Privacy Policy

1.Introduction

This Privacy Policy describes how Mariete (“Mariete”, “we”, “our” or “us”) collects, uses, discloses and protects the personal information of customers, website visitors, partners and other individuals in connection with our platform, products, websites and services (together, the “Services”).

By using the Services, you agree to the practices described in this Policy. If you do not agree, please do not use the Services. For enterprise deployments, this Policy is supplemented by the Data Processing Addendum (DPA) included in your agreement with us.

If you use one of our mobile apps, the sections on the Mariete app, Painter and Edge say what each app sends, the kinds of companies that receive it, why, and where they are based.

2.Information we collect

We collect information you provide to us directly, information we receive automatically when you use the Services, and information from third-party sources where you have authorised that sharing.

Account and profile information. Name, email address, company, role, billing details and authentication identifiers when you create an account or are provisioned by your organisation.

Customer content. Prompts, documents, data sources, configurations and agent outputs you submit to, or generate inside, the Services. Customer content is processed on your behalf and under your instruction. This includes what you give the Mariete app and Painter, described in the sections on each app. Edge sends us nothing you write or say, apart from a report you choose to send from Edge on Android.

Purchases in our apps. For credits bought in one of our iOS apps, the purchase record the App Store sends us, described under Our mobile apps. We do not receive your card or App Store account details.

Usage data. Log data, device and browser information, IP address, approximate location, referrer, pages viewed, actions taken and timestamps. We use this to operate, secure and improve the Services.

Cookies and similar technologies. We use first-party and limited third-party cookies for authentication, preferences, product analytics and attribution. On our marketing site, measurement and advertising technologies run only on the basis of your choice; we store that choice in a first-party cookie and keep a record of it on our servers. See the Cookies section below.

Communications. When you contact us, apply to the partner programme or respond to a survey, we collect the content of the communication and any metadata associated with it.

3.How we use your information

We use the information we collect to:

• Operate, maintain, secure and improve the Services;
• Authenticate users and authorise access to workspaces;
• Execute the agent tasks you request and return cited outputs;
• Communicate with you about the Services, including operational notices, security alerts and support responses;
• Bill for the Services and enforce our agreements;
• Detect, prevent and respond to fraud, abuse and security incidents;
• Comply with legal obligations and enforceable governmental requests;
• Conduct research and analytics to make the Services more useful.

We do not use Customer content to train foundation models. We do not sell personal information. Where we rely on legitimate interests as the legal basis for processing, we have balanced those interests against your rights.

4.How we share your information

We share information only in the circumstances described below:

Sub-processors. We engage vetted sub-processors to provide infrastructure (cloud hosting, logging, email), customer support and limited analytics. The sections on our apps describe the ones that receive content from each app by their role and where they are based. A complete current list is available on request and is maintained as part of our DPA for enterprise customers.

Advertising and measurement platforms. Where you have accepted advertising on our marketing site, a completed contact form is reported to Meta both from your browser and from our servers. The server-side report contains a SHA-256 hash of the email address and name you submitted, Meta’s own _fbp and _fbc cookies where your browser holds them, your IP address and user-agent string, the form and page involved, and an identifier that lets the two reports be counted as one conversion. No other content from the form is sent, and nothing is sent at all if you have not accepted advertising. Google Analytics and the LinkedIn Insight Tag receive site activity on the same basis. Where you have accepted measurement, PostHog receives site activity, including replays of how pages were used with everything typed into forms masked. Our Cookie Policy describes each of these in full.

Our account site, where you create an account and buy plans and credits, follows the same choice. When you create an account there and have accepted advertising in that browser, we report the sign-up to Meta once, from your browser and from our servers. The server report contains SHA-256 hashes of your email address, your first and last name and your account ID, Meta’s _fbp and _fbc cookies where your browser holds them, your IP address and user-agent string, and an event identifier that includes your account ID, so the two reports count as one. When you buy a plan or credits on our website, we report the purchase to Meta from our servers, with SHA-256 hashes of the email address used to pay and of your account ID, the amount and the currency, unless you have refused advertising. We never make either report for an account that has been used to sign in from one of our apps, and we never report purchases made in our apps.

Model providers. When a task or a generation needs a language, image, video or audio model, the content it needs is sent to the company that runs that model. The sections on the Mariete app and Painter describe these companies by their role and where they are based, and we can give you the current list of them on request. On the web, the same companies receive it by default, and others only when you choose one of their models. Each provider handles what it receives under its own terms, including how long it keeps it. We do not promise that every provider deletes your content as soon as it has responded; where a provider states how long it keeps content, the sections on our apps say so. Enterprise customers can agree zero-retention routing with us, as our Terms describe.

