Privacy policy

Last changed on October 14, 2026

This privacy policy explains how Marbly handles your personal data: what we collect, why and on what basis, who processes it, how long we keep it, and what rights you have. It covers the Marbly web service during its beta.

This policy is in Finnish and English. If the two versions differ, the English version prevails.

In brief

• We collect what you give us when you use the service: your account, your requests and bookings, and your messages and reviews. Some data, such as sign-in times and your IP address, is recorded automatically.
• We use it to run the service, keep it safe and improve it. We use no analytics or marketing cookies.
• Your display name, your reviews and the provider pages are public.
• Dietary details are shared only with your consent, and only with the providers who receive your request. We delete them 30 days after the event.
• We keep data only as long as we need it or the law requires. Section 8 has the periods.
• You can get, correct or delete your data, and withdraw your consent, by writing to the address in section 1.

1. Controller and contact

• Controller: [to be added: company name], which runs Marbly
• Business ID (Y-tunnus): [to be added: business ID]
• Address: [to be added: postal address]
• Privacy matters: [to be added: email address]

We answer questions and requests about your data at this address.

2. Legal bases

We process personal data only when one of these bases applies. Section 3 says which basis covers each kind of data.

• Contract: we need the data to run your account, your request or your booking.
• Legal obligation: the law makes us keep the data, such as the Accounting Act, or makes us prove that we handled your consent and your requests correctly.
• Legitimate interest: we need the data to keep the service safe or to improve it, and our interest does not override your rights. We have assessed each such use on its own.
• Consent: marketing messages, and dietary details on a request. Consent is voluntary, you can withdraw it at any time, and you can use the service without giving it.

3. What we process and why

3.1 Your account

• Email address, password and sign-in times – signing in. Basis: contract. Kept: while your account exists. We never store your password itself, only a form of it that cannot be turned back into the password.
• The email address, name and picture Google sends, if you sign in with Google – signing in with Google. Basis: contract. Kept: while your account exists. We do not copy the name and picture into your profile.
• Display name and language – showing who wrote a review or a message, and using the language you chose. Basis: contract. Kept: anonymised when your account is deleted, which means anything that links it to you is removed. Your display name is public: anyone can see it.
• Phone number – reaching you about a booking. Basis: contract. Kept: while your account exists.
• Role (customer, provider or admin) – access control. Basis: contract. Kept: while your account exists.
• The version of the terms you accepted, and when – proof of what you agreed to. Basis: contract; after your account ends, legitimate interest, so we can answer claims. Kept: while your account exists, then the claims period (section 8).
• Your consents and withdrawals: what the consent covers, whether you gave or withdrew it, and when – proof of consent and of its withdrawal. Basis: legal obligation. Kept: while your account exists, then the claims period.
• Your data requests (getting or deleting your data) – carrying out your rights. Basis: legal obligation. Kept: the claims period after the request is closed.
• Admin and system actions, such as who approved a provider – telling later who did what. Basis: legitimate interest. Kept: the claims period. We record only ids and statuses.

3.2 Providers

Many caterers are sole traders (toiminimi). For them, the business data below, such as the business ID, address and earnings, is their own personal data, and this policy covers it.

• Business name, description, logo, service areas, languages and Oiva rating – the public provider page. Basis: contract. Kept: while the provider is active. This data is public.
• Team members and email invitations – the team's access to the provider account. Basis: contract. Kept: while the provider is active; an invitation 30 days after it is used or expires.
• Business phone, email and pickup address – customers and Marbly reach the provider. Basis: contract. Kept: while the provider is active.
• Business ID, registered name and VAT status – checking the business, and VAT on orders. Basis: contract and legal obligation. Kept: the bookkeeping period.
• Legal name, registered address, tax ID and VAT number – invoicing. Basis: legal obligation. Kept: the bookkeeping period.

