Privacy policy

Marley provides automated employee birthday cards to employers. The employer is the controller of their employee data; Marley is a processor acting on the employer's instructions.

For each employee, an employer provides us with:

• First name
• Birth month and birth day (never the year)
• Work email
• Optionally, a cell phone number and a manager email
• Optionally, a start or anniversary date (with its year, so cards can say “5 years”)

We do not collect last names or birth years. Our database has no field for them. If an uploaded file contains extra columns, we read only the fields above and discard the rest.

Solely to send each employee a birthday card on the right day in the right language, to optionally notify their manager ahead of time, and to show the employer basic delivery statistics. We do not sell data and we do not use it for advertising.

Data is stored in Canada on Amazon Web Services (ca-central-1). Our subprocessors are Amazon Web Services (hosting and email delivery), Stripe (billing, which never receives your employee list), and Anthropic (card copy, which never receives employee data). Card copy is generated from your company name and language only, with the employee name merged in on our own servers.

Separately from employee data, we record basic first-party usage events for our own website and product — which pages are visited, and account milestones like signing up, signing in, and adding employees — so we can see what's working and fix what isn't. This uses a single first-party cookie to recognize repeat visits; we do not use third-party analytics or advertising cookies, and these events never contain page query strings, names, or message content.

We keep employee records for as long as the employer's account is active. Deleting an employee removes that person and their card history immediately and permanently. When an account is closed, all of its data is purged within 30 days. Any employee can opt out of future cards from a one-click link in every card, with no login required.

Employees can exercise access, correction, and deletion rights through their employer, who controls the data, or by contacting us at the address below and we will route the request. Under Canada's PIPEDA, a breach creating a real risk of significant harm is reported to affected individuals and to the Office of the Privacy Commissioner of Canada.

Employers who need a signed DPA can request one. A downloadable DPA will be linked here once finalized.

Questions about privacy? Write to [email protected].