Privacy Policy

Who is responsible

Marquete, based in Paris, France, is the data controller for the information described here. For any privacy request, write to bonjour@marquete.fr.

What we collect

Account data: name, work email, workspace name, city and password (stored hashed, never in readable form).

Business data you enter: brand or store profile, categories, terms, product catalogue, stock levels, orders, messages and sales representative records.

Technical data: log entries, approximate location derived from IP, and basic usage events needed to keep the service secure and working.

Why we use it

To provide the platform: accounts, discovery, ordering, stock, messaging and analytics (performance of a contract).

To send transactional and notification emails you have turned on, such as order updates, low stock alerts and digests (legitimate interest, with per-type toggles in Settings).

To bill subscriptions and prevent fraud (contract and legal obligation).

AI features summarise your own workspace data to produce briefs, matches and drafts. Your catalogue and orders are not used to train third-party models.

Who sees what

Stores and brands only see each other's business information when there is a reason to: a public or shared brand page, an order between them, or a match you have chosen to act on. Private drafts and unlisted storefronts stay hidden.

We use processors for hosting, database, email delivery and payments. They act on our instructions and are bound by contract.

How long we keep it

Account and business data for as long as your workspace is open, then up to 30 days before deletion. Invoices and order records are kept for the period French accounting law requires.

Your rights

Under the GDPR you can access, correct, export, restrict or delete your data, and object to processing based on legitimate interest. Email bonjour@marquete.fr and we will respond within one month. You can also complain to the CNIL.

Transfers and security

Data is stored in the European Union. Where a processor operates outside the EU, transfers rely on standard contractual clauses. Access is restricted, encrypted in transit, and row-level security keeps each workspace's data separated at the database itself.