Privacy policy

When you visit marsys.ai we collect the technical data every web server records: your IP address, the pages you open, the time of the visit, and the browser and device you use. We use it to run the site and to understand how it is used. We keep server logs for up to 60 days.

If you join the waitlist or write to us, we keep your name, email address and message to answer you and to tell you when Spren is available. You can ask us to delete them at any time.

When you or your company create a Spren account we store your name, email address, the company name, your role in the account, and the settings you choose. We store billing details (plan, invoices, the last four digits and expiry of a card) with our payment provider; we never see or store full card numbers. We keep account data for as long as the account exists. Cancelling or pausing a subscription does not close the account, and its data stays so you can come back to it. When an account is closed, section 6 says what is deleted and when.

Spren works by reading from and writing to the services your company connects, with the permission of the person who connects them. Depending on what you connect, that can include email messages and drafts, calendar events, documents and files, chat messages, records in a CRM, and the content of web pages Spren visits to do its work.

Spren processes this data to do the work it has been assigned and to remember what it has learned about that work. We store the results of Spren's work, the notes it keeps to do its job (for example, who a contact is and what was last agreed with them), the actions it took and who approved them, and the messages exchanged with it. We do not use your company's data to train machine learning models, and we do not sell it or share it with anyone except the service providers named in section 5, who process it only on our instructions.

Your company's administrators decide which services Spren may connect to, which people may instruct it, and what it may do without asking a human first. Every action Spren takes is recorded and can be reviewed in the account.

If you connect a Google account, Spren asks for permission to read your email, to create and send email on your behalf, to read and manage your calendar, and to read your files in Google Drive. Spren uses these permissions only to do the work you assign it: reading the messages, events and files relevant to that work, drafting and sending replies you asked for, and keeping the notes described in section 3. Spren does not read your Google data for advertising, does not sell it, does not use it to train models, and does not let a human at Marsys read it except with your permission to resolve a problem you reported, or as required by law.

The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

You can withdraw Spren's access at any time from your Google account's security settings or by disconnecting Google in Spren; when you do, Spren deletes the credentials it held for that account.

We use a small number of service providers to run Spren, and they process data only on our instructions and under contracts that require them to protect it:

Amazon Web Services (hosting of Spren, in its Zurich, Switzerland region, where Spren's data is stored); Vercel (hosting of the marsys.ai website); Anthropic, through Amazon Web Services, and Microsoft Azure (the AI models Spren runs on; they use each request only to produce its answer and do not train on it); Postmark (transactional email such as invitations and alerts); Stripe (payments); Google, Slack, Telegram and any other service you choose to connect (which receive only the requests needed to do the work in that service).

We may also disclose data if the law requires it, or to protect the rights and safety of our customers, the public or ourselves.

Spren's data is stored in Switzerland. Where a service provider processes data outside Switzerland or the EU, we rely on the safeguards recognised by Swiss and EU law, such as the standard contractual clauses.

We keep your company's data for as long as your account is active. When an account is closed, its data is deleted within 30 days, except for records we must keep for accounting or legal reasons, which are kept for the period the law sets and then deleted.

Data is encrypted in transit and at rest. Credentials Spren holds for connected services are stored in a dedicated secrets store, separately from other data, and are never shown to anyone. Access to production systems is limited to the people who operate them and is logged.

You have the right to know what personal data we hold about you, to receive a copy of it, to have it corrected or deleted, to restrict or object to how it is used, and to take it with you in a portable form. If your data is processed on behalf of a customer company, please contact that company first; we will help them answer you. Write to privacy@marsys.ai and we will reply within 30 days. You may also complain to the Swiss Federal Data Protection and Information Commissioner or, if you are in the EU or the UK, to your local data protection authority.

Spren is a tool for companies and is not intended for anyone under 18. We do not knowingly collect data from children.

When we change this policy we will post the new version here and update the date at the top. If a change materially affects how we use your data, we will tell account holders by email before it takes effect.

Marsys AI Ltd, Route de Genève 60 b, 1028 Préverenges, Switzerland. privacy@marsys.ai.