04Privacy policy

1. Who the controller is

Controller

Martín Silva Molina

OIB

42550330688

Address

Ul. Ivana Rendića 28b, 10000 Zagreb, Hrvatska

Privacy contact

hey@themariscal.com

We haven't appointed a data protection officer because we aren't required to (art. 37 of Regulation (EU) 2016/679, the GDPR), but anything you send to the address above is read by the person responsible. This policy covers themariscal.com and all its subdomains.

When we build a project for a client and process their users' data, the client is the controller and we only process it on their behalf: that's covered by the Data processing agreement, not by this policy.

2. What data we process

• Account: email, first and last name, username, profile photo, language, password (encrypted, held by Clerk), the provider you sign in with (Google, Apple) and your role.
• Learning: lessons watched and finished, where you are in each video, your answers and results in exercises and exams, what you've read of the book and the guides.
• What you write: notes, highlights, sticky notes, notebooks, exercise routines, your chats with Mariscal AI and what you ask it, and the images you upload for analysis.
• Analyses: the diagnoses, estimated level and error patterns built from your results.
• Purchases: what you bought, when, the amount, the Stripe payment ID, your credits and their movements. We never see your card details.
• Gifts: if you give one, the recipient's name, email and your message; if you receive one, the code and when you redeemed it.
• Community: comments, votes, likes, saves and reports.
• Messages: what you send us by email, through the contact form or through the forms on this site.
• Clients: if you hire us for a project, your contact details and your company's, the proposal, the contract, the invoices and what we discuss about the project.
• Business contacts: if you're the contact at a company we write to offering our services, your name, job title, work email and phone, the company and its website, and whatever you reply (see Business contacts).
• Technical data: IP address, browser, operating system, device language, server logs and errors.
• Usage (only if you accept analytics): the pages you view, the buttons you tap, how far you scroll, load times and, if you accept session recording, how you moved around the page.

We don't ask for or want sensitive data (health, religion, political opinions and so on). Please don't put it in your notes or your chats with the AI.

3. Why we use it and on what legal basis

4. Where the data comes from

• Almost all of it from you: what you write and what you do on the sites.
• If you sign in with Google or Apple, they pass us your name, your email (or Apple's private relay email) and your photo.
• If someone gives you a course, they give us your name and email. We tell you so in the gift email itself.
• Stripe confirms each payment and its status.
• Business contacts come from public professional sources (the company's website, professional profiles, business directories) or from an introduction by someone who knows you. We tell you so in the first email.

5. The demos

The sample shops and configurators (the T-shirts, 3D printing, the publisher, the cube, the cars and the rest) don't send to our servers what you configure, your test orders or the files you upload (images, 3D models, text): it's all processed in your browser and kept in your device's local storage, where you can delete it whenever you like. The only thing that can leave your device is analytics, and only if you've accepted it.

6. Artificial intelligence and your data

For Mariscal AI to answer you, analyse something or generate an exercise, we send AI model providers your message and the minimum context needed: the lesson or page you're on, the point in the video, your results when you ask for an analysis, and the image if you uploaded one. The request goes through The Mariscal's API and through our own server, which picks the model (in Germany (EU)); from there it goes to Groq or Cerebras (US).

• We don't use your data to train AI models, and we choose providers who commit not to do so with the data we send them.
• Conversations are saved in your account so you can pick them up again, until you delete them or delete your account.
• Profiling and automated decisions: the AI uses your results to build diagnoses and an estimated level. This is profiling (art. 4(4) GDPR) used only to tailor your learning. We don't make decisions with legal effects, or that significantly affect you, based solely on automated processing (art. 22 GDPR): the marks are only a guide and you can ask for a person to review them.

More detail: Artificial intelligence at The Mariscal.

7. What other people can see

Your notes, notebooks, progress, chats and purchases are visible only to you. What you post on the blog (comments) is visible to anyone, with your name and profile photo, and is machine-translated into the site's other languages. If you delete a comment, it disappears.

