Privacy policy.

heymarta.ai (“Marta”, “we”, “us”) is the data controller for the personal data described in this policy. That means we are the ones who decide what is collected and why, and we are the ones answerable for it.

We operate from the United Kingdom, so the UK GDPR and the Data Protection Act 2018 apply to what we do. Where we serve people in the European Economic Area, the EU GDPR applies as well.

The way to reach us about anything in this policy is hello@heymarta.ai. We are small enough that this is a person rather than a queue. We have not appointed a Data Protection Officer, because at our size the law does not require one; the same address reaches whoever is responsible.

Our full registered company name, company number and postal address will be published in this section. Until they are, hello@heymarta.ai is the contact of record for every request described here, and no request will be turned away for arriving at that address.

Each block below is one thing the service actually does. “Legal basis” is the specific reason UK and EU law lets us do it, and it matters, because your rights change depending on which basis we are relying on.

This one deserves its own section rather than a line in a table, because most people would not guess it.

When you upload a reference image, it is stored with our file storage provider. The generation step is a different company’s computer, and it has to be able to fetch your image over the web to work from it, so we hand it a temporary web address for that file. The address expires within a day of being issued. While it is live, anyone holding that exact address could open the image without signing in; it is not listed anywhere, not searchable, and we do not share it with anyone except the generation step that needs it.

We used to issue permanent addresses that never expired. We do not any more, and that is the honest reason this section exists rather than a claim that nothing is ever reachable.

So please keep that in mind before uploading anything you would mind a stranger seeing, and please do not upload photographs of other people unless they are happy for you to. If your references include recognisable people, you are the one deciding to use their images, and we handle them on your instructions.

Staying signed in. Session cookies from our authentication provider keep you logged in as you move around. They are strictly necessary to deliver a service you asked for, so the law does not require us to ask permission for them, and they are not used to track you.

Your answer to the banner. We store your consent decision and the time you made it in your browser’s local storage. It is how the banner knows not to ask again, and how we can show we asked.

Analytics and advertising. Nothing is loaded, set, or sent before you answer. Decline and none of it ever arrives. Accept and the analytics and advertising tools described in section 2 start, and they set their own cookies and local storage.

Changing your mind. Use the “Cookie choices” link at the bottom of any page. Withdrawing is one click, it takes effect at once, and it clears the analytics identifiers out of your browser. Withdrawing is as easy as giving, which is the whole point.

We do not run all of this ourselves. These companies process personal data on our behalf and on our instructions, each under a data processing agreement, and each only for the part of the service it provides:

• Vercel, hosting, content delivery and request logs.
• Supabase, authentication, the database, and file storage for your uploads. The email that confirms your address is sent by Supabase’s own mail service, so there is no separate email company in the picture.
• Stripe, payments, refunds and disputes.
• Sentry, error monitoring. Because ad blockers block error monitoring domains by default, these reports are routed through an address on heymarta.ai on their way out. The destination is the same, and the stripping described in section 2 happens before they leave.
• PostHog, product analytics, only after you accept.
• Meta and TikTok, advertising measurement, only after you accept.
• Our generation infrastructure provider, and the model providers it routes work to, which turn your prompts, brand URLs and reference images into finished images, video and voice.

On that last one, we owe you an explanation. We do not name the individual generation and model providers on this page, because the specific mix is part of how Marta is built and it changes as models improve. That is not a way of hiding them from you. Email hello@heymarta.ai and we will send you the current named list of every provider that touches your prompts, reference images and generated assets, and where each one processes them. We keep that list up to date. Everything else about this processing, the categories of data, the purpose, the transfers and the safeguards, is set out in full on this page.

We do not sell your data, we do not share it with data brokers, and we do not use your work to train models of our own.

Marta is run from the United Kingdom, but the companies that keep her running are not all here. Vercel, Supabase, Stripe, Sentry, PostHog, Meta, TikTok and our generation providers are all based outside the UK, and several of them are US companies. Some of them contract through European entities, but your data is stored or accessed outside the UK and the EEA either way, and you should assume that includes the United States.

UK and EU law does not treat the United States as automatically safe, so each of those transfers needs its own legal protection. For every provider above, we rely on the UK International Data Transfer Addendum and the European Commission’s Standard Contractual Clauses, which form part of that provider’s data processing terms. Where a provider is certified under the EU-US Data Privacy Framework and its UK extension, we may rely on that instead.

Alongside the paperwork there are the technical measures described in this policy: everything travels encrypted, error reports have identifiers stripped out before they are sent, and each provider gets only the data its part of the job needs.

If you want to see the transfer terms we rely on for any specific provider, ask at hello@heymarta.ai and we will send them.

We will be straight with you about this: Marta does not yet have a self-serve delete button. Deletion is started by a person, by hand, when you ask for it, and we do it within one month. What that person runs is a single tool that clears everything below in one pass, rather than a memory and a to-do list.