3.3 Requests, orders and bookings

• Event date, time, number of guests, postal code and budget – sending your request to providers. Basis: contract. Kept: if the request becomes a booking, 3 years after the event; otherwise 12 months after the event date, then anonymised.
• Event type – the provider plans a menu that suits the occasion. Basis: contract. Kept: as the request. Only the providers who received the request see it.
• Free text, cancellation reason and the provider's reason for declining – details the form has no field for. Basis: contract. Kept: as the request or booking. See also section 4.
• Dietary details: the diets you choose and any notes – the provider plans food for your guests. Basis: contract and explicit consent. Kept: 30 days after the event. See section 4.
• Change requests: guests, time and reason – changing a confirmed booking. Basis: contract. Kept: as the booking. Dietary notes in a change request are kept like other dietary details.
• Which providers received a request, and their answers – routing the request and tracking response times. Basis: contract. Kept: as the request.
• Shortlists – comparing providers, alone or with others. A shortlist can be shared by a link. Basis: contract. Kept: while your account exists; a shortlist made without an account 90 days after it was last opened. Anyone with the link sees the providers on the list, not who made it.
• Booking details: status, times and cancellations – running the booking. Basis: contract. Kept: 3 years after the event.
• Quotes, orders, order lines and amounts – the sale. Basis: contract and legal obligation. Kept: the bookkeeping period.
• Delivery address and contact phone for the event – delivering the food. Basis: contract. Kept: 30 days after the event.

3.4 Messages, reviews and moderation

• Messages and their attachments – customer and provider agree on the details. Basis: contract. Kept: the claims period after a booked event; 12 months after the event if nothing was booked.
• The original text of a message – if a message contains contact details, we hide them from the other side. The original is kept only when something was hidden. Only admins can read the original, and only to settle a dispute or a report. Basis: legitimate interest. Kept: 30 days after the event; the original of a reported message as long as the report is kept.
• When you last read a conversation – showing unread messages. Basis: contract. Kept: as the conversation.
• Reports about messages – moderation. Basis: legitimate interest. Kept: 12 months after the admin's decision, so the decision can be challenged.
• Reviews and the provider's replies – public ratings. Basis: legitimate interest. Kept: reviews stay, and the author is anonymised when their account is deleted. Reviews are public.
• Reports about reviews, and who hid a review and why – moderation. Basis: legitimate interest. Kept: as the review.

If we hide a review or restrict a provider's account, we tell the person affected why. We follow the EU Digital Services Act.

3.5 Notifications and email

• Notification settings, including marketing email – which emails we send you. Basis: contract; marketing by consent. Kept: while your account exists.
• Email delivery log – knowing whether an email arrived, and sending it again. Basis: legitimate interest. Kept: 90 days. The log holds the email address only when the recipient has no account, such as someone invited to a team. The address is cleared when deletion is requested.
• A scrambled copy of an email address that bounced – so we do not mail a dead address again. Basis: legitimate interest. Kept: with no end date. The address cannot be read from it, but it can be matched against the address, so it is still personal data.

3.6 Pictures and files

• Logos and provider photos – the provider page. Basis: contract. Kept: while the provider is active. They are public.
• Message attachments – as the message. They are private, and open only through a short-lived link the service issues.

Provider photos can show staff or guests. The provider is responsible for having their permission. If you appear in a photo, you can ask us at the address in section 1 to remove it, and we will.

3.7 Errors, logs and backups

• Website errors (Sentry) – fixing bugs. Basis: legitimate interest. Kept: at most 90 days. An error report holds the page address without its query, the browser type and the time. The website sends Sentry no name, no email address, no session recordings and no cookies.
• Server errors (Google Cloud Error Reporting) – fixing bugs. Basis: legitimate interest. Kept: 30 days.
• Request logs with your IP address (Vercel, Google Cloud Run and Supabase) – running and securing the service, such as blocking abuse. Basis: legitimate interest. Kept: at most 30 days.
• Backups (Supabase) – restoring the service after a failure. Basis: legitimate interest. Kept: for a limited period, at most 30 days.

3.8 Interviews and support

• Beta interviews: name, contact details and notes – learning why people use the service or leave it. Basis: consent, asked before the interview. Kept: until the findings are written up, then deleted.
• Emails you send us – answering your questions. Basis: contract; legitimate interest if you have no account. Kept: 12 months after the conversation ends.

4. Dietary and other sensitive data

Some diets can reveal health, such as gluten-free, lactose-free or nut-free, or religious belief, such as halal or kosher. Data protection law gives such data extra protection.