8. Business contacts

The Mariscal writes to companies to offer its services, either directly or through business partners who work with us from a @themariscal.com mailbox. We follow these rules:

• We only write to work addresses, about services that relate to what the company does.
• Every email says who we are and where we got your contact, and includes a link to stop hearing from us with one click (plus the one-click unsubscribe header that email clients understand).
• If you unsubscribe or tell us you're not interested, we won't write again. To make sure of that, we keep only your email on a suppression list.
• If you reply, the conversation is recorded so we can follow it up. If there's no further contact, we delete your data 24 months after the last message.
• Business partners see only the contacts assigned to them, under the same rules.

9. The emails we send you

We send you service emails: sign-in codes (sent by Clerk), purchase confirmations, gifts, replies to your messages, everything to do with a project, and important notices about your account or these documents. Right now we don't send newsletters or advertising to account holders; if we ever do, it'll be only with your consent or, if you've already bought from us, about similar products, with an unsubscribe link in every email.

10. Who we share data with

We don't sell or rent out your data. We share it only with the providers we need to run the service, who process it on our behalf (processors, art. 28 GDPR) under a data processing agreement, or as independent controllers where stated:

11. Data outside the European Union

Several providers are in the United States. Transfers rely on the safeguards in Chapter V of the GDPR: the adequacy decision for the EU-US Data Privacy Framework (Decision (EU) 2023/1795) for certified providers and, as well or instead, the European Commission's standard contractual clauses (Decision (EU) 2021/914). You can ask for a copy of the safeguards at hey@themariscal.com.

12. How long we keep it

13. Your rights

At any time, free of charge, you can ask us for:

• Access: to know what data of yours we process and get a copy (art. 15).
• Rectification: to correct data that's wrong (art. 16). You can change almost all of it from your account.
• Erasure: to delete your data (art. 17), except what the law requires us to keep.
• Restriction: for us to stop using it while a problem is sorted out (art. 18).
• Portability: to receive your data in a structured format (JSON) so you can take it elsewhere (art. 20).
• Withdrawal of consent whenever you like (art. 7(3)): for cookies, from your preferences.

Write to hey@themariscal.com or use the form below. We'll reply within one month at the latest (this can be extended by two more months if the request is complex, and we'll let you know). If we can't be sure it's you, we'll ask you to write from your account email.

14. Deleting your account

1. Write to hey@themariscal.com from your account email, or use the form above and choose “Delete my data or my account”.
2. We check with you first, because deleting the account means losing what you bought and your credits.
3. Within 30 days we delete your account and everything linked to it: progress, notes, highlights, notebooks, routines, chats and analyses. Your public comments are deleted or anonymised.
4. We keep only what the law requires: the record of purchases and invoices, for the tax retention period.

15. Children

In Croatia, the age at which you can consent to online services yourself is 16 (art. 19 of the Zakon o provedbi Opće uredbe o zaštiti podataka, the Croatian Act implementing the GDPR). If you're under 16, you need permission from your parent or guardian to create an account, and you can't accept analytics on your own. If you're a parent or guardian and believe a child has given us data without permission, write to us and we'll delete it.

16. Security

We use encrypted connections (HTTPS), encrypted passwords, access to data only for those who need it, session-based access checks on every feature, limits against abuse, providers with security certifications, and masking of everything you type in session recordings. If a security breach put your data at risk, we'd notify the AZOP within 72 hours and, if the risk is high, you too.

17. Complaining to the authority

If you think we've mishandled your data, please tell us first: we'll want to put it right. But you have the right to lodge a complaint with the supervisory authority (art. 77 GDPR). In Croatia, that's:

Authority

Agencija za zaštitu osobnih podataka (AZOP)

Address

Selska cesta 136, 10000 Zagreb, Hrvatska

Email

azop@azop.hr

Phone

+385 1 4609 000

Website

azop.hr

or the authority in the EU country where you live or work.

18. Changes to this policy

If we change something important (for example, a new provider or a new purpose), we'll let you know by email or on the sites before it takes effect. Previous versions are listed at the bottom of this document.