Privacy Notice
For the services of marveen.io and app.marveen.io
Version: 2.0 Effective from: October 8, 2026
This notice has been prepared on the basis of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information.
1. The controller
| Name | Impulzo Labs, LLC |
| Legal form | Single-Member LLC, State of Wyoming, United States |
| Formed | June 26, 2026 |
| Registered office | 30 N Gould St Ste R, Sheridan, WY 82801, USA |
| Representative | Szabolcs Szota (sole member) |
| EIN (US taxpayer identification number) | 30-1499649 |
| Filing number (Wyoming) | 2026-002016655 |
| hello@impulzolabs.com | |
| Company website | https://impulzolabs.com |
| Service website | https://marveen.io |
EU representative (Article 27 GDPR): Szabolcs Szota, hello@impulzolabs.com.
The controller is not obliged to designate a data protection officer, because its activities do not involve large-scale, regular and systematic monitoring of data subjects, and it does not process special categories of data on a large scale.
2. The most important thing to know
The Marveen software runs on your own device, under your own control. What you do with the software on your own computer, which files you open and which external accounts you connect is not transferred to the controller. To operate the software you use your own artificial intelligence subscription, and the controller has no access to that account.
The controller processes the data that are needed for the web services of marveen.io and app.marveen.io: for your account, your membership, your purchases, your license and the community platform.
3. Scope, purpose and legal basis of the data processed
3.1. Registration and account
Data: e-mail address, password (stored exclusively in encrypted, irreversible form), display name, profile picture, self-introduction, the time the account was created and the time of the last login. Purpose: creating and operating the user account, identification, login. Legal basis: performance of the contract (Article 6(1)(b) GDPR). Retention: until the account is deleted.
3.2. Acceptance of the Terms and Conditions and of this notice
Data: the fact and time of acceptance and the version number of the accepted documents. Purpose: proving that the contract was concluded between the parties, and with what content. Legal basis: compliance with a legal obligation and legitimate interest (Article 6(1)(c) and (f) GDPR). The legitimate interest: the controller must be able to prove that the contractual terms were accepted. Retention: 5 years following the deletion of the account (the general limitation period under civil law).
3.3. Membership and entitlement
Data: the membership tier, its validity, the source of the entitlement (trial period, purchase, subscription). Purpose: providing the access that was purchased or otherwise obtained. Legal basis: performance of the contract (Article 6(1)(b) GDPR). Retention: until the account is deleted.
3.4. Purchase and payment
Data: the name of the product or service purchased, its price, the time of purchase, the identifier of the payment transaction, the purchaser’s name and e-mail address and, where an invoice is requested, the billing name and address and, for a company, the tax number. The controller does not obtain or store bank card data. Card data are processed directly by the payment service provider (Stripe). Purpose: fulfilling the order, processing the payment, proving the purchase. Legal basis: performance of the contract (Article 6(1)(b) GDPR). Retention: 5 years from the termination of the contract.
3.4/A. Delivery of physical products
Data: the addressee’s name, telephone number, and the identifier and name of the parcel locker chosen by the User. Purpose: delivering the ordered physical product to the chosen pick-up point and sending the pick-up notification. The telephone number is necessary because the delivery partner sends the pick-up notification to this number; without it the User is not notified that the parcel has arrived. Recipient: the controller transfers these data to the partner performing the delivery (point 4). Legal basis: performance of the contract (Article 6(1)(b) GDPR). Retention: 5 years from the termination of the contract, in the same way as under point 3.4.
3.5. Invoicing
Data: the data shown on the invoice (name, address, tax number, item, amount, date of performance). Purpose: compliance with the statutory obligations to issue invoices and to retain accounting documents. Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR), under Act CXXVII of 2007 on Value Added Tax and Act C of 2000 on Accounting. Retention: 8 years under the Act on Accounting. The controller may not delete these data even if the account is deleted.
3.6. License and activation
Data: the license key issued, the number and time of activations, a one-way fingerprint derived from the device identifier, and the device label provided by the user. The controller’s server receives only the fingerprint, not the device identifiers themselves, and the identifiers cannot be restored from the fingerprint. Purpose: enforcing the license terms (the permitted number of devices), preventing misuse. Legal basis: performance of the contract and legitimate interest (Article 6(1)(b) and (f) GDPR). The legitimate interest: preventing unauthorized copying of the software. Retention: 5 years following the end of the license’s validity.
3.7. Community platform
Data: the posts, comments, uploaded images and files published by you, together with the related timestamps and the author’s identifier. For courses, progress data (lessons viewed). Purpose: operating the community features, recording course progress. Legal basis: performance of the contract (Article 6(1)(b) GDPR). Retention: until the account is deleted or until the content is deleted. Please note: content uploaded to the community platform is visible to the other authorized members of the platform. Do not publish personal data that you do not wish to share.
3.8. Agent access and API key
Data: the identifier and status of the access key issued to the user, and the time the key was issued and last used. Purpose: ensuring an authenticated connection between the software and the web service. Legal basis: performance of the contract (Article 6(1)(b) GDPR). Retention: until the key is revoked or until the account is deleted.
