Privacy Policy

Account information

You sign in at web.mariwave.com through Cloudflare’s login, which confirms your email address either through your Google account or with a code sent to that address. We receive that email address and an identifier for your sign-in, and use them solely to create and maintain your account. Mariwave does not receive your Google password.

Content you create

Plans, ICP profiles, research briefs, market intelligence, campaign artifacts, and any other content you generate or upload through Mariwave. This is stored in Mariwave’s Postgres database, tied to your account.

Usage data

We log API requests, feature interactions, and error events for the purpose of operating and improving the service. Logs are retained for 90 days and are not associated with your content.

Connected Google accounts

You may connect one or more Google accounts. For each one we keep a separate grant: Google’s refresh token, encrypted, the account’s address, and the permissions you gave it. Only you can read your grants. Disconnecting an account revokes its grant at Google and then deletes our copy.

Mail, contacts and calendar

With the permissions you grant, Mariwave reads the Gmail, Google Contacts and Google Calendar of each connected account to show your inbox, your search results and your CRM views. Most of these reads are live and nothing from them is stored. We do store, visible only to you: one line for each email in your inbox (sender, subject, time, whether you have read it, and whether it was sorted as signal or noise); the tags and properties you add to an email thread; and a copy of your Google contacts (names, email addresses, phone numbers, organizations and notes). A contact you choose to add to your team’s CRM is copied there, where your team can see it.

PDF attachments

When you search your email, the text of PDF attachments in the results is read by a separate parsing service that we run on our own server. The attachment is deleted from that service once its text is read, and the text is not stored.

Gmail drafts and sending

If you grant the Gmail drafts permission (Google’s gmail.compose), Mariwave writes and edits drafts in your Gmail when you ask it to in chat. A draft lives in your Gmail; Mariwave keeps no copy of it outside your chat. Mariwave sends an email only when you confirm that send with Touch ID. A chat cannot send one on its own.

iMessage on the Mac app

If you set up the Mac app’s iMessage channel, the app reads the phone numbers and email addresses on your own Contacts card, and you confirm one by texting back a code the Mac sends to it. Your confirmed handles are kept in the app’s database on your Mac. A text reaches the app only when your Shortcuts automation hands it over with its sender; the app never reads your Messages history. A text from a handle you have not confirmed is dropped. A text from your own handle becomes a chat on your Mac, and the reply is sent back to you through Messages, with a long answer attached as a file. The app sends texts through the Messages app on your Mac, and withholds any reply that looks like it holds a secret.

Approvals by text

When an agent on your Mac asks to take an action and you are away from the Mac, the app may text your confirmed handle to ask for approval. The text names the action, the chat it is in, the agent’s reason, the names of what the action touches (a file path or a host, never a secret’s value), how dangerous the action is rated and, unless it is rated too dangerous to approve by text, a four-character code and a deadline. You answer YES or NO with the code; no answer means no. An action rated too dangerous to approve by text waits for you at the Mac. The record of the decision keeps the code and the handle that answered only as SHA-256 digests, never the handle itself. Before an approval is asked, a short description of the action is sent to web.mariwave.com, which asks TypeSafe to rate how dangerous it is.

Payment information

Billing is handled by our payment processor. We do not store full payment card numbers. We retain billing records (amount, date, plan) as required for accounting.

Google (optional connections)

If you connect a Google account, Google gives Mariwave only the permissions you choose: reading Gmail, Contacts or Calendar, and writing Gmail drafts. You can connect more than one Google account. Mariwave asks for no Google Drive access. Google is not Mariwave’s primary identity provider, and these permissions are requested separately after sign-in.

Email drafts written in chat

When you ask a chat to write or edit an email draft, what you ask for and the draft’s text pass through OpenRouter and the model provider you use there.

TypeSafe (classification)

To sort your inbox into signal and noise, Mariwave sends TypeSafe the sender, subject and a short preview of each new item no fixed rule has sorted: Gmail’s preview of an email, or the first 500 characters of a chat or agent message. When an agent on your Mac asks to take an action, web.mariwave.com sends TypeSafe a short description of that action so its Jev model can judge how dangerous the action is.

OpenRouter (AI inference)

Every model call Mariwave makes for chat, AI-assisted research, generation and the agent’s tools runs on, and is billed to, the OpenRouter key you connect. Mariwave holds no OpenRouter key of its own. Request content passes to OpenRouter and to the provider hosting the model it routes to. Review OpenRouter’s data processing terms at its website.

Cloudflare Workers AI (search embeddings)

To make your content searchable, Mariwave sends the text of records you save, and the text of your searches, to Cloudflare Workers AI on Mariwave’s Cloudflare account, which returns a list of numbers (an embedding) for each. The embeddings of your records are stored in Mariwave’s database.

Google Gemini (image generation)

When you ask a chat for a slide image, the chat’s model writes a description of the picture from your request, and that description is sent to Google’s Gemini API on Mariwave’s account to draw the background art. The finished image is stored with your media.

Brave Search (web research)

When the expert loop performs web research, queries are sent to Brave’s search API. Brave’s privacy policy applies to search query data.

Cloudflare (media storage, edge delivery and account email)

Media files (slide decks, generated images) are stored in Cloudflare R2. The emails about your account are sent from web.mariwave.com through Cloudflare Email Service. Cloudflare’s data processing terms apply to stored content.

Access and portability

You may request a copy of your data at any time. We will provide it in a machine-readable format within 30 days.

Correction

You may update your account information through the platform settings at any time.

Deletion

You may request deletion of your account and all associated content. We will process the deletion within 30 days.

Objection and restriction (EU/UK residents)

If you are located in the EU or UK, you have additional rights under the GDPR, including the right to object to certain processing and to lodge a complaint with your local data protection authority.

California residents (CCPA)

California residents have the right to know what personal information we collect, the right to delete it, and the right to opt out of its sale. We do not sell personal information.