What we collect
We collect:
- account information — your name, work email address, organisation and role, provided by you or your administrator;
- content you submit to the service — messages, files and data from tools you choose to connect — processed solely to carry out your instructions;
- operational logs — technical records of service activity, retained for 30 days;
- seat and billing records, kept for your organisation’s account;
- consent records — which versions of our terms and this policy you accepted, when, and the IP address and browser used, kept as evidence of acceptance;
- support communications when you contact us.
How we use it
We use personal information to provide and secure the service, operate the approval workflow, administer seats and billing, respond to support requests, and meet legal obligations.
We do not use your content to train machine-learning models, and we do not build evaluation datasets from it. We do not sell personal information. Our staff do not read your conversations except with your organisation’s authorisation, or where security or law requires it.
Where your data goes
The service is hosted in Australia and New Zealand. Personal information may be processed in New Zealand, Singapore, Australia and the United States. Cross-border disclosures are made under our data processing addendum, with safeguards comparable to those of the New Zealand Privacy Act 2020.
The service is not offered in mainland China, the European Economic Area or the United Kingdom, and this policy does not address the GDPR or UK GDPR.
How we protect it
Each AI agent runs in its own isolated container with fixed resource limits. State-changing actions require human approval. Access to systems holding personal information is restricted and controlled, as described in our security addendum. If we confirm a security incident affecting your data, we notify your organisation within 72 hours.
How long we keep it
Operational logs are kept for 30 days. Content is kept for the duration of your organisation’s subscription. After the subscription ends, your organisation has 30 days to export its data, after which we delete it. Consent and billing records are kept for as long as the law requires.
Your rights
Under the New Zealand Privacy Act 2020 you may ask for access to the personal information we hold about you and ask us to correct it. Australian users have corresponding rights under the Privacy Act 1988 (Cth). To exercise them, contact our privacy officer. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner (New Zealand) or the Office of the Australian Information Commissioner.
Changes and contact
When we publish a new version of this policy, you will be asked to accept it the next time you sign in.
Privacy officer: privacy@marilune.co.nz. General enquiries: hello@marilune.co.nz.