Privacy policy

Your privacy matters to us. This policy explains what personal data Tarig Bouazzati, trading as MARL, Mons, Belgium (“MARL”, “we”, “us”) collects when you use this website, buy our products or take part in the creator programme, how we use it, and the choices you have.

1. Data we collect

• Order data: when you check out, our payment provider Stripe collects your name, email address, delivery address and payment details to process your order. We receive the order details; we never receive your full card number.
• Account data: your email address, the sign-in codes and order links we send you, and when they are used, so that you can reach My MARL without a password.
• Creator data: if you are a MARL creator, your name, handle, platform, public profile picture and email address, your acceptance of the Creator Agreement, the openings of your referral link, your earnings and payouts, and, if you add them, your bank details.
• Contact data: if you email us, we keep your message and contact details so we can respond.
• Technical data: our hosting provider keeps standard server logs, such as IP address and browser type, for security and to keep the site running.
• Usage data: on the store pages (Home, the Atelier and the order confirmation) we measure how the site is used: the pages opened, the steps taken in the Atelier and whether an order followed, with the creator link you arrived through. Until you allow cookies this is done without any cookie or stored identifier: our analytics provider turns your IP address and browser type into a code that changes every day and cannot be turned back into you. If you allow cookies, it also records how visits unfold on screen, with anything you type masked. We never use it on My MARL, the creator pages or Admin.

2. How we use your data

• To fulfil and deliver your orders and manage your subscription.
• To sign you in and keep your account secure.
• To provide customer support and honour our guarantee.
• To send service messages about your order or subscription, such as the order confirmation, dispatch and subscription changes.
• To pay creators and keep their earnings accurate.
• To improve our website, products and customer experience.

We send no marketing emails today. If that changes, we will ask for your consent first, and every such email will carry an unsubscribe link.

3. Legal bases

We process your data under the following legal bases: performance of a contract (fulfilling your order, or the Creator Agreement), legitimate interests (keeping the site secure, improving it and preventing fraud), consent (where we ask for it), and legal obligation (tax and accounting records).

4. Sharing your data

We never sell your personal data. We share it only with the service providers who make our store work, and only to the extent needed to provide their service: payment processing and checkout (Stripe), website hosting (Heroku), email delivery (Resend), the images and video on the site (Cloudinary), the lookup of a creator’s public profile picture when MARL welcomes them (Apify), usage measurement on the store pages (PostHog, hosted in the EU) and, only if you allow cookies, visit recordings (Microsoft Clarity), and the carriers who deliver your order. Each provider is bound by its own data-protection obligations.

5. Cookies

The site always sets the cookie that is strictly necessary for it to work: a session cookie that keeps you signed in, carries your checkout and remembers the creator link you arrived through, for the visit. On the store pages we also ask, once, whether you allow analytics cookies. If you answer, we keep your answer for 180 days in a cookie named marl_consent. If you allow them, PostHog and Microsoft Clarity set their own cookies to recognise your browser between visits and to record how visits unfold on screen; if you don’t, no analytics cookie is set and measurement stays cookieless as described above. We use no advertising or cross-site tracking cookies. You can change your answer at any time from Cookie settings at the bottom of the home page.

6. Creator links

If you reach MARL through a creator’s link, the link carries that creator’s code to the Atelier and the checkout. We record that the link was opened and when, and nothing about you. If you buy through it, the creator sees that a purchase happened and what it earned; they never see your name, email address or address.

7. Data retention

We keep order records for as long as required by tax and accounting law (typically six years in the UK), creator agreement and payout records for as long as the same law requires, and support correspondence for up to two years. Data that is no longer needed is securely deleted.

8. Your rights

You have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent at any time. To exercise any of these rights, email us at hello@marlcare.co.uk. You also have the right to lodge a complaint with the Information Commissioner’s Office.

9. Security

All traffic to this site is encrypted with TLS, payments are handled by Stripe (a PCI-DSS Level 1 certified provider), creators’ bank details are stored encrypted and shown masked, and access to customer data is limited to the people who need it to serve you.

10. Children

Our website and products are intended for adults. We do not knowingly collect personal data from children under 16. The creator programme is open only to people aged 18 or over.

11. Changes to this policy

We may update this policy from time to time. Material changes will be announced on this page with a new “last updated” date.

12. Contact

For any privacy question or request, contact us at hello@marlcare.co.uk.