Privacy Notice

This notice explains how Marginalia, a service provided by Gallus Insight, collects and uses personal data. Gallus Insight is the data controller for the information you provide.

What we collect

• Account data: name, email, login credentials.
• Library data: photos of covers and shelves you upload, and the book titles, authors, genres, themes, and reviews we derive from them.
• Usage data: device, IP address, browser, and interactions with the service, used for security, fraud prevention, and improvement.
• Support data: messages you send to our support team.

How we use it

• To provide the service (contract performance): identify books, produce insights, recommendations, roadmaps, and chat responses.
• To secure the service and prevent fraud (legitimate interests).
• To improve the service (legitimate interests).
• To communicate about your account and important service updates (contract performance).

Who we share it with

• Paddle (Merchant of Record) — processes payments, tax, invoicing, and subscription management.
• Supabase — hosts our database and authentication.
• AI providers (Google, OpenAI) — receive photos and library data to produce identifications, insights, and chat replies.
• Authorities, where required by law.

Retention

We keep your data for as long as your account is active. On deletion we remove your data within 30 days, except where retention is required by law.

Your rights

Depending on your location you may have rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. Contact us to exercise any of these. UK/EEA users have the right to complain to a supervisory authority.

Security

We use industry-standard technical and organisational measures including encryption in transit, row-level access control, and least-privilege service credentials.

International transfers

Data may be processed outside your country by our subprocessors. Where required, we use Standard Contractual Clauses or equivalent safeguards.