1. Who We Are
Marres Insights Pte Ltd ("Marres", "we", "us") operates an internal analytics platform providing marketing intelligence and competitive research services to authorised clients. This policy describes how we collect, use, disclose, and protect personal data in connection with that platform.
We are subject to the Personal Data Protection Act 2012 (Singapore) ("PDPA"). We do not currently operate in the European Union and are not subject to the General Data Protection Regulation.
2. Scope
This policy applies to platform account holders (Marres staff with login credentials) and, indirectly, to client data subjects whose publicly available review or social content is processed as part of a commissioned analytical run.
3. Personal Data We Collect
Account holders
| Data | Purpose | Legal basis |
|---|---|---|
| Email address | Account identification and login | Consent |
| Password (bcrypt hash — never plaintext) | Authentication | Consent |
| Session token | Maintaining authenticated sessions | Consent |
| Audit log entries (action, timestamp, IP) | Security monitoring | Legitimate interests |
| Credit transaction history | Billing and usage tracking | Contract |
Scraped public content
We retrieve publicly available Google Maps review text and Instagram caption text via Apify to generate client deliverables. Before entering our processing chain, all content passes through two controls:
- Field whitelist: All identity metadata (author username, display name, owner ID, profile photo, post URLs) is discarded at ingestion. Only review text, approximate timestamp, and a non-reversible content hash are retained.
- Structured-PII redactor: Email addresses, E.164-format phone numbers, and @handles in the text body are replaced with redaction markers before storage.
Personal names in review text are not automated-redacted, as software cannot reliably distinguish a person's name from a firm name, street name, or place name. Processing of publicly available text rests on PDPA s.4 (publicly available personal data).
4. How We Use Personal Data
- Account management: authentication, sessions, credits.
- Service delivery: executing analytical pipelines and returning results to the commissioning client.
- Security: audit logging to detect and investigate unauthorised access.
We do not sell personal data. We do not use personal data for advertising.
5. Retention
| Data category | Retention period |
|---|---|
| Analytical run inputs (URLs, configuration) | 7 days from run completion |
| Analytical run outputs (reports, processed data) | 365 days from run completion |
| Account data | Until account deletion or written request |
| Audit logs | 2 years |
6. Sub-Processors
| Sub-processor | Role | Location |
|---|---|---|
| Apify Technologies s.r.o. | Web scraping (Google Maps Reviews, Instagram) | Czech Republic / global CDN |
| Groq, Inc. | LLM inference for text analysis | United States |
| RunPod, Inc. | GPU compute for MIMIRI and M3 pipelines | United States |
| Google LLC | Calendar integration for scheduling | United States |
| Replit, Inc. | Application hosting and deployment | United States |
| Neon, Inc. | PostgreSQL database hosting | United States |
7. Disclosure
We do not disclose personal data to third parties except to sub-processors listed above for service delivery, where required by Singapore law or court order, or to a successor entity in a corporate reorganisation subject to equivalent privacy obligations.
8. Security
We apply AES-256-GCM encryption for stored credentials, bcrypt password hashing, TLS on all connections, CSRF tokens, reCAPTCHA, account lockout after multiple failed attempts, and an append-only audit log. See our Security page for the full technical posture.
9. Your Rights
Account holders may, at any time from the platform's Settings section:
- Export data: download a copy of all personal data associated with your account.
- Delete account: permanently delete your account and all associated data. This action is irreversible.
For privacy enquiries, contact us at marresinsights@gmail.com.
10. Changes
We will notify account holders of material changes by updating the effective date above. Continued use of the platform after the effective date constitutes acceptance of the revised policy.
11. Contact
Privacy Officer · Marres Insights Pte Ltd · Singapore
marresinsights@gmail.com