Within your organisation. Workspace administrators can see users, roles, activity and billing within their tenant.

With your consent. We share information with third parties when you explicitly instruct us to do so: for example, when you connect an integration, or allow one of our apps to send your content to the kinds of companies it lists.

Legal and safety. We may disclose information where required by law, to enforce our agreements, to protect Mariete or the rights and safety of others, or in connection with an investigation of fraud or abuse.

Business transfers. In the event of a merger, acquisition, financing, reorganisation or sale of assets, information may be transferred subject to this Policy.

How those we share with must protect it. We share personal information only with the recipients described in this Policy, and only what each needs for the purpose described. Each of them handles it under our agreement with it or the terms on which we use its service, and we have reviewed those terms against this Policy. Where a recipient’s terms protect your information less than this Policy does, for example on how long it is kept, how the recipient may use it or where it is stored, the section for the app concerned says so, and the app asks your permission before anything is sent.

5.Our mobile apps

We make three mobile apps: the Mariete app, Painter and Edge. The three sections after this one say what each app sends, the kinds of companies that receive it, what for, and where they are based. We describe these companies by their role and location rather than by name. We can give you the current list of them on request: write to hello@mariete.ai. This section covers what the apps have in common.

Your permission comes first

The Mariete app and Painter send your content to the companies described in their sections only after you allow it. After you sign in, and again if you use a feature that sends content before allowing it, the app shows a screen that lists what is sent and the kinds of companies that receive it, with two buttons: Allow and Not now. Not now turns off only the features that send content. Everything else in the app keeps working.

You can review or withdraw your choice at any time under Data sharing: in Painter’s Settings, or on the Account tab of the Mariete app. Withdrawing stops the app sending content from that moment. A task or generation already running finishes, and in the Mariete app a task you set to repeat on a schedule keeps running until you cancel it. Withdrawing does not recall what was sent while your permission was in place, and results already made stay in your account until you delete them. If we add a kind of recipient or change what is sent, the app asks you again.

Our servers check your choice as well: content that reaches us from one of our apps without your current permission is not passed on. Each time you allow or withdraw, we record your account, the app, the version of this Policy the screen described, your choice, the kinds of recipients it listed, your device’s platform, the app version and the time. We keep these records as evidence of your choices for as long as your account exists, and delete them with it.

Signing in

The Mariete app and Painter sign you in with your Mariete account, on our sign-in page shown in a secure sheet inside the app. If you choose to sign in with an account you already have with another company, that company confirms who you are and shares your name and email address with us. Edge has no account.

Deleting your account

Delete account, on the Account tab of the Mariete app and in Painter’s Settings, opens your profile page on account.mariete.ai in your browser, where you can delete your account as our Delete your account page describes. That visit is treated like the app itself: pages on account.mariete.ai show no cookie banner, load no analytics or advertising tags, report nothing to advertising platforms and offer no plans and no way to buy, including after you sign in. A cookie that lasts until your browser session ends keeps it that way for the rest of the visit.

Buying credits

In the Mariete app and Painter on iOS, credits are sold only as in-app purchases through the App Store, and the apps do not open any page where plans or credits are sold. Credits you buy go to your personal Mariete wallet, the same one you use on the web. The App Store handles the payment, and we never receive your card or App Store account details. So that the credits reach the right account, the app gives the App Store your Mariete account ID with the purchase, and the App Store sends us a signed record of it: the transaction number, the product, the price and currency, the App Store country, the date and that account ID. A purchase that starts outside the app, such as one made with an offer code, carries no account ID, and its credits go to the account signed in to the app that passes it to us. We use the record to add the credits, to make sure each purchase is counted once, and for our accounts. We keep it while your account exists, and delete it with your account. The App Store keeps its own record of the sale under its own privacy terms.

If the App Store refunds a purchase, it tells us, and we take back the credits it added, or the refunded share of them, as far as your balance allows. A purchase refunded before it reaches us is not credited, and neither is one for a product that is not a credit pack the app sells. In both cases the app tells you that no credits were added.

No advertising measurement in the apps

Our apps contain no advertising, analytics or tracking code, and we do not track you across other companies’ apps and websites. When you sign in from an app, our sign-in page shows no cookie banner, loads no analytics or advertising tags and reports nothing to advertising platforms. Once an account has been used to sign in from one of our apps, we never report its sign-up or its purchases to an advertising platform, even when it is later used on our websites. Purchases made in the apps are never reported to any advertising platform.

