Maro

Privacy Policy

Last updated: 30 June 2026

This policy explains what data Maro (heymaro.ai) collects and how we use it. The data controller is Smash, s. r. o. (details at the bottom).

1. What we collect

• Account: your email address (and name, if you sign in with Google).
• Content you create: tasks, projects, notes, chat messages, scheduled items and your day log.
• Usage: number of messages and AI usage/cost metering.
• Billing: your plan, subscription status and billing dates. Card details are entered with our payment processor (Stripe) and are never seen or stored by us.
• Technical: IP address (for security and rate-limiting), a basic activity log (e.g. logins, key actions) and your language preference.

2. How we use it

To provide and run the Service: generate AI responses, keep your tasks and day organized, secure the Service (rate limits, abuse and cost protection), and improve it. We don’t sell your data or use it for advertising.

3. AI processing

To generate responses, we send your messages and relevant content to our AI provider, Anthropic (the Claude API), which processes it to return a reply. See Anthropic’s terms at anthropic.com/legal.

4. Processors we use

• Anthropic — AI responses.
• WebSupport (EU/Slovakia) — hosting and database.
• Stripe — payment processing for paid subscriptions (handles your card and billing details securely; we never store your card number).
• Resend — sending transactional emails such as your one-time sign-in code.
• Google — only if you choose “Sign in with Google” (Google provides your email/name).
• DataFast — privacy-friendly, cookieless analytics on our public pages only (aggregated, non-identifying; not used inside your signed-in workspace).

5. Cookies & local storage

We use only what’s necessary to run the Service — no advertising and no cross-site tracking. For aggregate visitor statistics on our public pages we use DataFast, which is cookieless and stores nothing on your device. Inside your signed-in workspace we run no analytics at all.

Because these are strictly necessary/functional, no cookie consent banner is legally required. We still show a short cookie notice for transparency — you can reopen it anytime via Manage cookies.

6. Retention

We keep your data while your account is active. You can delete your content or request account deletion at any time — then we remove your personal data, except where we must keep limited records by law.

7. Your rights (GDPR)

You have the right to access, correct, delete, restrict or port your data, and to object to processing. To exercise these, email us (below). You may also lodge a complaint with the Slovak Data Protection Authority (Úrad na ochranu osobných údajov SR).

8. Contact