Privacy Policy
Effective October 15, 2026
This policy explains what personal data Marcaj collects, why, how long it is kept and what rights you have. We collect what is needed to run your account and the labeling work, we do not sell personal data, and we use no advertising or analytics trackers.
1. Who is responsible
The controller of personal data processed through Marcaj is „MARCAJ” S.R.L., str. Grădina Botanică 14, bl. 3, of. 307, MD-2032, sect. Botanica, mun. Chișinău, Republica Moldova, IDNO 1026023147217. For any privacy question or request, write to emirza@marcaj.com.
Data inside projects. Files that customers upload for labeling may themselves contain personal data, such as people in photos. For that data the customer organization is the controller and we process it only on its instructions, as its processor. Requests about it should go to the organization that owns the project; we will pass on any we receive.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account data | First and last name, email address, country, password (stored only as a hash), interface language, notification preferences | You, at registration and in your profile |
| Google sign-in data | Google account identifier, email address and name | Google, only if you choose to sign in with Google |
| Organization data | Organization and team memberships, your role, invitations | Organization administrators and you |
| Work data | Annotations you create, review remarks and comments, @-mentions, task history, review outcomes | Your use of the platform |
| Activity data | Active time spent on tasks (measured while the editor is open and you are working), audit log of changes you make | Generated automatically |
| Technical data | IP address, browser type, request logs, page performance measurements (load timings per page template, without page content) | Your browser and our servers |
| Communications | Messages you send us; delivery status of emails we send you | You and our email provider |
Activity and work data are visible to the managers and administrators of the organization in which the work was done — that is how they review quality and productivity.
3. Why we use it and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and running your account, signing you in, letting you work in organizations and projects | Performance of a contract — Art. 6(1)(b) |
| Sending service emails: address confirmation, invitations, notifications you have not turned off | Performance of a contract — Art. 6(1)(b) |
| Showing organizations the time spent and review results of their members' work | Legitimate interests of the organization in managing its projects — Art. 6(1)(f) |
| Protecting the platform: rate limiting, detecting abuse, keeping an audit log | Legitimate interests in security and accountability — Art. 6(1)(f) |
| Measuring and improving performance | Legitimate interests in a working service — Art. 6(1)(f) |
| Complying with legal obligations and responding to lawful requests | Legal obligation — Art. 6(1)(c) |
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. We do not sell personal data or use it for advertising.
4. Who we share it with
We share personal data only with the service providers we need to run the platform, under contracts that oblige them to protect it:
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Server hosting and storage | Germany (EU) |
| Resend, Inc. | Delivery of service emails | United States |
| Google LLC | Sign-in with Google, only if you use it | United States |
Inside the platform, your name, email and work are visible to the other members of the organizations you belong to, to the extent their role allows. We may also disclose data where required by law or to protect rights and safety.
5. International transfers
Our servers are in the European Union. Where a provider processes data outside the EEA, we rely on an adequacy decision (including the EU–US Data Privacy Framework where the provider is certified) or the European Commission's Standard Contractual Clauses.
6. How long we keep it
- Account data — for as long as your account exists.
- When you delete your account — it is deactivated at once, your sessions are revoked, your password and Google link are removed, and your name and email are replaced with placeholders. Your previous email address is kept in the audit log to investigate abuse and handle disputes.
- Work and activity data — for as long as the project exists. They belong to the organization's project; after your account is deleted they remain attributed to a deleted user.
- Projects and their files — until the organization deletes the project or the organization.
- Performance measurements — 30 days.
- Audit log — for as long as needed for security and accountability.
7. Your rights
Under the GDPR and similar laws you have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected — most of it you can edit yourself in your profile;
- have your data erased — you can delete your account in Settings;
- restrict or object to processing based on legitimate interests;
- receive data you provided in a portable format;
- lodge a complaint with the National Center for Personal Data Protection of the Republic of Moldova, or with the data protection supervisory authority of the country where you live or work.
To exercise a right, write to emirza@marcaj.com. We will answer within one month and may ask you to confirm your identity.
8. Security
Traffic is encrypted with TLS, passwords are stored only as salted hashes, sessions are kept in an HttpOnly cookie that page scripts cannot read, access is checked on the server for every request, and changes are recorded in an audit log. No system is completely secure; if a breach affects your data, we will notify you and the authorities as the law requires.
9. Cookies
We use only cookies that are strictly necessary to run the platform. See the Cookie Policy.
10. Children
Marcaj is not intended for anyone under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.
11. Changes to this policy
We will update this policy when our processing changes. The date at the top shows when the current version took effect; we will notify you of material changes in the app or by email.