Some Painter features open our web workspace inside the app, and only after you have allowed data sharing. Those pages recognise that they are inside the app, and there they show no cookie banner, load no analytics or advertising tags, ignore any cookie choice stored earlier, and show no plans and no way to buy.

Links in the apps to our Terms and to this Policy open our website in your browser. There, as everywhere on our websites, measurement and advertising follow the choice you make in each browser, as described under Cookies and tracking.

6.The Mariete app

The Mariete app sends the tasks you give it to our platform, which does the work. To do it, the platform uses language models run by outside companies, and services that run a workspace for your files, search the web, fetch public data, host preview sites and connect to apps you choose. None of your content goes to them until you allow it in the app.

What the app sends to us

• What you ask: text you type or dictate, and text, links and files you share into the app. Dictation uses your phone’s own speech recognition, which may run on the phone or on its maker’s servers under the maker’s terms. We receive only the text.
• Photos and files you attach.
• Your answers to the questions the app asks when you start, which shape your first tasks.
• If you allow notifications, a push token for your device and the device’s name, so we can tell you when a task is done.
• If you report a reply, the reply, the reason you choose and any note, which we review.

Who receives your content

• Language model providers: companies whose language models read your task and write the work. Some are based in China or operated from Singapore. They receive what you ask, your name, what Mariete remembers about you if memory is on, your answers to the starting questions when they shape a task, the conversation so far, the text of the files and web pages the task reads, the images it needs to look at, such as photos you attach and screenshots of web pages, and the results of the tools it uses. When a task edits a file, the file’s text and the change can also go to one of them. The model every task uses by default is run by a company based in China, which says it stores the data it receives in the People’s Republic of China. Images are read by a model that is run from Singapore and made by a company based in China.
• Workspace and web tools: services that run your files in a secure workspace, search the web, fetch public data and host preview sites you ask for. The workspace service receives the files you attach, the files the task creates and the pages it visits. The search service receives the search terms and page addresses the task chooses, which can include words from your request. The public data service receives the search terms the task uses to look up things such as company profiles, social media posts, products, property listings, job listings and market prices. The preview site service receives the files of a site a task publishes, which anyone with its address can then see. Most of these services are based in the United States.
• Apps you connect: apps you link to your account, and the service that connects them, receive what a task sends to them. If you have connected another service on the web, such as your email or calendar, a task can use it, and that service and the connecting service, which is based in the United States, receive what the action needs, such as the text of an email the task drafts. You can disconnect an app at any time.

These companies handle what they receive under their own terms. The terms of the company that runs the default language model say little about how long it keeps what it receives or how it may use it, so they protect your information less than this Policy does. If that matters to you, choose Not now, or withdraw your permission under Data sharing.

We can give you the current list of these companies on request: write to hello@mariete.ai.

Services that keep the app running

• A database and storage provider based in the United States stores your account, conversations, files and the records of your choices.
• A notification service based in the United States and the maker of your phone deliver notifications, which carry the session’s title.
• An error reporting service based in the United States receives error reports, which can include your account ID and the request that failed.
• A monitoring service based in Germany receives records of each run, including what was asked and the reply, which we use to find faults and check quality.

7.Painter

Painter makes images and short videos from what you give it. It sends your content to our model hosting provider, which runs the models Painter uses. For most models, the hosting provider passes the request on to the company that made the model, which produces the result. In the app, nothing is sent until you allow it. Painter on the web, at painter.mariete.ai, sends the same content to the same companies when you use the same features.

What Painter sends

• Your prompt. If you dictate it, your voice is turned into text on your phone, and only the text is sent.
• Photos you add from your camera or library, and any area you paint over to change it.
• Brand kit details used for styling: colours, font, industry, tone and audience. For Improve, Random prompt and copy drafted in the web workspace, also your brand’s name and tagline.
• In the web workspace that some features open inside the app (canvas, presentations, charts and the video composer), also: text you ask a model to write, voice recordings you make there, photos you add to a persona, voice-over scripts, music descriptions, and video and audio you lip-sync, caption or upscale.
• On painter.mariete.ai in a browser, also the text of a website you set up a brand kit from. Inside the app this feature is not offered.

Painter does not add your name, email address or device identifiers to these requests. Your results are kept in your Mariete account until you delete them.

If you report a result in the app, the reason you choose, any note, that item’s prompt and ID and the app version are sent to Mariete with your account, and we review them.

