Marhalh (“Marhalh”, “we”) is a platform for creative studios to manage projects, freelancers, contracts and payments. This policy explains what data we collect and how we use and protect it.

• Account data: name, email, phone number and organization name.
• Work data you enter: projects, tasks, contracts, invoices and files.
• Technical data: IP address, browser type and usage logs for security and diagnostics.

An organization owner may optionally connect a Google Drive account so project files are stored in their own Drive instead of ours.

• Scope requested: only https://www.googleapis.com/auth/drive.file, which gives Marhalh access solely to files and folders that Marhalh itself creates. We cannot read, list or modify any of your other Drive content.
• What we do with it: we create a Marhala/<project>/ folder and upload project files, deliverables and receipts to it, and show them to authorized project members inside Marhalh.
• What we store: an encrypted access token used only for these operations, plus file identifiers and metadata (name, size, type). File contents stay in Drive; we do not keep a copy after transfer.
• Sharing: we do not sell Google user data, share it with third parties, use it for advertising, or use it to train AI or machine-learning models.
• Revoking access: the owner can disconnect at any time from the integration settings, or revoke Marhalh at myaccount.google.com/permissions. On disconnect we delete the stored tokens; we never delete Drive files we did not create.

Marhalh’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

To operate and provide the service, send notifications, secure accounts and prevent abuse, and meet legal obligations. We do not sell your data.

We use providers for infrastructure hosting (Amazon Web Services), email delivery and product analytics. They process data on our behalf under confidentiality and security obligations. We may disclose data where legally required.

Data is encrypted in transit, integration tokens are encrypted at rest, and access is limited by role and project membership. We keep data while your account is active and delete or anonymize it within a reasonable period after closure, except where retention is legally required.

You may request access to, correction or deletion of your data, or object to its processing, by emailing privacy@marhalh.com.

We may update this policy; the date above shows the latest revision and we will notify you of material changes.