Draft for lawyer review. This document has not been reviewed by an attorney and is not final legal advice. It will be updated before launch.

LEGAL

Privacy Policy

Draft. Last updated: October 1, 2026.

FlipDeck LLC, a California limited liability company ("we", "us"), operates Marnyx, an AI marketing service. This policy explains what we collect, why, who we share it with, and the choices you have.

1. Information we collect

• Account information: your email address and a securely hashed password.
• Business information you give us: business names, website addresses, mailing address, time zone, and the brand brief (which you can edit).
• Website content: when you ask Marnyx to read your website, we fetch your homepage and a few key public pages (such as About, Products and Contact), respecting your site's robots.txt, and keep the text and page titles used to write your brief.
• Content you and Marnyx create: post drafts, scheduled and published posts, uploaded images and videos, video plans, ad drafts, email campaigns and outreach messages, and your approvals, edits and rejections.
• Connected social accounts: if you connect Facebook, Instagram, X or TikTok, we receive the account name and identifier and an access token (and refresh token where offered). Tokens are encrypted at rest. We use them only to publish posts you approved and to read performance numbers.
• Analytics: metrics the platforms report for posts we published for you (for example reach, impressions, likes, comments, shares, clicks and views).
• Email contact lists: email addresses and optional names you upload, the consent information you give us about them, and their unsubscribe status. See section 5.
• Payment information: payments are handled by Stripe. We receive your plan, subscription status and billing dates, not your full card number.
• Usage and security records: sign-in events, an audit log of actions in your account, IP address and basic device information.

2. How we use information

• To provide, secure and improve the service, including writing drafts for your approval. Nothing is published, sent or spent without your approval in the app.
• To send service emails such as password resets, email confirmation, and notices that a social connection needs to be reconnected.
• To keep an audit trail of generation, edits, approvals, scheduling, publishing, sending, connections and billing.
• To enforce plan limits and prevent abuse and unexpected costs.
• To comply with the law and enforce our terms.

We do not sell your personal information and do not use it for advertising by third parties.

3. AI processing

To write briefs, drafts, scripts and similar content, we send relevant text to our AI provider (Anthropic): text from your website, your approved brand brief, recent posts, and instructions you type. Website text and other third-party text is treated as untrusted data and is not allowed to give instructions to the AI. We do not send your passwords, access tokens or payment details to the AI provider. AI output may be inaccurate; you review it before anything is used.

4. Service providers and platforms

We share information with providers that help us run the service, only as needed: hosting and database (Render), email delivery (Postmark), AI (Anthropic), payments (Stripe), and the social platforms you choose to connect (Meta for Facebook and Instagram, X, and TikTok), which receive the posts and media you approve for publishing. Those platforms handle your data under their own policies.

5. Email lists you upload

For contacts you upload, you are responsible for having their consent, and you confirm this when you upload. We send campaigns on your behalf, add your mailing address and an unsubscribe link to every message, and permanently honor unsubscribes. We keep unsubscribed addresses on a suppression list so they are never emailed again by that business. As to those contacts, you act as the controller of the information and we act as your service provider.

6. Retention and deletion

We keep information while your account is active. When you delete a business, its brief, drafts, media, connections, contacts and analytics are deleted. When you disconnect a social account, its stored tokens are deleted immediately. We keep limited records (such as the audit log, suppression lists and records of deletion requests) where needed for security, legal compliance or to honor opt-outs. If you remove Marnyx in your Facebook settings and request deletion, we delete the stored Facebook and Instagram access automatically. See Data Deletion.

7. Your choices and rights

You can edit or delete your businesses, disconnect accounts, and turn off auto-drafting in the dashboard. You can ask us to access, correct or delete your personal information. California residents have additional rights under the California Consumer Privacy Act, including the right to know, delete and correct, and to not be discriminated against for exercising these rights. Email michael.dano1523@gmail.com.

8. Cookies

We use a strictly necessary session cookie to keep you signed in, and your browser stores your light/dark preference. We do not use advertising cookies.

9. Security

We use encrypted connections, hashed passwords, encrypted access tokens and access controls. Each business's data is separated by account. No system is perfectly secure.

10. Children

Marnyx is not for anyone under 18, and we do not knowingly collect information from children.

11. Changes

We may update this policy and will post the new date above.

12. Contact

FlipDeck LLC, California. Email: michael.dano1523@gmail.com