Privacy Notice

• Marrow Technologies Ltd makes Core and Company Brain, software for businesses.
• This notice explains how we use personal data where we decide why and how it is used: if you visit marrow.id, write to us, work with us for a customer or supplier, or use an account we give you.
• When a customer connects its tools to Core or Company Brain, the content stays the customer's. We handle it only as our agreement with the customer allows.
• We do not sell personal data or show advertising. We do not train AI models on customer content, and we require the AI model providers we use not to.
• Questions and requests go to privacy@marrow.id. You can also complain to the Information Commission.

Marrow Technologies Ltd is a private limited company registered at Companies House in England and Wales under company number 17288650. Our registered office is 19c Highgate West Hill, London, United Kingdom, N6 6NP. We are not registered for VAT.

We handle personal data in two ways, and different rules apply to each.

When we decide how and why data is used (as controller). For people who visit marrow.id, write to or meet us, or act for a customer or supplier, and for the records we keep to run and secure the accounts and API access we give, we decide what is collected and why. This notice explains that data.

When we act for a customer (as processor). A customer can connect its email, documents, chat, spreadsheets and meetings to Core or Company Brain. That content, the information built from it, and the settings its administrators keep for who can see what, are the customer's. The customer decides what connects and who may see it, and our agreement with the customer, including its data processing terms, governs how we handle it. If your personal data is in a customer's workspace, for example because you emailed one of its staff, please contact that organisation. If you write to us instead and we can tell which customer holds it, we pass your request to them and help them answer it.

When the customer runs Core. A customer can run Core in its own cloud or on its own servers. What data, if any, then reaches Marrow or our providers, and what support access involves, are set out in our agreement with that customer.

Where we need information to give you access or to answer you, we say so when we ask for it. We do not make decisions about people by automated means that have legal or similarly significant effects.

If you write to us or meet us

If you are a contact at a customer or supplier

If you have an account

We give accounts to a customer's staff, and access to the API or MCP to the customer, so they can use Core and Company Brain.

We keep no readable copy of an API key once it is issued. Which colleagues can see what, and the record of what agents did for your organisation, are part of the customer's content, described below.

If you visit marrow.id

We do not use analytics or advertising tools on marrow.id. The site's use of browser storage is listed below.

For our customers, Core and Company Brain handle:

• the sources a customer connects, such as email, documents, chat, spreadsheets, and meetings where Company Brain is enabled;
• the information drawn from those sources, which Core keeps as facts, each linked to the passage it came from;
• records of what agents did, and the procedures and proposed changes learned from them.

The customer decides which sources connect, which channels and meetings Company Brain joins, and who can see what. An agent working for a person is given only what that person can open.

We do not train AI models on customer content, and we require the AI model providers we use not to train on it. One customer's content is not used to improve another customer's service. What Core learns from a customer's work stays within that customer's service, and a person there decides whether it is used.

Our staff look at customer content only at the customer's request, to investigate a security problem or misuse as our agreement with the customer allows, or where the law requires it.

How long customer content is kept, how it is deleted, and how we handle a security incident are set out in our agreement with each customer.

Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

• Service providers: companies that run parts of our service on our instructions, such as hosting, databases, storage, email delivery and sign-in, and the AI model providers that process content so Core can draw out facts and answer requests. Each is bound by a contract. Those that handle customer content are listed, with what each receives and where, at marrow.id/legal/subprocessors.
• Advisers, auditors and insurers, where they need it to advise or cover us.
• Authorities, where the law requires it.
• A buyer or investor, if Marrow is sold or raises money, under a duty of confidentiality.

We do not sell personal data or share it for advertising.

Some of our providers handle data outside the UK, mostly in the United States. We rely on the UK's adequacy regulations where they apply, including the UK Extension to the EU–US Data Privacy Framework for certified US providers. Otherwise we use the International Data Transfer Agreement, or the International Data Transfer Addendum to the EU standard contractual clauses. Ask us for a copy of the relevant safeguard; commercial details may be removed.

The tables above give each period. When a period ends we delete the data, or keep it only in a form that no longer identifies anyone. Backups are overwritten on a 30-day cycle, after which deleted data cannot be recovered.

We protect personal data with measures that include encryption in transit and at rest; production access limited to the staff who need it, with multi-factor authentication; and regular backups. Each person's access is checked before anything is given to an agent working for them. We do not yet hold a security certification such as SOC 2 or ISO 27001.

You have the right to ask for a copy of your personal data and to have it corrected. In some circumstances you can also ask us to delete it, to limit how we use it, or to stop using it where we rely on our legitimate interests. We tell you if a right does not apply, and why.

We normally answer within one month. Where the law allows, for example for a complex request, we may take up to two further months, and we tell you why within the first month. We may ask you to confirm who you are. We do not charge, unless a request is clearly unfounded or excessive.

If your data is part of a customer's content, the customer decides on the request. We pass it to them and help them answer it.

If you are unhappy with how we have handled your data, tell us at privacy@marrow.id. We acknowledge a complaint within 30 days, look into it, and tell you the outcome without undue delay.

You can also complain to the Information Commission, the UK's data protection regulator, at ico.org.uk. It usually expects you to have raised the matter with us first.

This session cookie is strictly necessary to sign you in. Nothing on marrow.id tracks you across other sites.

Marrow is a service for businesses and is not meant for anyone under 18.

Each version is dated, and earlier versions are kept at marrow.id/legal. If we make a material change, we tell our customers' administrators by email 30 days before it takes effect. A change the law or security requires urgently may take effect sooner, and we tell them as soon as we can.

Email privacy@marrow.id, or write to Marrow Technologies Ltd, 19c Highgate West Hill, London, United Kingdom, N6 6NP.