Privacy Policy

Notice: Engineering compliance draft for Mareante (not yet reviewed by an independent attorney).

---

1. Introduction and Scope

This Privacy Policy explains how Nuno Ribeiro, operating as a Swiss sole proprietorship (Einzelunternehmen) trading as "Mareante" ("we", "us", or "our"), collects, processes, stores, and protects personal data when you use the Mareante platform at mareante.nuuno.art (the "Platform" or "Service"), create an account, communicate with our voice or text agents, or interact with our services.

Mareante provides an autonomous software development platform that converts natural language voice or text requests into technical specifications, plans, sandboxed executions, and deployed repositories for multi-tenant organisations.

We comply with:

• The Swiss Federal Act on Data Protection (revised FADP / nFADP, SR 235.1) and its Ordinance (DPO / DSV, SR 235.11);
• The Regulation (EU) 2016/679 (General Data Protection Regulation or GDPR);
• The Directive 2002/58/EC (ePrivacy Directive) and Article 45c of the Swiss Telecommunications Act (FMG / TCA, SR 784.10).

---

2. Identity and Contact Details of the Data Controller

The Data Controller responsible for personal data processing on the Platform is:

• Data Controller: Nuno Ribeiro, sole proprietorship (Einzelunternehmen) trading as "Mareante"
• Address: [To be provided by operator: {{LEGAL_ADDRESS}}] (Current city of operation: 8000 Zürich, Switzerland; street address pending confirmation).
• Commercial Register: Not entered in the Commercial Register (turnover below CHF 100,000 threshold under OR Art. 931 / HRegV Art. 36; conditional placeholder: [To be provided by operator: {{LEGAL_REGISTER}}]).
• Value Added Tax (VAT): Exempt under Swiss MWSTG Art. 10(2)(a) (turnover below CHF 100,000 threshold; conditional placeholder: [To be provided by operator: {{LEGAL_VAT_ID}}]).
• Contact Email: [To be provided by operator: {{LEGAL_EMAIL}}]
• Data Protection Inquiries: No Data Protection Officer (DPO) is appointed, as appointment is not mandatory under GDPR Art. 37 or Swiss nFADP Art. 10 for this sole proprietorship. All privacy inquiries, data subject access requests, export (FR-AU-04), and erasure requests (FR-AU-05) are handled directly by the proprietor/controller at: [To be provided by operator: {{LEGAL_EMAIL}}] (or [To be provided by operator: {{LEGAL_DPO_CONTACT}}]).
• EU Representative (Art. 27 GDPR): [To be provided by operator: {{LEGAL_EU_REPRESENTATIVE}}] (Designation pending; see README.md).

When business customers use Mareante to process data on behalf of their end-users, the business customer acts as the Data Controller, and Mareante acts as the Data Processor governed by our Data Processing Agreement.

---

3. Principles of Data Processing

We adhere strictly to core data protection principles:

1. Lawfulness, Fairness, and Transparency: Personal data is processed lawfully, fairly, and transparently.
2. Purpose Limitation: Data is collected solely for specified, explicit, and legitimate software development and platform operational purposes.
3. Data Minimisation: Processing is limited to what is strictly necessary in relation to those purposes.
4. Accuracy: Personal data is kept accurate and updated.
5. Storage Limitation: Data is retained only as long as necessary for specified purposes or statutory retention obligations.
6. Integrity and Confidentiality: State-of-the-art technical and organisational measures ensure security against unauthorised access, alteration, or disclosure.
7. No Tracking / No Ad-Tech: We do not engage in behavioral tracking, cross-site analytics, profiling, or data brokering.

---

4. Categories of Data, Purposes, and Legal Bases

The following table details the categories of personal data collected, processing purposes, and applicable legal bases under GDPR (Article 6(1)) and Swiss nFADP (Article 31):

---

5. Voice Data Processing and Real-Time Dialogue

Mareante provides an interactive full-duplex voice interface powered by Google Gemini Live API (FR-VC-01):

1. Ephemeral Audio Streaming: Microphones audio streams over a secure WebSocket directly to our backend control plane and is forwarded to Google Gemini API for real-time speech-to-text and model reasoning.
2. No Persistent Audio Storage: Raw audio chunks are buffered ephemerally in volatile memory solely for the streaming window. We do not record or store raw voice audio on persistent disk storage.
3. Dialogue Transcripts: For continuity and accessibility (FR-VC-03), spoken dialogue is transcribed to text and saved in the project conversation history, allowing review and seamless switching between voice and text.
4. Approval by Voice: Where a project specification or plan is confirmed by voice (FR-VC-04), the spoken transcript is recorded in our append-only audit log alongside timestamp and user identity.
5. No Model Training on Voice: Under enterprise API terms with Google Cloud, customer voice audio and prompts are never used to train or fine-tune Google's public foundation models.

---

6. Zero Tracking and Strictly Necessary Cookies

Mareante implements privacy by design:

• No Third-Party Advertising: We display no ads and share no data with ad networks.
• No Cross-Site Trackers: We do not use Google Analytics, Meta Pixel, tracking beacons, or cross-site fingerprinting scripts.
• Strictly Necessary Cookies Only: We use only strictly necessary first-party cookies for session authentication, CSRF security, and user theme preferences. Under Article 5(3) of the ePrivacy Directive and Swiss FMG Article 45c, strictly necessary cookies are exempt from consent requirements, omitting the need for a consent banner.
• For complete technical details, consult our Cookie Notice.

