your data, and what we do with it.

Margo is an AI productivity service operated by Archetype Advisory Ltd ("we", "us", "our"), a company registered in England and Wales. Our service is accessible at mymargo.ai. If you have questions about this policy or your data, contact us at hello@mymargo.ai.

Account data: When you create an account, we collect your email address and a hashed password, or authentication credentials if you sign in via Google. We do not store plaintext passwords.

Content you provide: Everything you add to Margo — tasks, captures, notes, plans, chat messages, and voice inputs — is stored in your account. Voice recordings are transcribed and then discarded; only the resulting text is retained.

Google account data (optional): If you choose to connect your Google account, we access: Google Calendar — calendar event titles, times, and status, used to show busy periods on your plan and to create or update calendar events at your instruction. Gmail — sender name, subject line, and a short snippet of incoming emails, used to identify messages that need a reply or contain a time-sensitive date. Email access is strictly read-only. We do not read, store, or process full email body content. Google data is used solely to provide the planning features described above. It is not used for advertising, profiling, or shared with third parties. You can disconnect Google at any time from your account settings, after which we stop accessing your Google data and delete any stored tokens.

Usage data: We collect standard server logs including IP addresses, browser type, pages visited, and timestamps. This is used for security monitoring and service improvement.

Billing data: If you subscribe, payment is processed by Stripe. We do not store card details. We retain records of subscription status and transaction history.

We use the data we collect to: provide and operate the Margo service; generate AI-assisted plans, prioritised task lists, and suggested time blocks; sync with your Google Calendar and Gmail where you have given permission; process subscription payments; send transactional emails; monitor for security threats and fix bugs; comply with legal obligations. We do not use your personal data for advertising. We do not sell your data to any third party.

We process your personal data on the following legal bases under UK GDPR and EU GDPR: contract performance — to deliver the service you have signed up for; legitimate interests — to maintain security, prevent fraud, and improve the service; consent — for optional Google integrations, which you can withdraw at any time; legal obligation — where required by law.

We share your data only with the following service providers who process it on our behalf: Lovable Cloud / Supabase — database hosting and authentication; AI model providers — your text inputs are sent to AI providers to generate plans and responses, these providers do not use your data to train their models under our agreements; Stripe — payment processing; Google — where you have connected your Google account. We do not sell, rent, or share your personal data with any other third parties.

Your data is retained for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where required for legal or financial compliance (billing records retained for 7 years in line with UK tax law). Google access tokens are deleted immediately on disconnection.

Under UK GDPR and EU GDPR, you have the right to: access a copy of your personal data; rectify inaccurate data; erase your data; restrict processing; data portability; object to processing based on legitimate interests; withdraw consent at any time for any processing based on consent, including Google integrations. To exercise any of these rights, email hello@mymargo.ai. We will respond within 30 days. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

Margo's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we only request Google data necessary to provide the features you have requested; we do not use Google user data to serve advertisements; we do not allow humans to read your Google data except where necessary for security or required by law; we do not use or transfer Google user data for purposes unrelated to providing and improving Margo's features.

We take reasonable technical and organisational measures to protect your data, including encrypted connections (HTTPS), row-level database security, and hashed passwords checked against known breach lists.

Margo uses essential cookies and session tokens to keep you signed in. We do not use advertising or tracking cookies.

Margo is not directed at children under 13. We do not knowingly collect personal data from children.

We may update this policy from time to time. If we make material changes, we will notify you by email or by a notice in the app.

Email: hello@mymargo.ai
Company: Archetype Advisory Ltd, England and Wales