Who receives it

• Our model hosting provider: a company in the United States that runs the image, video, voice and text models Painter uses on its servers. It receives what each request contains. It says it deletes the inputs and outputs of these requests an hour after they are made.
• Model makers: the company that built the model you choose may receive your request from the hosting provider to produce the result. Some are based in China, and most of the others in the United States. What a maker receives depends on the model: for an image model, your prompt with any brand details it carries, your photos and the areas you paint; for a video model, your prompt and photos; for the model behind Improve, Random prompt and copy drafting, your prompt and your brand’s name, tagline, industry, tone and audience. In the web workspace, also the text you ask a text model to write, photos of a person for persona face sheets, voice-over scripts, music descriptions, video and audio for lip sync, which usually show a person’s face and voice, and videos to upscale. On painter.mariete.ai in a browser, also the text of a website for brand kit setup.
• A stock photo service, run from Germany: receives search words for the inspiration gallery, such as what you search for or your brand kit’s industry, a few words of its description and its main colour. Our servers send it these words and nothing else about you.

Model makers receive requests under their own terms, not ours or the hosting provider’s, and some of those terms protect your information less than this Policy does, for example on how long it is kept. If that matters to you, choose Not now, withdraw your permission under Data sharing, or pick a model from a maker you trust.

We can give you the current list of these companies on request: write to hello@mariete.ai.

Other services

• Some models are open models that the hosting provider runs itself, so the people who published them receive nothing: a safety model that checks prompts, a speech model that turns voice recordings made in the web workspace into text, and models for upscaling, background removal, object removal, style transfer and captions.
• A public model hosting site, run by a company in the United States, serves the speech model the app downloads the first time you dictate. Like any download, it sees your IP address and basic details of your device, and nothing you write or say.
• On painter.mariete.ai in a browser, to show a brand’s icon, the page can load it from a web icon service run by a company in the United States, which receives the brand’s website address.
• Pages of the web workspace, in the app and in a browser, load their fonts from a font service run by a company in the United States, which sees your IP address and nothing you write.
• Our own service providers. A cloud hosting company based in the United States stores your uploads and results, runs painter.mariete.ai and renders videos. A database provider based in the United States stores your account, library, brand kits and the records of your choices. Our platform’s servers, which record your choices and purchases, send error reports to the error reporting service described for the Mariete app.

Some of the companies that make the models Painter offers are based in China. Your content goes only to the maker of the model you choose, so if you prefer that it does not go to a company based in China, choose a model from another company. The list we give on request says which models those are.

8.Edge

Edge runs its language model on your phone. Your chats, journal entries, memories and voice are processed and stored on your device. Edge has no account, and it sends none of them to Mariete or to any other company, so the permission screen described under Our mobile apps does not apply to it, and neither does the paragraph on model providers under How we share your information.

• A public model hosting site, run by a company in the United States, serves the files Edge downloads: an open language model that runs on your phone and, for voice journal entries, a speech model. Edge asks before it downloads. Like any download, the site sees your IP address and basic details of your device. It receives nothing you write or say, and the makers of the models receive nothing at all.
• Voice is turned into text on your phone.
• On Android you can report a reply. If you do, the reply, the reason you choose and any note are sent to Mariete, which stores them to review the report. Edge on iPhone has no reporting.
• If you copy a diagnostics report and send it to us, it contains the app version, your device’s name and system version, the state of the models and recent error messages.
• Edge contains no analytics, advertising or tracking code.
• What Edge stores stays on your phone. On iPhone it is included in your own phone backup, online or on a computer, if you use one. Edge on Android is excluded from cloud backup.

Edge’s own privacy page, at edge.mariete.ai/privacy, describes this in more detail.

9.Data retention

We retain personal information for as long as your account is active or as needed to provide the Services, resolve disputes and enforce our agreements. Customer content is retained according to your workspace configuration and the retention terms of your agreement with us.

Records of the choices you make in our apps, and of purchases made in them, are kept as described under Our mobile apps, and other records of purchases as long as tax and accounting law requires. The companies we send content to keep it under their own terms, which differ; where one states how long it keeps content, the sections on our apps say so.

On termination, Customer content is returned or deleted in accordance with your agreement, with narrow exceptions for information we are required to retain by law.

10.Security

We maintain administrative, technical and physical safeguards designed to protect personal information against unauthorised access, loss, misuse and alteration. These include encryption in transit (TLS 1.3) and at rest (AES-256), role-based access control, least-privilege provisioning, audit logging, vulnerability management and third-party penetration testing.

No system is perfectly secure. You are responsible for maintaining the confidentiality of your credentials and for access controls inside your workspace. Suspected incidents may be reported to hello@mariete.ai.

