← Marrowe

Privacy Policy

Effective: May 29, 2026 · Last updated: June 10, 2026

1. Who we are

This Privacy Policy applies to the website at marrowe.app and the related application and processing services, including the signed-in dashboard known as The Pass (collectively, "Marrowe", "we", "us", or "our"), operated by its founders, Ryan and Dove, in the Province of Alberta, Canada.

For questions about this policy or any privacy matter, contact our Privacy Officer at hello@marrowe.app.

2. The laws we comply with

We comply with applicable Canadian and Alberta privacy and anti-spam laws, including:

  • the Personal Information Protection and Electronic Documents Act (Canada) ("PIPEDA");
  • the Personal Information Protection Act (Alberta) ("PIPA Alberta");
  • Canada's Anti-Spam Legislation ("CASL") and related regulations of the CRTC.

Where the requirements of these laws differ, we apply the stricter standard.

3. What this policy covers

This policy covers personal information we collect when:

  • a chef creates an account and signs in to The Pass;
  • a chef uploads documents (Banquet Event Orders, master prep lists) or adds photos and notes in The Pass;
  • a chef subscribes to a paid plan;
  • any person visits this website or submits the "Request access" form;
  • any person contacts us at hello@marrowe.app or another Marrowe address.

4. What we collect

4.1 Information you give us

  • Account information: your email address, your kitchen or chef name, and a password. Passwords are stored only as salted cryptographic hashes by our authentication provider; we never see or store your password in plain text.
  • Uploaded documents: the text and files (typically PDFs) of the BEOs and master prep lists you upload. A BEO may include event metadata (name, date, time, venue, headcount), the menu, allergen and dietary information, a service timeline, contact names and phone numbers of the booking client, and other information the sales coordinator chose to include.
  • Incidental guest information: BEOs sometimes name individual guests in relation to allergies or dietary needs (for example, "shellfish allergy, Table 7, bride's mother"). We process this information only as part of the uploaded document and only to generate your kitchen documents and event pages.
  • Photographs and notes: photos and service notes you add to an event page in The Pass.
  • Lead form submissions: if you submit the "Request access" form, the name, email address, kitchen, and message you provide.

4.2 Information we collect automatically

  • Server logs: IP address, request timestamp, request path, and user agent for requests to our servers, retained for security and abuse-prevention purposes.
  • Session cookies: when you sign in to The Pass, we set strictly necessary, httpOnly session cookies that keep you signed in. They contain authentication tokens and nothing else, and are not used for tracking.
  • First-party, cookieless analytics: our marketing pages send a small beacon recording the page path, referrer, user agent, and a visitor identifier. That identifier is a salted one-way hash that incorporates the calendar date, so it rotates every 24 hours and cannot be reversed into your IP address. We store no analytics cookies and no raw IP addresses in analytics data, and we use no third-party analytics or advertising trackers.
  • Usage metering: a record of each document read in under your account, kept to administer your plan's document allowance.

4.3 Payment information

  • Subscriptions are processed by Stripe. Your card number goes directly to Stripe and never touches our servers. We receive and store only what we need to run your subscription: a Stripe customer identifier, a subscription identifier, your plan, and its status and renewal date.

4.4 What we do not collect

  • We do not use analytics cookies, advertising cookies, or third-party tracking pixels.
  • We do not store payment card numbers.
  • We do not knowingly collect information about children. See section 13.

5. Why we collect it (purposes)

We collect personal information only for purposes a reasonable person would consider appropriate in the circumstances, in accordance with PIPEDA s.5(3) and PIPA Alberta s.11. Those purposes are:

  1. Providing the Service. Reading the documents you upload and generating your kitchen documents: the kitchen card, crew sheet, divided savory and pastry prep sheets, standing lists, and event pages.
  2. Operating your account. Authentication, keeping you signed in, and maintaining your book of pages.
  3. Billing. Administering your subscription, free trial, and document allowance through Stripe.
  4. Communications. Service notices about your account or subscription, responses to the "Request access" form, and support.
  5. Operating, securing, and improving the Service. Detecting abuse, debugging errors, understanding aggregate website usage, and improving how we read and render documents.

6. Legal basis for collection (consent)

We rely on the following bases under PIPEDA and PIPA Alberta:

  • Express consent, given when you create an account, upload a document, subscribe to a plan, or submit the "Request access" form;
  • Implied consent by virtue of your continued use of the Service after being informed of this policy;
  • Inferred consent for transactional processing (generating the kitchen documents you asked for from the documents you uploaded), consistent with your reasonable expectations.

You can withdraw consent at any time. See section 10.

