Privacy Policy

Maralito Labs is the controller of personal data described in this notice. For privacy questions or to exercise your rights, contact hello@maralitolabs.com.

• Enquiry and correspondence data — name, email address, company, project details, budget and timeline choices, and messages sent to us.
• Booking data — information provided to Cal.com when booking; Cal.com also processes it under its own notice.
• Direct-purchase and delivery data — email address, product, order and payment-reference identifiers, amount and currency, payment and fulfilment status, and delivery events. Stripe processes payment credentials and payment information under its own privacy notice; we do not receive or store full card details.
• Technical and analytics data — IP address, browser and device information, pages viewed, approximate location from IP, and interaction events. Hosting providers collect limited technical logs for security. Google Tag Manager and Google Analytics receive analytics data only if you opt in.
• Cookie-choice data — an analytics choice stored locally on your device so we can remember it.

Please do not send special-category, confidential, or unnecessary personal data through the Site. We do not knowingly seek data from children under 16.

• Answer enquiries and consider an engagement — legitimate interests in running our business and, where relevant, steps before entering a contract.
• Process direct purchases and provide downloads — performance of the purchase contract and our legitimate interests in preventing fraud and supporting customers.
• Operate, secure, and improve the Site — legitimate interests in security, fraud prevention, reliability, and improving services.
• Optional analytics — consent. You may withdraw it through Cookie settings.
• Meet legal, accounting and tax obligations and manage claims — legal obligation and legitimate interests in establishing, exercising, or defending legal claims.

We use essential local storage to remember your cookie choice. We do not load Google Tag Manager or Google Analytics unless you actively select “Accept analytics”. If you accept, Google may set or access cookies and process analytics data. You can reject analytics without losing access to the Site and can change your choice at any time through Cookie settings in the footer.

We use processors to run the business, including Vercel for hosting, logs and download delivery, Stripe for direct-payment processing, Neon for order records, Resend for transactional order emails, Google for consented analytics, Cal.com for bookings, and our email provider for correspondence. We may disclose data to professional advisers, insurers, regulators, or authorities where required or reasonably necessary to protect our rights.

Some providers may process data outside the UK. Where required, we use an adequacy regulation or appropriate safeguards, such as the UK International Data Transfer Agreement or UK Addendum to EU Standard Contractual Clauses. You may ask us for information about the safeguards.

We keep enquiry and correspondence data for up to 24 months after our last meaningful contact, unless a longer period is needed for a legal claim, contract, or legal obligation. We retain direct-purchase and fulfilment records for the period required by applicable accounting, tax, consumer-protection, and legal-claims requirements. Hosting logs are typically kept for up to 30 days. Analytics retention is controlled in Google Analytics settings. We delete or anonymise data when no longer needed.

Subject to applicable law, you can request access, correction, erasure, restriction, data portability, or object to processing based on legitimate interests. You can withdraw analytics consent at any time. The right to object to direct marketing is absolute; we do not currently send marketing emails unless you separately choose to receive them.

Email hello@maralitolabs.com to exercise a right. We normally respond within one month. You can complain to the Information Commissioner’s Office.

We do not make solely automated decisions that produce legal or similarly significant effects using Site data. We may update this notice for legal or operational changes; the date above identifies the current version.