---

7. Recipients and Sub-processors

To provide the Platform, we share data with vetted third-party service providers acting as processors or independent controllers under written data processing agreements conforming to GDPR Article 28 and Swiss nFADP Article 9:

A complete directory is available in our Sub-processors Directory.

---

8. International Data Transfers

When personal data is transferred outside Switzerland or the European Economic Area (EEA), we ensure adequate protection through:

1. Adequacy Decisions: Transfers between Switzerland and the EEA occur freely pursuant to reciprocal adequacy decisions recognized by the European Commission and the Swiss Federal Council.
2. Data Privacy Framework (DPF): Transfers to US-based entities certified under the EU-U.S. Data Privacy Framework and Swiss-U.S. Data Privacy Framework rely on the respective adequacy determinations.
3. Standard Contractual Clauses (SCCs): Where adequacy does not apply, transfers are safeguarded by the European Commission’s Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), supplemented by the Swiss Addendum approved by the Swiss Federal Data Protection and Information Commissioner (FDPIC).
4. Technical Safeguards: TLS 1.3 encryption in transit, AES-256 / ChaCha20-Poly1305 encryption at rest, PostgreSQL Row-Level Security, and ephemeral container execution.

---

9. Data Retention and Erasure

We retain personal data only for as long as necessary to fulfill collection purposes or as mandated by statutory retention periods:

For full operational details, see our Data Retention Schedule.

---

10. Automated Decision-Making and AI Transparency

1. No Solely Automated Legal Decisions: Mareante does not make solely automated decisions producing legal effects concerning you within the meaning of GDPR Article 22 or Swiss nFADP Article 21.
2. Human in the Loop: Mareante agents generate specifications, draft plans, and produce code, but critical actions are gated by human approval. Specifically, deployments (FR-PL-04), spend increases above project caps, and external credential integrations require explicit human UI approval by an authorized user.
3. Automated Safety Filters: In accordance with our Acceptable Use Policy, automated guardrails screen prompts for illegal activities. If an action is blocked, you receive a Statement of Reasons explaining the rule applied and have the right to human review and appeal.
4. AI Disclosure: Pursuant to Article 50 of the EU AI Act (Regulation (EU) 2024/1689), you are informed that you are interacting with an artificial intelligence system. Detailed information is provided in our AI Transparency Notice.

---

11. Your Data Protection Rights

Under Chapter III of the GDPR and Chapter 4 of the Swiss nFADP, you have the following rights:

1. Right of Access (GDPR Art. 15 / Swiss nFADP Art. 25): You have the right to obtain confirmation as to whether personal data concerning you is being processed, and to receive a copy of that data.
2. Right to Rectification (GDPR Art. 16 / Swiss nFADP Art. 32): You have the right to request the correction of inaccurate or incomplete personal data.
3. Right to Erasure / "To Be Forgotten" (GDPR Art. 17 / Swiss nFADP Art. 32): You have the right to request the deletion of your personal data. Tenant Owners can trigger tenant-wide deletion via the platform interface (FR-AU-05), permanently destroying all tenant rows, encryption keys, and volumes.
4. Right to Restriction of Processing (GDPR Art. 18): You have the right to restrict processing where accuracy is contested, processing is unlawful, or data is needed for legal claims.
5. Right to Data Portability (GDPR Art. 20 / Swiss nFADP Art. 28): You have the right to receive your personal data in a structured, commonly used, and machine-readable format. Tenant Owners can download an export of tenant data directly via FR-AU-04.
6. Right to Object (GDPR Art. 21 / Swiss nFADP Art. 30(2)(b)): You have the right to object to processing based on legitimate interests.
7. Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

Exercising Your Rights

To exercise any of your rights, contact us at:

• Email: [To be provided by operator: {{LEGAL_EMAIL}}] (or [To be provided by operator: {{LEGAL_DPO_CONTACT}}])
• Postal Address: Nuno Ribeiro (Mareante), Attn: Data Protection, [To be provided by operator: {{LEGAL_ADDRESS}}]

We respond to verified requests within 30 days without charge, except where requests are manifestly unfounded or excessive.

---

12. Right to Lodge a Complaint

If you believe our processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with a competent supervisory authority:

• In Switzerland:

Federal Data Protection and Information Commissioner (FDPIC / EDÖB) Feldeggweg 1, CH-3003 Bern, Switzerland Telephone: +41 58 462 43 95 Website: www.edoeb.admin.ch

• In the European Union / European Economic Area:

You may lodge a complaint with the data protection supervisory authority in the EU Member State of your habitual residence, your place of work, or the place of the alleged infringement. A complete list is available at the European Data Protection Board (EDPB).

---

13. Data Security Measures

Mareante implements technical and organisational measures (TOMs) under GDPR Article 32 and Swiss nFADP Article 8:

• Cryptographic hash-chained audit logging (FR-AU-01–FR-AU-02);
• Strict database-level multi-tenant isolation via PostgreSQL Row-Level Security (FR-ID-07);
• Ephemeral, resource-capped container execution with strict egress host allow-lists (FR-EX-01, FR-SC-08);
• Credential isolation via secure secret proxy injection without exposing secrets in model context or logs (FR-SC-03–FR-SC-04);
• One-click Emergency Breach Rotation (FR-SC-09).

---

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect operational, regulatory, or technical changes. Substantial modifications will be notified to registered account holders via email or an in-app notice at least 14 days before taking effect.