Privacy Policy

Last updated: 9 November 2026

1. Who we are

This policy explains how Marbeez ("we", "us") processes personal data when you use the Marbeez app. We are the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Contact our privacy team at support@marbeez.com. Registered company details: Marbeez LLC.

2. Personal data we collect

Identity and contact data: name, email address, date of birth, sign-in method and authentication records. Passwords are stored only as salted hashes.
Financial profile data you provide: income, age, goals, risk preferences, budgets, savings goals, manual holdings, debts and asset descriptions.
Bank data (only if you connect a bank): account names and types, balances and transaction history received through Plaid.
AI coaching data: the questions you ask the coach and the replies generated.
Technical and usage data: sign-in times, coach credit usage, security events and device preferences. Some preferences (card order, hidden amounts, app lock) are stored only on your device.

3. Purposes and lawful bases (UK GDPR Article 6)

Contract (Art. 6(1)(b)): creating your account and providing the dashboard, budgets, goals, portfolio, spending trends and AI coaching you request.
Consent (Art. 6(1)(a)): connecting a bank account. You may withdraw consent at any time by disconnecting the bank; this does not affect processing carried out before withdrawal.
Legitimate interests (Art. 6(1)(f)): keeping the service secure, preventing fraud and misuse, enforcing plan allowances and improving reliability. We have balanced these interests against your rights.
Legal obligation (Art. 6(1)(c)): keeping records required by tax, accounting or other laws, and responding to lawful requests.
Financial information can reveal sensitive circumstances. We do not intentionally process special category data (Art. 9); please do not enter health or other special category details into the coach.

4. Bank connections and access tokens

Bank connections are provided by Plaid, a regulated account information service provider. You enter your bank credentials with Plaid or your bank directly; Marbeez never sees or stores your bank login details.
Access is read-only. Marbeez cannot move money, make payments or change your bank accounts.
Plaid issues an access token that lets us refresh your balances and transactions. Tokens are exchanged server-side, encrypted at rest using AES-GCM, never sent to your browser and never visible to Marbeez staff.
When you disconnect a bank, we revoke the token with Plaid and delete the balances and accounts synced from that connection. Plaid's own handling of your data is described in the Plaid End User Privacy Policy.

5. AI coaching

When you ask a question, we assemble the relevant parts of your saved financial profile, budgets, holdings and bank data on our servers and send them, with your message, over an encrypted connection to our AI model provider to generate a reply.
Our AI providers process this data on our behalf as processors. Your data is not used by Marbeez or our providers to train AI models.
Coaching is educational guidance, not regulated financial advice. It does not involve solely automated decisions that produce legal or similarly significant effects on you within the meaning of UK GDPR Article 22.
Your saved Marbeez AI conversations are private to your account. Database access rules allow only you, signed in (and verified with two-factor authentication where enabled), to read or change them. Marbeez staff, admins and support cannot open, read or browse your conversations, and our admin tools have no way to display them.
Voice dictation sends your recording only to be transcribed into text you can edit. Audio recordings are not saved to your account or our storage.
You can delete individual conversations at any time from Marbeez AI chat history, include them in your data export from Settings, or erase them all by deleting your account.

6. Staff access

Our admin tools are designed so staff can see only account-level status (such as sign-up date, plan, connection health and usage counts). Staff cannot view your balances, transactions, asset names, budgets or Marbeez AI conversations, and no admin screen or tool exists to display them. Every administrative action is recorded in an audit log.

7. Who we share data with

We do not sell your personal data or use it for advertising.
We share data only with processors acting on our instructions under written contracts meeting UK GDPR Article 28: cloud hosting and database providers, Plaid (bank connections), AI model providers (coaching), market data providers (prices, without personal data) and, when enabled, a payment provider.
We may disclose data where required by law, to protect our rights, or as part of a business transfer subject to equivalent protections.

8. International transfers

Some providers process data outside the UK. Where this happens, we rely on UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with transfer risk assessments.

9. How long we keep data

Account, profile, budget, goal and holdings data: for as long as your account is active.
Bank data: until you disconnect the bank or delete your account.
Coaching usage records: for as long as your account is active, to operate plan allowances.
On account deletion, we delete your data from live systems promptly and from backups within 30 days, except limited records we must keep by law (for example, billing records for up to 6 years).

10. Your rights

Under UK GDPR you have the right to: access your data (Art. 15); rectify inaccurate data (Art. 16); erasure (Art. 17); restrict processing (Art. 18); data portability (Art. 20); object to processing based on legitimate interests (Art. 21); and withdraw consent at any time.
Data portability: you can ask us for a copy of the data you provided, including your profile, budgets, goals, holdings and connected-account data, in a structured, commonly used, machine-readable format (JSON), downloadable any time from Settings, or ask us to send it to another controller where technically feasible.
To exercise any right, contact support@marbeez.com. We will respond within one month, which may be extended by two further months for complex requests. We may need to verify your identity. Requests are free unless manifestly unfounded or excessive.
You can also edit your details in Settings, disconnect banks and delete your account directly in the app.

11. Complaints

If you are unhappy with how we handle your data, please contact us first. You have the right to complain to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, ico.org.uk, telephone 0303 123 1113.

12. Security

We use encryption in transit (TLS) and at rest, encrypted bank tokens, row-level access controls so each account can only reach its own data, optional two-step verification and device app lock. We will notify you and the ICO of personal data breaches where required by law. No online service can be guaranteed completely secure.

13. Cookies and device storage

We use strictly necessary storage to keep you signed in and remember your preferences on your device. We do not use advertising or third-party tracking cookies.

14. Children

Marbeez is only for people aged 18 or over. We do not knowingly collect data from children.

15. Changes to this policy

We may update this policy. We will change the date below and tell you in the app about significant changes.