• Account, profile, prompts, reference images, generated assets and job records: kept while your account is open, then deleted when you ask us to close it. Your uploaded files are deleted outright. We keep the bare record that a generation happened and what it cost, with everything describing it or pointing at it removed, because that is part of the payment record below.
• Payment and credit records: at least six years, because UK tax law requires it. We cannot delete these on request, and if you ask us to erase everything else, these stay. So that they still add up, a stripped-down account record stays with them: an internal reference number and nothing else. Your email address is removed from it and your sign-in is closed for good.
• Signup IP records: deleted automatically after seven days. The rate limit itself only ever looks at the past hour; the rest of that week is so we can recognise a wave of fake signups after the fact. These records are not attached to your account — an address on its own does not identify which signup was yours — so we cannot pick yours out on request, which is exactly why they now expire on their own.
• Device pairing records: the pairing expires ten minutes after you start it, and the record is deleted outright the moment your tool collects its key. Anything left unclaimed is swept automatically.
• Rate-limit counters: expire after an hour and are swept the same way. The sweep runs twice a day, so neither these nor unclaimed pairing records last more than about a day past expiry.
• Duplicate-charge records: deleted automatically after 30 days.
• Waitlist email: until you unsubscribe or ask us to remove you.
• Error reports and hosting logs: on the short retention windows set by those providers, then gone.
• Analytics events: collection stops the moment you withdraw consent; events already recorded are deleted on request.

We do not make decisions about you by solely automated means that produce legal effects or similarly significantly affect you, and we do not profile you.

We do run some automatic checks, and it is only fair you know what they are: a limit on how many accounts can be created from one internet connection in an hour, a blocklist of throwaway email domains at signup, and a cap on how many credits one account can spend in a day. These can stop a signup or pause spending.

If one of them catches you and it is wrong, email hello@heymarta.ai and a person will look at it and put it right.

Under UK and EU data protection law you have all of the following. One email to hello@heymarta.ai starts any of them.

• Access. Ask what we hold about you and get a copy of it.
• Rectification. Have anything inaccurate corrected, or anything incomplete filled in.
• Erasure. Have your data deleted. We will do it, with the one exception of the payment and credit records we are legally required to keep, and we will tell you exactly what stayed.
• Restriction. Tell us to keep your data but stop doing anything with it while a dispute or a correction is sorted out.
• Portability. Get the data you gave us in a structured, machine-readable format, or have us send it to someone else. This covers what we hold on the basis of your consent or our contract with you.
• Objection. Object to anything we do on the basis of legitimate interests, which is the abuse controls, the error monitoring and the hosting logs. We stop unless we can show compelling grounds that override your rights. For direct marketing, there is no argument: you object, we stop.
• Withdraw consent. At any time, for analytics, advertising and waitlist emails, and just as easily as you gave it. Withdrawing does not make what we did beforehand unlawful, it just stops it going forward.
• Not be subject to solely automated decisions that significantly affect you. As explained in section 8, we do not make any.

These are free. We answer within one month, and if a request is genuinely complex we may take up to two months more, in which case we will tell you why inside the first month. We may need to check it is really you before we send personal data anywhere.

Where we got your data. Almost all of it comes from you. The exceptions: if you sign in with Google, your email address and basic profile come from Google, and when you buy credits, Stripe tells us that the payment succeeded and gives us the reference for it.

Do you have to give it to us? The account and payment data is needed to have an account and to buy credits; without it we cannot provide the service. Everything gated behind the consent banner is genuinely optional, and saying no costs you nothing.

If you think we have got something wrong, please tell us first at hello@heymarta.ai. We would much rather fix it directly than have you hear about it from a regulator.

You also have the right to complain to the Information Commissioner’s Office, the UK data protection regulator, and you do not have to come to us first.

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Helpline 0303 123 1113. ico.org.uk

If you live in the EEA, you can complain to the supervisory authority in your own country instead.

Marta is a tool for people running a business, and is not intended for anyone under 18. We do not knowingly collect personal data about children. If you believe a child has created an account, email hello@heymarta.ai and we will remove it.

Everything travels encrypted. Passwords are hashed by our authentication provider and never stored in a readable form. API keys are stored as one-way hashes, so we cannot read yours back to you. The one moment a key exists in readable form is while you are pairing Marta with a tool on your own machine: it is held only until that tool collects it, and the record is deleted the instant it does. Card details never touch our servers. Database access is restricted so one account cannot reach another account’s rows.

The one exception you should know about is upload links, which we describe in section 3. We would rather name it here than let it sit unmentioned under a sentence about how seriously we take security.

If this policy changes in a way that matters, we will update the date at the top and say what changed. Continued use after a change means the new version applies.