Privacy Policy

1. Data Controller

The data controller is:
Marmalade skies s.r.o.
IČO: 24372901
Bělehradská 858/23, 120 00 Praha, Czech Republic
Email: hello@marmaladeskies.dev

We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 GDPR.

2. Information We Collect

We may collect the following data:

• Account data: name, email address, password hash, role, company/workspace details.
• Client and document tracking data: document names, due dates, statuses, notes, communication history, and uploaded files.
• Billing data: subscription plan, payment status, and invoice-related details (payments are processed by third parties).
• Technical data: IP address, browser type, device information, log records, and usage events.

3. Role of the Parties (Controller vs Processor)

For account, billing, and service usage data, Marmalade skies s.r.o. acts as a data controller.

For Customer Data uploaded to the service by or on behalf of a workspace owner (including client records, documents, and related metadata), Marmalade skies s.r.o. acts as a data processor on behalf of the workspace owner, who is the data controller.

We process Customer Data only on documented instructions from the workspace owner, as set out in our Data Processing Agreement, unless otherwise required by applicable law.

Our Data Processing Agreement (DPA) forms part of our Terms and applies to all processing of Customer Data where we act as processor. A copy is available on request at hello@marmaladeskies.dev.

4. How We Use Your Information

We use personal information to:

• Provide and operate the application.
• Manage document workflows, reminders, deadlines, and client communication.
• Authenticate users and maintain account security.
• Provide support and respond to your requests.
• Process subscriptions and billing operations.
• Monitor performance, troubleshoot issues, and improve the product.
• Comply with legal obligations.

5. Legal Bases for Processing

Depending on your location, we process personal data based on:

• Contract necessity (to provide the service you requested).
• Legitimate interests (service security and quality).
• Legitimate interests for B2B customer relationship management, including service-related email communication with business contacts.
• Consent (where required, e.g., certain cookies).
• Compliance with legal obligations.
• For Customer Data, processing is performed on behalf of the workspace owner under a Data Processing Agreement.

6. Sharing and Disclosure of Data

We do not sell personal data. We may share information with:

• Subprocessors and service providers that support platform operations, including hosting/infrastructure, email delivery, analytics, and payment processing.
• Professional advisors and authorities when required by law or to protect rights and safety.
• A successor entity in case of merger, acquisition, or asset transfer.

A current list of subprocessors is available upon request at hello@marmaladeskies.dev.

7. Data Retention

We retain personal data according to the following periods:

• Account data: for as long as the account is active and up to 12 months after deletion.
• Billing data: retained for 10 years in line with Czech tax and accounting obligations.
• Log data: retained for up to 12 months.
• Backup copies: retained for up to 35 days.

8. Security

We use reasonable technical and organizational safeguards to protect personal data, including access controls, encrypted connections, and monitoring. No method of transmission or storage is completely secure, but we continuously work to improve protection.

9. International Data Transfers

Our primary hosting infrastructure is located in the European Union (including Czech Republic and other EU member states). Some service providers (for example payment and email providers) may process personal data in countries outside the European Economic Area (EEA), including the United States.

Where required, we rely on an adequacy decision or implement appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs).

You can request more information about the transfer mechanism applicable to your data by contacting hello@marmaladeskies.dev.

10. Cookies and Analytics

We use cookies and similar technologies to keep you signed in, remember preferences, measure usage, and improve the service. You can manage cookies in your browser settings.

11. Your Rights Under GDPR

If you are in the European Economic Area, you have the right to:

• Access your personal data.
• Correct inaccurate data.
• Request deletion of your data.
• Restrict or object to certain processing.
• Request data portability.
• Withdraw consent where processing is consent-based.
• Lodge a complaint with your local supervisory authority.

To exercise these rights, contact us using the details below.

We respond to GDPR requests within 1 month in accordance with Article 12(3) GDPR.

You also have the right to lodge a complaint with the Czech supervisory authority:
Úřad pro ochranu osobních údajů (ÚOOÚ)
https://www.uoou.cz

If your request relates to Customer Data processed on behalf of a workspace owner, you should contact that workspace owner first as the data controller. We will assist the workspace owner as required by applicable law.

12. Children's Privacy

Our service is not intended for children under 16 (or the minimum age in your jurisdiction), and we do not knowingly collect personal data from children.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated effective date.

14. Contact Us

For privacy questions or requests, contact:
Marmalade skies s.r.o.
IČO: 24372901
Bělehradská 858/23, 120 00 Praha, Czech Republic
Email: hello@marmaladeskies.dev

For requests related to Customer Data in a specific workspace, please contact the relevant workspace owner (data controller) first.