7. Who we share information with

We do not sell, rent, or trade personal information. We share it only with the following categories of service providers ("processors"), strictly to operate the Service and under terms requiring them to safeguard the information:

  • Supabase, Inc. (United States): database, authentication, and file storage. Your account, your uploaded documents, your pages, and your standing lists are stored on Supabase infrastructure, encrypted at rest.
  • Groq, Inc. (United States): large language model inference for reading your documents. The text of an uploaded document is transmitted to Groq for the duration of the request.
  • Stripe, Inc. (United States): payment processing and subscription billing. Stripe's handling of your card details is governed by Stripe's own privacy policy.
  • Railway Corp. (United States): application hosting; our servers and their logs run on Railway infrastructure.
  • Google LLC (United States): web font delivery. Your browser requests fonts from Google Fonts when loading our pages, which discloses your IP address and user agent to Google for that request. We also use Google email infrastructure for operational mail such as lead notifications.
  • Legal compliance: we may disclose information when required to do so by law, court order, or other valid legal process, or to protect the rights, property, or safety of Marrowe, our users, or the public.

We do not authorize any of these providers to use your information for their own marketing purposes.

8. Cross-border data transfers

Our processors named in section 7 (Supabase, Groq, Stripe, Railway, Google) are located in or process data in the United States. When personal information is transferred to or processed in the United States, that information becomes subject to United States laws, including laws that may grant US government authorities access to the information.

We use providers that maintain industry-standard security practices, but we cannot guarantee that personal information processed outside Canada will be afforded the same protections as it would under Canadian law. By using Marrowe, you acknowledge and consent to this transfer and processing.

9. Retention and deletion

We retain personal information only as long as is reasonably necessary for the purposes identified in section 5.

  • Your pages, uploaded documents, and standing lists are retained while your account exists: keeping your professional record is the core function of the Service. You can tear out (delete) any page yourself in The Pass, and you may request full deletion at any time (see section 10).
  • Photographs and notes are retained as part of the page on which they appear, and deleted with it.
  • Usage-metering records are retained as long as needed to administer the document allowance and resolve billing questions.
  • Billing records are retained as required by Canadian tax and accounting law.
  • Server logs are retained for up to 90 days, after which they are deleted on a rolling basis.
  • Analytics data contains no raw IP addresses, and its visitor identifiers rotate every 24 hours by design.
  • Lead form submissions are retained until the conversation concludes or you ask us to delete them.

If you delete your account (or request deletion by email), we will delete or anonymize your personal information within 30 days, except where retention is required to comply with a legal obligation (including tax law for billing records), resolve a dispute, or enforce our agreements.

10. Your rights

Subject to certain limitations under applicable law, you have the right to:

  • Access the personal information we hold about you;
  • Correct inaccurate or incomplete information;
  • Withdraw consent to ongoing collection, use, or disclosure;
  • Request deletion of your personal information;
  • Object to or restrict certain processing.

To exercise any of these rights, email hello@marrowe.app from the email address on your account. We will respond within 30 days, in accordance with PIPEDA and PIPA Alberta. Note that withdrawing consent to processing that is necessary to provide the Service (for example, the reading of documents you upload) means we can no longer provide it.

11. Complaints

If you believe we have not handled your personal information in accordance with this policy or applicable law, please contact our Privacy Officer first at hello@marrowe.app. We will investigate and respond within 30 days.

You also have the right to file a complaint with the appropriate regulator:

  • Office of the Privacy Commissioner of Canada: priv.gc.ca
  • Office of the Information and Privacy Commissioner of Alberta: oipc.ab.ca

12. CASL: commercial electronic messages

Most email we send is transactional: account notices, subscription receipts and billing notices, and replies to messages you send us. Some messages (for example, product announcements) may constitute "commercial electronic messages" under Canada's Anti-Spam Legislation.

Every commercial electronic message we send will:

  • identify Marrowe as the sender and provide a contact method;
  • include a clear and unambiguous unsubscribe mechanism;
  • be sent only with your express or implied consent under section 10 of CASL.

Unsubscribe requests are processed without charge and within ten (10) business days of receipt, as required by CASL.

13. Children

Marrowe is intended for use by adult food-service professionals. We do not knowingly collect personal information from any person under the age of 13. If you believe we have collected such information, please contact us immediately and we will delete it.

14. Security

We use reasonable administrative, technical, and physical safeguards to protect personal information against loss, theft, and unauthorized access, including transport-layer encryption (HTTPS) for all traffic, encryption of stored data at rest with our infrastructure providers, hashed credentials, row-level access controls so each account can read only its own data, and limited internal access. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

15. Cookies and tracking

Marketing pages (this website) set no cookies. Aggregate usage is measured by the first-party, cookieless beacon described in section 4.2: no analytics cookies, no advertising cookies, no third-party trackers.

The Pass sets strictly necessary session cookies when you sign in. They are httpOnly (not readable by scripts), carry only your authentication tokens, and exist solely to keep you signed in.

Stripe checkout and billing pages are hosted by Stripe and may set cookies governed by Stripe's own privacy and cookie policies.

16. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of this page will reflect any change. Material changes will be communicated to affected users by email or by a notice on the website prior to taking effect.

17. Contact

Privacy Officer
Ryan and Dove, Marrowe
Email: hello@marrowe.app