Data controller
Fabien Deshais, 231 rue Saint-Honoré, 75001 Paris, France. Contact: hello@marginward.com.
Data we process
Account: your email address and an account identifier.
Billing: handled by Stripe. We never store your card numbers.
Data you import through your connections: identifiers of your own customers (email, name, recurring revenue) read read-only from Stripe, and technical identifiers (user_id) plus LLM costs from Langfuse or the ingestion API.
Third-party access keys you provide are encrypted at rest (AES-256-GCM) and are never displayed or exported.
Free tools: if you submit your email to receive a result or guide, we store that email, your consent and the time it was given.
Purposes and legal bases
Providing the service (per-customer margin): performance of the contract.
Subscription billing: performance of the contract and legal accounting obligations.
Email alerts and digests: performance of the contract (configurable in settings).
Sending content you requested through our free tools (and occasional related follow-ups): your consent, which you can withdraw at any time via the unsubscribe link in every email.
Security and abuse prevention: legitimate interest.
Anonymous site audience measurement (no cookies, no profiling): legitimate interest.
Processors and recipients
Your data is processed by the following processors, each within the necessary scope:
Supabase (Supabase Inc.) — database and authentication, hosted in the European Union.
Vercel (Vercel Inc., United States) — application hosting and cookieless audience measurement (Vercel Web Analytics).
Stripe (Stripe Payments Europe) — subscription billing and read-only access to your billing data.
Resend (Resend Inc., United States) — transactional emails (alerts, digests).
Langfuse — read-only access to your LLM costs when you connect that source.
OpenRouter — read-only access to your LLM costs aggregated by model when you connect that source.
Sentry (Functional Software Inc.) — error monitoring, only when enabled.
Transfers outside the European Union
Some processors (Vercel, Resend, Sentry) are based in the United States. Transfers are governed by the European Commission's Standard Contractual Clauses.
Retention
Data is kept while your account is active. Usage history is limited by your plan (30 days, 365 days, or unlimited).
When you delete your account, all data is erased — except billing and invoice records, which are kept for the legally required period (10 years for accounting documents).
Emails collected through our free tools are kept for up to 3 years after the last contact, then deleted. You can unsubscribe at any time via the link in every email.
Your rights
You have the right to access, rectify, erase, port, restrict and object.
You can export all your data (JSON) and permanently delete your account directly from settings. For any other request, contact us.
You may lodge a complaint with the French data protection authority (CNIL, cnil.fr).
Security
Third-party keys encrypted at rest, per-account data isolation at the database level (Row-Level Security), HTTPS and strict security headers.