Your AI co-founder

Draft — to be reviewed before launch.

Privacy Policy

Last updated: October 18, 2026

This policy explains what personal data Marpitch collects when you use it, why we need it, who helps us process it, and how you stay in control. In short: we collect what the service needs, we never sell it, and you can export or delete it at any time.

1. Who we are

Marpitch is operated by [Legal entity name], [Registered address], the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number [KvK number] (“Marpitch”, “we”, “us”). We are the controller of the personal data described in this policy.

For any privacy question or request, write to [Contact email: privacy@marpitch.com].

2. What we collect

We only collect what we need to run Marpitch for you:

  • Account data: your email address and your name.
  • Conversation messages: what you write to Morphi and what Morphi answers.
  • Uploaded files: documents and other files you add to a conversation.
  • Business data: the facts in your Business Brain and their versions, your missions and contracts, and the documents written from them.
  • Mission evidence: the numbers and quotes you approve when you tell Morphi what happened in a test.
  • Billing data (when you subscribe): your plan, its status and dates, and the references Stripe gives your customer record and subscription. Your card details go to Stripe directly; we never see or store them.
  • AI usage logs: which AI model was used, the number of tokens, the cost and the time of each request. These logs do not contain the content of your conversations beyond what is already stored as messages.
  • Voice input (only when voice is enabled): your recording is sent for transcription and the text is stored as a message. The recording itself is not stored.
  • Technical data: the session cookie described below and standard server logs (such as IP address, browser type and time of request) that keep the service secure. Server logs are kept for [Log retention period].

Your business data may include information about other people, such as the names or words of your customers. Please add only what you are allowed to share and what the test needs. For that data, you decide what goes in, and we process it on your behalf to provide the service.

3. How we use your data and why

  • To provide Marpitch — your account, conversations with Morphi, your Business Brain, missions and documents. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
  • To send service emails — sign-in codes and important messages about your account. Legal basis: performance of our contract.
  • To keep the service secure and working — preventing abuse, fixing errors and keeping AI costs under control. Legal basis: our legitimate interest in a safe, reliable service (Art. 6(1)(f) GDPR).
  • To meet legal obligations — for example keeping billing and tax records once paid plans start. Legal basis: legal obligation (Art. 6(1)(c) GDPR).

We do not sell your data. We do not show ads, and we do not use tracking or advertising cookies. We will not send you marketing emails unless you ask for them.

4. How AI is used

To answer you, Marpitch sends the relevant parts of your conversation and business data to our AI model provider, Anthropic. Under Anthropic’s commercial terms, prompts sent through its service are not used to train its models. We do not use your content to train AI models either.

AI output can be wrong. Morphi proposes; you decide. Nothing is added to your Business Brain without your approval, and a mission’s verdict (met, not met or unknown) is computed by the rule in the contract you signed, not by the AI. Marpitch does not make decisions about you that have legal or similarly significant effects.

5. Who processes your data for us

We use a small number of service providers (processors), each bound by a data processing agreement:

  • [Hosting provider, EU region] — hosts the application and database. All stored data lives in the EU.
  • Anthropic — AI model provider. Receives the conversation content needed to generate each answer.
  • Resend — email delivery. Receives your email address and the content of service emails.
  • OpenAI — voice transcription, only when voice is enabled. Receives your recording to turn it into text.
  • Stripe (Stripe Payments Europe, Limited, Ireland) — payments, invoices and VAT. Receives your name, email address, billing address, VAT number if you give one, and your payment details. For fraud prevention and its own legal duties Stripe also acts as an independent controller under its own privacy policy.

6. International transfers

Some processors (Anthropic, Resend, OpenAI and Stripe) may process data outside the European Economic Area, for example in the United States. Where that happens, we rely on an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework, where the provider is certified) or on the European Commission’s Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.

7. How long we keep your data

  • We keep your data for as long as you have an account.
  • When you delete your account, we delete your data within 30 days. Backups rotate within the same 30-day window.
  • Voice recordings are not stored; only the transcript is kept, as a message.
  • Records we must keep by law, such as invoices and payment records, are kept only for the period the law requires and only for that purpose: in the Netherlands, 7 years for tax records. Deleting your account does not delete them; they stay with Stripe and in our accounts.

8. Exporting your data

You can export your data at any time from your Account page, in a common, machine-readable format.

9. Cookies and local storage

Marpitch uses only what it needs to work:

  • mp_session — a strictly necessary cookie that keeps you signed in. It is not readable by scripts on the page and expires after 30 days without use, or when you sign out.
  • Theme preference — if you choose light or dark mode, the choice is saved in your browser’s local storage. It never leaves your device.

There are no analytics, tracking or advertising cookies, so there is nothing to accept or reject in a cookie banner.

10. Security

Data is encrypted in transit (HTTPS). Access to production data is limited to the people who need it to run the service. No system is perfectly secure; if a breach affects your personal data, we will tell you and the supervisory authority as the law requires.

11. Your rights

Under the GDPR you have the right to:

  • Access the personal data we hold about you.
  • Rectification — have inaccurate data corrected.
  • Erasure — have your data deleted. Deleting your account does this.
  • Portability — receive your data in a machine-readable format. The export on your Account page does this.
  • Restriction — ask us to limit how we use your data.
  • Objection — object to processing based on our legitimate interests.
  • Complaint — lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work, or in the Netherlands with the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority, autoriteitpersoonsgegevens.nl).

To use any of these rights, write to [Contact email: privacy@marpitch.com]. We answer within one month. We may ask you to confirm your identity first.

12. Age

Marpitch is for founders aged 18 and over. We do not knowingly collect data from children.

13. Changes to this policy

If we change this policy in a way that matters, we will tell you by email or in the product before the change takes effect. The date at the top shows when it was last updated.

14. Contact

[Legal entity name], [Registered address], the Netherlands. KvK [KvK number]. Email: [Contact email: privacy@marpitch.com].