• We ask for separate, explicit consent for dietary details. You give it with a checkbox that is not ticked in advance and that shows only when you add dietary details.
• Without consent, the request is sent without the dietary details.
• Only the providers who received the request see the dietary details. After a booking, only the booked provider does.
• We delete dietary details 30 days after the event.
• We never use dietary details or the event type for ads or profiling, and never send them to analytics or error-tracking services.
• You can withdraw your consent by removing the dietary details from your request, or by writing to the address in section 1. We then delete them. Withdrawing does not affect what was done before.

Please do not write about your health or beliefs in free-text boxes or messages. If you do, we do not process it for that purpose. The text is kept like the rest of the request or booking.

5. Where the data comes from

Most data comes from you, when you type it into the service. You see it as you enter it.

Some data is recorded without you typing it:

• sign-in times, when you sign in;
• the name, email address and picture Google sends, if you sign in with Google;
• when you opened a conversation;
• the original text of a message;
• admin and system actions;
• the email service's report on whether an email arrived or bounced;
• your IP address in request logs;
• error reports.

A member of a provider's team can give us your email address to invite you to the team.

6. Cookies

We use only the cookies the service needs to work. We use no analytics or marketing cookies.

• Keeps you signed in – lasts 400 days, or until you sign out. Name: sb-…-auth-token
• Completes a sign-in – removed when the sign-in finishes. Name: sb-…-auth-token-code-verifier
• Remembers the language you chose – removed when you close the browser. Name: NEXT_LOCALE

All of them are set by Marbly itself.

7. Who receives the data

Other users. The providers you send a request to see the request. Your display name, your reviews and the provider pages are visible to everyone.

Processors handle data on our behalf, to run the service.

• Supabase: the database, sign-in, files, messages and backups. The data is in the EU or the United Kingdom.
• Vercel: runs the website and keeps request logs. The data is in the EU, in Frankfurt.
• Google Cloud: runs the server (Cloud Run) and the error reports. Cloud Run is in London.
• Sentry: website errors, with as little personal data as possible. The data is in the EU.
• Resend: sends our emails, such as the sign-up confirmation. The emails are sent from Ireland, but Resend keeps them and their delivery logs in the United States.

Google sign-in. If you sign in with Google, Google learns that you signed in, under Google's own terms.

Transfers outside the EU. The United Kingdom is outside the EU, but the European Commission has found its data protection adequate. The decision is valid until 27 December 2031. Supabase, Vercel, Google, Sentry and Resend are US companies. If data is accessed from the US, such as by support staff, or kept there, as Resend keeps our emails, the transfer relies on the EU's standard contractual clauses or the EU–US Data Privacy Framework.

8. How long we keep data

A retention period is the longest we keep data. If you delete it sooner, or ask us to, we delete it then, unless the law makes us keep it.

Section 3 refers to three general periods:

• Dispute window: 30 days after the event, or until a disagreement about the event is settled.
• Claims period: 3 years after the event, the account's deletion or the matter's close. It is the general limitation period for claims in Finland (laki velan vanhentumisesta).
• Bookkeeping period: 10 years for the books and 6 years for receipts (the Finnish Accounting Act).

Deleted data stays in backups until their retention period ends.

9. Your rights

You have the right to:

• know what data we hold about you, and get a copy of it;
• ask us to correct data that is wrong;
• ask us to delete your data. We delete or anonymise it. We keep bookkeeping records as long as the law requires, and your reviews stay up without your name;
• ask us to restrict how we use your data;
• object to a use that rests on our legitimate interest;
• withdraw your consent at any time. Withdrawing does not affect what was done before.

Send your request to the address in section 1, from your account's email address. We send a confirmation link to check that the request is yours. We never ask for an ID document. We answer within one month.

Complaints. If you think we handle your data unlawfully, you can complain to the Data Protection Ombudsman: Office of the Data Protection Ombudsman.

10. How we protect your data

• During the beta, only Marbly's founders have admin rights.
• Each time an admin opens the original text of a message or a report, it is logged.
• Private files open only through a short-lived link.

11. Age

Marbly is for adults. We do not knowingly collect data about anyone under 18.

12. Automated decisions

We make no automated decisions about you that have legal or similarly significant effects, and we do not profile you.

13. Changes to this policy

We update this policy when the way we handle data changes, before the change takes effect. The date at the top of the page shows when it last changed.