We keep the least data that does the job.

For each employee we store only their first name, birth month, birth day, and work email. A cell phone and a manager email are optional. That is the whole record.

• We do not store last names.
• We do not store birth years, or any full date of birth.
• These are not policy promises. Our database has no column for a last name or a birth year, so there is nowhere for that data to go. It is enforced by the schema itself.

If you upload a spreadsheet that happens to include last names, salaries, or full dates of birth, our importer reads only the columns it recognizes and discards the rest. A date of birth is reduced to a month and a day at the moment of import. The year is never written to our database and never written to our logs.

Every connection to Marley is served over HTTPS, with HSTS instructing browsers to refuse an unencrypted connection. Optional cell phone numbers are additionally encrypted at the application level using AES-256-GCM before they are stored, so they are ciphertext in the database.

Marley runs on Amazon Web Services in the Canada Central region (ca-central-1). Your employee data is processed and stored in Canada.

We use a large language model to write warm, natural card copy in your team's languages. It never receives employee data. When we generate a card message we send only the language, the tone, the occasion, and your company's display name, and we ask for a template with a placeholder where a name belongs. The real first name is merged into the template on our own servers, at send time. No employee first name, email, phone number, or birthday is ever sent to the model.

We rely on a short list of trusted providers to run the service:

• Amazon Web Services (Canada) for hosting and database.
• Amazon Simple Email Service for delivering the cards.
• Stripe for billing. Stripe never receives your employee list.
• Anthropic for generating card copy, which, as above, never receives employee data.

When you delete an employee, we remove that person and their entire card history immediately and permanently. There is no soft delete and no archive copy. Any employee can also opt out of future cards from a one-click link in the footer of every card, with no login required, and that takes effect right away.

When an account is closed, all of its data is scheduled for permanent deletion and purged within 30 days.

If you have a security question, or believe you have found a vulnerability, please write to [email protected]. We read every message and aim to respond quickly.