Privacy Policy

1. About this policy

This policy explains how MARCO handles personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

In this policy, “we”, “us”, and “our” mean MARCO SOFTWARE PTY LTD (ACN 701 588 061; ABN 69 701 588 061), which operates MARCO at trustmarco.com. Our main business location is Queensland, Australia. This policy covers our website, subdomains and APIs.

2. Information we collect

We collect the following categories of information:

• Account information — email address, password hash managed by Supabase Auth, display name, provider profile details if you choose social sign-in, and the plan you are on.
• Compliance check data — ingredient names, formulas, product descriptions, and any documents you upload for screening (label images, COAs).
• Marketplace data — if you list a contract manufacturer profile or request quotes, the contact details, project notes, and quote correspondence you provide.
• Payment data — if you use a supported checkout, handled directly by Stripe. We do not store full card numbers; we receive billing identifiers and subscription status.
• Technical data — IP address, browser type, pages visited, and request timestamps, captured in standard server logs and error monitoring.
• Support and chat — messages you send to the AI assistant, support requests and contact details you provide for a response.
• Cookies and similar technologies — see our Cookie Policy.

We generally collect this information directly from you, from a sign-in provider you choose, and from your interaction with the service. Providing account and submission data is optional, but without the information needed for a requested feature we may be unable to create an account, perform a check or reply. You can browse public information without an account and reject optional tracking.

Only submit information you are authorised to share. Do not upload patient records, medical histories or unnecessary sensitive personal information. Formula text, label images and assistant messages may be sent to Anthropic for the AI processing you request. Cookie consent is separate from this processing and from acceptance of our terms.

3. How we use your information

We use your information to:

• Run the compliance checks, formula analyses, and pathway advice you request.
• Authenticate you, enforce plan limits, and prevent abuse.
• Process payments and manage subscriptions through Stripe.
• Deliver marketplace quote requests and responses between brands and manufacturers.
• Send service emails about account events and requested quotes, and regulatory digests you subscribe to. These are separate from optional promotional email; accepting cookies or creating an account does not subscribe you to promotional email.
• Monitor service health, debug errors, prevent abuse and investigate support requests. Optional public-page analytics and advertising measurement operate only with your consent.
• Where operational query logging is enabled, retain screening inputs and result summaries in our database for troubleshooting and internal quality review. This is separate from optional website analytics; do not submit unnecessary personal information in screening inputs.
• Comply with our legal obligations.

Formula and ingredient data are commercially sensitive. We do not use customer formula data to train machine-learning models. We do not sell, rent, or share customer compliance data with third parties for marketing purposes.

Where UK or EEA data-protection law applies, we rely on performance of our contract for requested account and screening services, legal obligations for required records, and legitimate interests in securing and operating the service where those interests do not override your rights. We rely on consent for optional analytics and advertising measurement. You may withdraw that consent through Cookie preferences.

4. Where your data lives

Customer data is stored in Supabase (Postgres) in the ap-southeast-2(Sydney) region. Static assets and serverless functions run on Vercel, with the production deployment pinned to the syd1 region. Some processing may transit edge nodes outside Australia. AI screening, email delivery, caching and monitoring may also process data overseas through the providers below; Australian database hosting does not mean all processing stays in Australia. Overseas processing may include the United States and other locations used by these providers and their sub-processors. The country can depend on the provider, feature and service configuration; contact us before submitting data subject to a specific location requirement.

5. Sub-processors we use

Provider notices explain their own processing and sub-processors. We remain responsible for our handling of personal information and applicable overseas-disclosure obligations. Contact us for current processing locations, contractual safeguards or a data-processing agreement before using the service where these are procurement requirements.

6. Disclosure to third parties

We disclose personal information only:

• To the sub-processors listed above, strictly for the purposes shown.
• To a supplier when you initiate a quote request, including the project, formula, screening snapshot and contact details submitted in that flow. Supplier profiles and reviews you choose to publish are visible to other authorised marketplace users. Suppliers are responsible for their subsequent handling of information.
• To regulators, law enforcement, or courts if we are required by law.
• To a successor entity in the event of a merger, acquisition, or asset sale, subject to equivalent privacy commitments.

We do not sell customer formulas or account lists. Optional advertising measurement shares limited event and device data with Google only if you permit it; personalised advertising is disabled. Rejecting optional tracking prevents that optional sharing.

7. Data retention

We retain account and screening records while needed to provide the service and meet applicable recordkeeping obligations. You can delete saved checks in your account or request account deletion at privacy@trustmarco.com. Some records may need to be retained for legal obligations, security or disputes. Backup and provider-log retention depend on the configured service settings; contact us for the current arrangements before submitting information with a specific retention requirement.

8. Your rights

Under the APPs you may:

• Ask us what personal information we hold about you (APP 12).
• Ask us to correct inaccurate information (APP 13).
• Ask us to delete your account and associated data.
• Withdraw optional tracking consent through Cookie preferences and unsubscribe from optional email using the controls provided or by contacting us. Essential account and security messages may still be necessary.
• Complain about how we handle your personal information.

Email privacy@trustmarco.com for any of the above. Describe your request or complaint and the account involved; do not send passwords or identity documents unless we arrange a secure verification method. We may need to verify identity to protect the account. We aim to respond within 30 days and will explain any applicable exception or extension. If you are not satisfied with our response, or have not received one within a reasonable time, you may contact the Office of the Australian Information Commissioner at oaic.gov.au.

Depending on the law that applies to you, additional rights may include erasure, restriction, objection and portability of personal data, and complaining to your local supervisory authority. We assess requests under the applicable law. MARCO does not use screening outputs to make decisions about an individual’s eligibility for employment, credit, healthcare or similar services.

9. Security

We protect your information with HTTPS, HSTS, encrypted-at-rest databases, role-based access controls, and short-lived session tokens. We use Supabase Row-Level Security to enforce data isolation between customers. We log administrative actions on the marketplace approval queue and on the regulatory alerts pipeline.

For more on our security posture, see Trust & Security.

10. Notifiable Data Breach plan

If we become aware of unauthorised access to personal information that is likely to result in serious harm, we will notify affected individuals and the OAIC as required by the Notifiable Data Breaches scheme. Our incident-response process includes containment, root-cause analysis, notification, and remediation.

11. Children

MARCO is a B2B compliance tool. We do not knowingly collect personal information from anyone under 16. If you believe we have done so, contact us and we will delete the information.

12. Changes to this policy

We will publish a new “Last updated” date at the top of this page when we make changes. Material changes will be announced by email to active customers at least 14 days before they take effect.

13. Contact

Privacy questions: privacy@trustmarco.com
General contact: /contact
Main business location: Queensland, Australia (full postal address available on request)