Privacy Policy
Last updated: 14 November 2026
This policy explains what personal data Marmelow collects, why, and what you can do about it. We keep it to what the site needs to work.
1. Who is responsible
João Barradas, sole trader in Portugal, is the data controller. Contact: hello@marmelow.com.
2. What we collect
- If you only design: nothing that identifies you. Your designs stay in your browser.
- Photos for lithophanes: they are processed in your browser and are never uploaded to us.
- Account: your email address, and your name and profile picture if you sign in with Google.
- Downloads: the lamp settings you send to our server to build the files, the date, the quality, and a one-way, scrambled code made from your internet address (we don't keep the address itself). We use this to count downloads and stop abuse.
- Subscription: from Lemon Squeezy we receive your plan, its status, renewal date and customer number. We never receive your card details.
- Messages you send us (by email or the feedback form): the message, the address you give for a reply and, if you tick the box, the settings of your current design. We keep them to answer you and improve Marmelow.
3. Why we use it (and the legal basis)
- To run your account, count downloads and deliver Premium: to perform our contract with you.
- To prevent abuse, fraud and file sharing: our legitimate interest in protecting the service.
- To keep invoices and payment records: our legal obligations.
- To email you about your account, changes to these policies or your subscription: to perform our contract. We'll only send you news or offers if you opt in, and you can opt out at any time.
4. Who processes it for us
- Supabase (database, sign-in and file storage, servers in the EU, Frankfurt).
- Netlify (website hosting and the server that builds your files).
- Brevo (sign-in emails, feedback messages you send us, and emails we send you).
- Google (only if you choose "Continue with Google").
- Lemon Squeezy (payments, as merchant of record. Their privacy policy applies to your purchase).
Some of these companies are based in the United States. Where data leaves the EU, it is protected by the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. We don't sell your data and we don't share it for advertising.
5. Cookies and local storage
We use your browser's storage only for what the site needs: keeping you signed in and remembering your settings. We don't use advertising cookies. If we add privacy-friendly statistics in the future, we'll update this page and ask for your consent where the law requires it.
6. How long we keep it
- Account data: while you have an account, and up to 30 days after you delete it.
- Download records: up to 24 months, to apply limits and trace shared files.
- Generated files: we keep only your latest download, privately, and replace it with the next one. It is deleted with your account.
- Payment records: as long as tax law requires (in Portugal, up to 10 years).
7. Your rights
You can ask to see, correct, delete or receive a copy of your data, to object to how we use it, or to restrict it. Write to hello@marmelow.com and we'll answer within one month. You can also complain to the Portuguese data protection authority, the CNPD, or to the authority in your own country.
8. Children
Accounts are for people aged 16 or over. We don't knowingly collect data from younger children.
9. Changes
If we change this policy in a way that matters, we'll update the date at the top and tell account holders by email.