How we handle your data.

Marmello is a managed marketing platform. We collect what we need to run our clients' content and ads, and nothing else. This page tells you exactly what that means.

Who this applies to

Two groups of people interact with our data: our clients (small businesses who pay us to manage their content and ads) and their prospects (people who fill in a Meta Lead Ad form run on a client's Facebook Page). The policy below covers both.

What we collect from clients

• Account details: name, email address, role.
• Business context: name, description, services, tone of voice, target audience, reference accounts. This feeds the AI that drafts content and emails on your behalf.
• Content you create or upload: calendar entries, captions, briefs, comments, footage references.
• An encrypted Facebook Page access token, only when you choose to connect your Page. The token is encrypted at rest with a key only our server holds. We never expose it to the browser.

What we collect from prospects

When someone submits a Meta Lead Ad form for one of our clients, Facebook sends us the responses via webhook. We typically receive:

• The person's name, email, and phone (whatever fields the form asked for).
• The Page and form the lead came from, and the time it was submitted.

The data is stored against the client's account inside Marmello, used to generate a first-response email draft, and shown to the client so they can follow up. It is not shared with third parties, used for advertising, or sold.

What we do with the data

• Run the platform: render dashboards, send notifications.
• Generate AI drafts for emails, content briefs, and weekly recap summaries. We use Anthropic's Claude API for this; only the specific text needed for a draft is sent, never bulk exports.
• Send emails on behalf of the client (lead replies, weekly recaps). Delivered via Resend. No marketing emails to prospects.

When you ask us for a guide or a strategy call

If you download one of our free guides or ask for a free strategy call, we collect your name, your business name, your email address and, if you give it, your mobile number and website, along with your answers to the questions on the page and which of our ads you came from. We use them to send you what you asked for, to look at your business before the call, and to follow up with you about it. Marmello Media Ltd is the data controller. We rely on your request and our legitimate interest in replying to it.

If you have accepted cookies, we also tell Meta that someone who saw our ad downloaded the guide or asked for a call, so we can see which ads work. Your email address and mobile number are sent to Meta only in hashed form, as Meta requires. If you decline cookies, none of this is sent.

Who can see it

• The client whose account the data sits in.
• Marmello team members assigned to that account (directors and staff). We log every meaningful action so the audit trail exists.

No one else. We do not sell data. We do not share it across clients. We do not use one client's data to train AI for another.

Where it lives

Application data is stored in Supabase (PostgreSQL) in the EU region. Encrypted Page access tokens are stored alongside the rest of the data but encrypted with AES-256-GCM at the application layer, so a database compromise alone cannot decrypt them. Hosting is on Vercel (Frankfurt region). Email delivery via Resend. AI inference via Anthropic.

How long we keep it

• Account data: while the account is active, plus 90 days after closure.
• Lead data: same lifecycle as the client account that received it.
• Activity logs: 12 months rolling.
• Guide and strategy call requests: 12 months from when you made them, then deleted automatically.

Your rights

Under UK GDPR you have the right to access, correct, or delete the personal data we hold about you, and to object to or restrict processing. To exercise any of these, email socials@marmello.media. We respond within 30 days. See our data deletion page for the specific deletion procedure.

Disconnecting Facebook

A client can disconnect their Facebook Page from Marmello at any time. When they do we delete the encrypted Page access token, unset the linked Page ID, and ask Meta to unsubscribe the Page from our leadgen webhook. Leads received before disconnection remain in the client's account; the client can request deletion at any point.

Cookies

We use one essential cookie for the signed-in session and short-lived cookies during the Facebook OAuth flow (for CSRF protection). Those are always on. With your consent, given through the cookie banner, we also use Google Analytics to understand how the site is used and the Meta pixel on our guide and strategy call pages to measure our Facebook and Instagram ads. If you decline, neither loads. You can change your mind by clearing this site's data in your browser, which brings the banner back.

Changes

If we change this policy materially we'll email everyone with an active account at least 14 days before the change takes effect.

Contact

Marmello is operated by Marmello Media Ltd, registered in England and Wales, company number 17360009, registered office The Mount, Paris Street, Exeter, EX1 2JY, United Kingdom. That company is the data controller for everything described above. Reach us at socials@marmello.media for anything privacy-related.