Privacy Policy
Last updated: 8 October 2026
This Privacy Notice for Marmot Data Ltd ("we", "us", or "our") describes how and why we collect, store, use, and share your personal information when you use our website at marmotdata.io, use Marmot Cloud at cloud.marmotdata.io, or engage with us in other related ways, including marketing communications.
Questions or concerns? Contact us at [email protected].
1. What information do we collect?
We collect personal information that you provide to us and, when you use Marmot Cloud, information about how you use it. We do not use analytics, advertising cookies, or any form of cross-site tracking. The information we collect depends on how you interact with us:
| How you interact with us | Data collected |
|---|---|
| Marmot Cloud account | Name, email address, sign-in identifiers, and your role and phone number if you give them |
| Your organisation and billing | Company name, size, country, billing address, VAT number, and website. Payment card details are collected by Stripe and we never see your full card number. |
| Using Marmot Cloud | Which version of our Terms you accepted, when, and the IP address and browser you accepted from, your email preferences and marketing consent, when you last used the console, and the instances and usage on your account |
| Team invitations | The email address of the person invited, and who invited them |
| Security logs | IP address, browser information, and the time of each request to Marmot Cloud |
| Emails to us | Name, email address, message content |
| Cloud waitlist (now closed) | Email address, marketing preference |
Marmot Cloud uses only the cookies and browser storage that are strictly necessary to keep you signed in and to protect the service. The marmotdata.io website does not set cookies.
We do not collect sensitive personal information, and we do not collect any information about you from third parties, other than payment status from Stripe.
Data in your catalog. The metadata and other data your organisation puts into a Marmot Cloud instance is processed by us on your organisation's behalf, under our Data Processing Agreement. Your organisation decides how that data is used, and this notice does not cover it.
2. How and why do we process your information?
We process your personal information for the following purposes:
- To provide Marmot Cloud — creating and managing your account and organisation, running your instances, taking payment, and recording your acceptance of our Terms.
- To send service emails — such as sign-in codes, invitations, billing receipts, trial reminders, and security notices. These are part of the service and you cannot opt out of them while you have an account.
- To keep Marmot Cloud secure — preventing abuse, fraud, and unauthorised access.
- To respond to enquiries — replying to messages you send us.
- To send product updates — news about changes to Marmot Cloud, sent to account holders. You can turn these off at any time from your account page or by clicking the unsubscribe link in any email.
- To send marketing — only if you have given us explicit consent by ticking the marketing checkbox. You can opt out at any time by clicking the unsubscribe link in any email, from your account page, or by contacting us.
3. What legal bases do we rely on?
Under the UK GDPR and EU GDPR, we rely on the following legal bases:
- Contract — for providing Marmot Cloud, managing your account, billing, and sending service emails.
- Consent — for sending marketing and promotional communications. You can withdraw your consent at any time.
- Legitimate interests — for keeping Marmot Cloud secure, sending product updates to account holders, and responding to enquiries you have sent us. These interests do not outweigh your rights and freedoms given the limited data involved and your reasonable expectations when using our services.
- Legal obligations — where necessary for compliance with applicable law, such as keeping tax and accounting records.
4. Who processes your data?
We share your personal information with the following service providers who act as data processors on our behalf:
| Provider | Purpose | Location |
|---|---|---|
| Google Cloud | Hosting Marmot Cloud and its databases | United Kingdom |
| Cloudflare | Website and console traffic, DNS, and protection against attacks | Global network; Ireland (EU) |
| Resend | Email delivery and contact list management | United States |
Stripe processes your payments as an independent controller under its own privacy policy. On marmotdata.io, search is provided by Algolia, which receives your search terms, and blog comments are provided by GitHub through giscus, under GitHub's own privacy policy if you choose to comment.
We do not sell, rent, or share your personal information with any third party for their own marketing purposes. If you are a member of an organisation on Marmot Cloud, other members of that organisation can see your name and email address. We may transfer your information in connection with a merger or acquisition of our business.
5. International transfers
Marmot Cloud is hosted in the United Kingdom. Your data is processed by Cloudflare on its global network, and stored by Resend in the United States for email delivery and contact list management.
Where data is transferred outside the UK or EEA, we rely on the European Commission's Standard Contractual Clauses (SCCs) and the UK's International Data Transfer Agreement to ensure your personal information receives an adequate level of protection.
6. How long do we keep your information?
- Marmot Cloud accounts — retained while your account is open. When you delete your account, we delete your personal information promptly, apart from the records below.
- Billing records — retained for six years after the end of the financial year they relate to, as UK tax law requires.
- Security logs — retained for a short period and then deleted.
- Waitlist contacts — retained until the product launches or for up to 12 months, whichever is sooner, then removed.
- Newsletter subscribers — retained until you unsubscribe.
- Emails to us — retained for as long as needed to deal with your enquiry.
When we have no ongoing legitimate business need to process your personal information, we will delete or anonymise it.
7. How do we keep your information safe?
We have implemented appropriate technical and organisational security measures, including encrypted connections (TLS), encryption at rest, access controls, and UK-region data storage. However, no electronic transmission over the internet can be guaranteed to be 100% secure. Our security page has more detail.
8. Children
We do not knowingly collect data from or market to anyone under 18 years of age. If we learn that we have collected personal information from a child, we will promptly delete it. Please contact us at [email protected] if you believe we have inadvertently collected such data.
9. Your rights
Depending on your location, you may have the following rights under applicable data protection laws (including UK GDPR, EU GDPR, CCPA, and other regional laws):
- Access — request a copy of the personal information we hold about you.
- Rectification — request correction of inaccurate data.
- Erasure — request deletion of your personal information.
- Restriction — request that we limit how we use your data.
- Portability — receive your data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interests.
- Withdraw consent — where we rely on consent (e.g. marketing), you can withdraw it at any time without affecting the lawfulness of prior processing.
You can update your details, change your email preferences, and delete your account yourself from your account page in Marmot Cloud. To exercise any of these rights, email us at [email protected]. We will respond within one month (or sooner where required by law).
We do not sell your personal data, do not engage in targeted advertising, and do not profile users. US residents have the right to non-discrimination for exercising their privacy rights.
If you believe we are unlawfully processing your personal information, you have the right to lodge a complaint with your local data protection authority. In the UK, this is the Information Commissioner's Office (ICO).
10. Updates to this notice
We may update this Privacy Notice from time to time. The updated version will be indicated by a revised "Last updated" date at the top of this page. If we make material changes, we will notify you by prominently posting a notice on our website and, if you have a Marmot Cloud account, by email.
11. Contact us
If you have any questions about this Privacy Notice or wish to exercise your rights, contact us at:
Marmot Data Ltd
Company number 17420684
66 Paul Street, London, EC2A 4NA, United Kingdom
Email: [email protected]