11.International data transfers

Mariete operates globally. Where personal information is transferred across borders, we rely on appropriate transfer mechanisms, including Standard Contractual Clauses (SCCs) and equivalent safeguards. Enterprise customers can select EU, UK or US data residency at contract signing for storage and inference. That choice does not cover our mobile apps.

Some of the companies described in the sections on our apps are based outside the United States, the United Kingdom and the European Economic Area. In the Mariete app, the language model every task uses by default is run by a company based in China, which says it stores the data it receives there, and images are read by a model that is run from Singapore and made by a company based in China. In Painter, some of the companies that make the models you can choose are based in China. The law in those countries may not protect personal information to the standard of the law where you live, and may give public authorities access to it. Before you allow anything to be sent, each app says that some of these companies are based in China, and the Mariete app also that some are operated from Singapore. We rely on that permission for these transfers. You can avoid them by not giving that permission or by withdrawing it, and in Painter also by choosing a model from a company based elsewhere. We can tell you which companies these are on request: write to hello@mariete.ai.

12.Your rights

Depending on where you live, you may have the right to access, correct, delete, port, restrict or object to the processing of your personal information, and to withdraw consent where processing is based on consent. Residents of the EEA, UK, Switzerland and certain US states (including California) have specific rights under the GDPR, UK GDPR, Swiss FADP, the CCPA and other applicable laws.

In the Mariete app and Painter, you can withdraw permission to send your content to model providers at any time under Data sharing: in Painter’s Settings, or on the Account tab of the Mariete app.

To exercise your rights, contact hello@mariete.ai. Where you are a user of a workspace administered by a customer, we will direct your request to that customer, who is the controller of the content you submitted.

13.Cookies and tracking

We use cookies and similar technologies for authentication, session management, preferences, product analytics and limited marketing attribution. Cookies strictly necessary to deliver the Services are always set. Measurement and advertising technologies on our marketing site are not: they run only on the basis of your choice.

Where prior opt-in is required, in the EEA, the United Kingdom and Switzerland, nothing loads until you accept, and we treat an undetermined location the same way. Elsewhere these technologies are on by default and you can opt out at any time. The choice is separated into measurement and advertising, may be given for one and refused for the other, and can be changed or withdrawn at any point using the Cookie settings link in the footer of the marketing site. We store it in a first-party cookie for 180 days and ask again once that period ends or when the cookie policy version changes.

Withdrawing consent stops further collection. It does not reverse what was collected, or transmitted to an advertising platform, while your consent was in place. Our Cookie Policy lists every cookie we set, its lifetime and its purpose, and describes the information we send to advertising platforms from our own servers, which browser cookie controls do not affect.

Disabling essential cookies will prevent the Services from working as intended. We do not use cookies to infer political affiliation, religion, health status or other sensitive categories.

None of this measurement runs inside our apps, on our sign-in and account pages when an app opens them, or in the Painter pages that open inside the app; see Our mobile apps. Links in the apps to our Terms and to this Policy open our website in your browser, where the choice you make in that browser applies.

14.Children's privacy

The Services are not directed to children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact hello@mariete.ai and we will take steps to delete it.

15.Voice calling

Where the Services include outbound voice calling, calls placed on your behalf are recorded and transcribed for the purpose of executing the task you requested and reconciling cost. Every call begins with an audible disclosure to the called party that the caller is an AI voice assistant and that the call is being recorded.

We collect and process the destination phone number, call timestamps, duration, transcript, audio recording, ended-reason and itemised cost breakdown (carrier and provider components, plus the platform multiplier shown in your billing settings). Audio and transcripts are stored by our voice-AI provider and routed through a regulated telephony carrier; we retain a copy and the metadata in your workspace.

You may delete a specific call recording at any time through the Services or by emailing hello@mariete.ai. You are responsible for ensuring your use of voice calling complies with applicable law in the destination jurisdiction, including the U.S. Telephone Consumer Protection Act (TCPA), national Do-Not-Call registries, two-party-consent recording statutes (such as California’s) and equivalent laws elsewhere.

16.Changes to this Policy

We may update this Policy to reflect changes to our practices, our Services or legal requirements. When we make material changes, we will provide notice: through the product, by email, or by updating the “Last updated” date at the top of this page. Continued use of the Services after a change takes effect constitutes acceptance of the updated Policy.

17.Contact

Privacy questions, rights requests, data-protection enquiries, security matters and all other legal enquiries: hello@mariete.ai.

Mariete, Inc. 1955 North Calvert Street Arlington, VA 22201, USA