|
| Account and profile data | The contractual relationship, plus five (5) years |
| Configuration: keywords, markets, competitors | The contractual relationship, plus thirty (30) days |
| Market observations and screenshots | The history window of your plan; thereafter deleted or aggregated so that individual captures are no longer retained |
| Connected advertising data | Until the connection is removed, plus thirty (30) days |
| Enquiries and support correspondence | Two (2) years from the last interaction |
| Billing and financial records | Six (6) years, under Spanish tax legislation |
| Usage analytics | Twenty-six (26) months, thereafter anonymised |
| Security and access logs | Twelve (12) months |
At the end of the applicable period, data is securely deleted or irreversibly anonymised.
7. Your rights
You have the right to request access to your personal data, and its rectification or erasure; to restrict or object to processing; to data portability; and to withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand.
7.1 Exercising them
Write to [email protected], or to Parrot Partners, S.L., Data Protection, Calle Cristofor Colom, 4-6, 43001 Tarragona, Spain. We respond within one month, which may be extended by two further months where a request is complex, in which case we will tell you within the first month. We may ask for information to verify your identity.
8. Automated decision-making
Marley produces measurements, competitive states and suggestions — for example that spend on a keyword appears reclaimable. These are decision support. They have no legal or similarly significant effect on any individual, and no action is taken on your advertising account without a person deciding to take it.
9. Cookies
The Marley website uses only what is strictly necessary to serve pages and, in the application, to keep you signed in. A session cookie is set when you log in and is required for the service to function. Where we use any non-essential cookie or analytics technology, we ask for consent first and you may withdraw it at any time.
10. Security
We apply technical and organisational measures appropriate to the risk, including encryption in transit, hashed credentials, tenant isolation so that one customer's workspace is not reachable from another, least-privilege access for staff, and logging of administrative actions. No system is perfectly secure; where a breach is likely to result in a risk to your rights and freedoms, we will notify the supervisory authority within 72 hours and you without undue delay where the risk is high.
11. Minimum age
Marley is a business service and is not directed at children. You must be at least 18 and acting in a professional capacity to use it.
12. Changes
We may update this policy. Material changes will be notified by email to workspace owners or in the application before they take effect. The date at the top records the current version.
13. Supervisory authority
You may lodge a complaint with the AEPD, or with the authority of your habitual residence or place of work, if you consider that our processing infringes data protection law.
14. Contact
For anything in this policy: [email protected].