سياسة الخصوصية

1. What We Collect

Account data: name, email, password (always hashed).

Usage data: your conversations with Mary, prompts, generated content.

Billing data: payment records (we do not store cards).

Technical data: IP, browser type, app events (via PostHog/Sentry).

2. How We Use Your Data

• Run the service and deliver content to you.
• Improve Mary by analyzing usage patterns (aggregated and de-identified).
• Prevent fraud and protect the platform.
• Send essential operational emails (no marketing without consent).

What we do — and what we never do:

• ❌ We do not sell your data to any third party.
• ❌ We do not use your conversations to train public models.
• ✅ We encrypt data in transit (TLS 1.3) and at rest (AES-256).

3. AI Providers

Mary uses models from Anthropic (Claude) and OpenAI to generate content. Your conversations are sent to them solely for processing — under our agreements, they do not store your data and do not use it for training.

4. Who We Share Data With

• Infrastructure providers: Fly.io (hosting), Cloudflare R2 (file storage), Sentry (error monitoring), Resend (email).
• Payment providers: PayPal, Stripe (subscription processing only).
• Legal obligations: if legally compelled (e.g. court order), we try to notify you first when possible.

5. Retention

We keep your data as long as your account is active. On cancellation we delete everything within 30 days (except billing records required for tax compliance, kept 7 years).

6. Your Rights

Under GDPR, Saudi PDPL, and UAE PDPL you have the right to:

• Access: request a copy of your data.
• Rectification: correct inaccurate data.
• Erasure: request full deletion via data deletion page.
• Portability: export your data as JSON.
• Objection: object to specific processing.

To exercise: privacy@mary-os.com.

7. Memory (New Feature)

Mary may remember things about you (your business name, tone preferences) to give better help. You're in full control via Settings → Memory: view, edit, delete each memory, or disable the feature entirely.

8. Cookies

We use only essential cookies (session, language preference). No ad-tracking cookies. You can clear them in your browser settings.

9. Children

Mary is not for children under 16. If we learn a child created an account we delete it immediately.

10. International Data Transfers

Our primary servers are in the European Union (Frankfurt). Your data may be transferred to the United States via our AI providers under Standard Contractual Clauses.

11. Changes to This Policy

We update this policy when needed. Material updates will be announced via email at least 30 days in advance.

12. Contact

Data Protection Officer: privacy@mary-os.com
General: hi@mary-os.com