Legal

Privacy Policy

Last updated: 15 July 2026

This policy explains what personal data Markline collects, why, and your rights. The data controller is Roy Thande (t/a Markline), operating Markline at markline.app. Contact us about privacy at hello@markline.app.

What we collect

• Account data — your email address (used to send your passwordless sign-in link).
• Workspace data — the client, statement-of-work, and request text you enter to run scope checks.
• Scope-check inputs — contract and request text you submit for assessment.
• Email you request — if you ask the free tool to email you a scope-check verdict, we use the address you enter to send that one message and do not retain it afterwards.
• Usage & analytics — product analytics via PostHog (EU region).
• Payment data — handled entirely by Paddle. Markline does not receive or store your card details.

Why we use it (lawful basis)

We process account and workspace data to provide the service (performance of our contract with you), and usage analytics to operate and improve the product (legitimate interest). Emails you explicitly request — such as a scope-check verdict from the free tool — are sent as transactional messages at your request and the address is not kept for marketing. Product analytics and advertising measurement are non-essential and run on consent only: nothing loads until you choose, the two are separate choices, and refusing is the default if you ignore the banner. We do not sell your personal data.

Your tracking choices

The banner offers two independent options — product analytics (how the tool is used, so we can improve it) and advertising (which ads bring people here). Neither loads before you accept it. You can change or withdraw either at any time from the Tracking preferences link in the footer; withdrawing stops both the in-browser tracking and any server-side reporting we would otherwise send to an ad platform.

Processors we use

We share data with the following processors only as needed to run the service:

• Supabase — database and authentication (EU / Frankfurt).
• PostHog — product analytics (EU region).
• Resend — transactional email delivery.
• Anthropic — scope-check text is sent to Anthropic’s API to generate the scope verdict and draft change orders.
• Paddle — payments, invoicing, and refunds, as our Merchant of Record.
• Reddit — advertising measurement, and only if you consent. We tell Reddit when an ad click led to a signup or a purchase, so we can tell whether our advertising works. We send an anonymous click identifier from the ad you arrived on — never your email address or any other personal detail.

International transfers, retention, and security

Some processors may transfer data outside your country under appropriate safeguards (e.g. standard contractual clauses). We keep personal data only as long as needed to provide the service and meet legal obligations, then delete or anonymise it. We use encryption in transit and access controls to protect data.

Cookies

We use a minimal set of cookies for sign-in sessions and analytics. PostHog is configured for the EU region; where consent is required for analytics cookies in your jurisdiction, we honour it.

Your rights (GDPR)

If you are in the EU/EEA or UK, you have the right to access, correct, delete, port, and object to the processing of your personal data, and to withdraw consent. To exercise any right, email hello@markline.app.

Your rights (Kenya Data Protection Act, 2019)

If you are in Kenya, the Data Protection Act, 2019 gives you rights to be informed of how your data is used, to access it, to request correction or deletion, to object to processing, and to data portability. Roy Thande (t/a Markline) is the data controller for these purposes. To exercise any of these rights, or to raise a concern, email hello@markline.app; you also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC).

Contact

Privacy questions or requests: hello@markline.app.