3.9. Technical logs and security
Data: technical log entries related to the use of the service: timestamp, the function called, the result of the operation, error message, technical data indicating the source of the request. Purpose: operating the service, troubleshooting, preventing and detecting misuse and attacks. Legal basis: the controller’s legitimate interest (Article 6(1)(f) GDPR). The legitimate interest: the secure and reliable operation of the service. Retention: technical logs are deleted within 12 months at the latest, by an automatic deletion process running daily, unless the investigation of a specific security incident justifies longer retention. Exception: records relating to payment and invoicing operations are not technical logs but data connected to accounting documents, therefore the 8-year retention period under point 3.5. applies to them.
3.10. Newsletter and informational messages
Data: e-mail address, name, the time of subscription and the fact of consent. Purpose: informing you about news of the service and about offers. Legal basis: your consent (Article 6(1)(a) GDPR). Consent may be withdrawn at any time, without giving reasons, via the unsubscribe link at the bottom of the e-mails or by an e-mail sent to the controller. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. Retention: until consent is withdrawn. The transactional messages belonging to the operation of the service (registration confirmation, password reset, invoice, license key, material change) are not newsletters: you cannot unsubscribe from them while the contract is in force, because they form part of the performance of the contract.
3.11. Contact and customer service
Data: your name, e-mail address and the content of your message. Purpose: answering the inquiry, investigating the complaint. Legal basis: performance of the contract or legitimate interest (Article 6(1)(b) and (f) GDPR); in the case of a complaint, compliance with a legal obligation (Article 6(1)(c) GDPR, under Act CLV of 1997 on Consumer Protection). Retention: 5 years following the closure of the matter; in the case of a complaint, for the period prescribed by law.
3.12. Cookies and local storage
The website classifies cookies and data stored in the browser into three categories.
Necessary (always active). Storage essential for providing the service: maintaining the login session, preserving display settings (for example the light or dark theme), and data used for secure form submission. Legal basis: under the rules on electronic communications, no consent is required for these.
Analytics (disabled by default). Would serve to measure website traffic. Marketing (disabled by default). Would serve measurement for advertising purposes. Legal basis: these two categories require your prior consent (Article 6(1)(a) GDPR). Without consent, no storage for these purposes takes place.
At the time this notice is issued, the website actually stores only data in the necessary category: no analytics or marketing cookies are in use. The choice is offered so that, if such a tool is introduced, it can be activated only after your consent.
Consent can be modified or withdrawn at any time via the Cookie settings link at the bottom of the website, as easily as it was given. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
3.13. Private messages between members
Data: the text of the private messages you send and receive, the identifiers of the participants in the conversation, the timestamps and read status of the messages, and the blocks and reports you create. Purpose: enabling direct communication between members and handling misuse. Legal basis: performance of the contract (Article 6(1)(b) GDPR); as regards the handling of reports, the controller’s legitimate interest in the proper use of the service (Article 6(1)(f) GDPR). Retention: until the account is deleted. When the account is deleted, the messages you have sent are deleted. Who can see them: the content of a private message is visible only to the two participants in the conversation. The controller’s staff and the administrator do not see the content; the only exception is a reported conversation, which the administrator may view for the purpose of investigating the report. Please note, because this is important: this protection is based on access control, not on end-to-end encryption. Messages are stored in readable form in the database, therefore the controller is technically able to access them, even though under its procedures it does not do so. Do not send passwords, banking data or any other information whose disclosure would cause harm in a private message. Your agent: your agent is not authorized to send private messages; the service excludes this on the server side.
4. Data processors
The controller uses the following data processors to provide the service. A data processing agreement is in force with each of them, and each of them may act only on the controller’s instructions.
| Data processor | Activity | Data processed | Privacy policy |
|---|---|---|---|
| Supabase Pte. Ltd. (Singapore), a member of the Supabase, Inc. (United States) group. The data are stored in the European Union, in a data center in Frankfurt. | database, user accounts, storage, backend functions | the data listed in points 3.1., 3.2., 3.3., 3.4., 3.6., 3.7., 3.8. and 3.9. | https://supabase.com/privacy |
| Netlify, Inc. (United States) | serving the website and the application | technical data related to serving | https://www.netlify.com/privacy |
| Stripe Payments Europe, Limited (Ireland) | bank card payments | data required for the payment, card data | https://stripe.com/privacy |
| Plus Five Five, Inc. (“Resend”, United States) | sending transactional e-mails and the newsletter | e-mail address, name, content of the message | https://resend.com/legal/privacy-policy |
| Billingo Technologies Zrt. (1133 Budapest, Árbóc utca 6.) | invoicing | the data shown on the invoice | https://www.billingo.hu/adatkezelesi-tajekoztato |
| FoxPost Kft. (1097 Budapest, Könyves Kálmán körút 12-14.) | delivery of physical products to parcel lockers and the pick-up notification | the data listed in point 3.4/A.: the addressee’s name, telephone number, the chosen parcel locker | https://foxpost.hu/uploads/documents/hu/adatkezelesi_tajekoztato.pdf |
Where the data are stored. The service’s database, the user accounts and the uploaded files are stored in the European Union, in a data center in Frankfurt (eu-central-1). Stripe and Billingo are also European data processors.
Who the contracting party is. This is a separate question from the place of storage. In the case of Supabase, the contracting party is a Singaporean company and the parent company is American; Netlify and Resend are American companies. Therefore, although storage takes place in the European Union, access within the service provider’s group of companies may qualify as a transfer of data to a third country. The legal basis for this is the standard contractual clauses (SCC) adopted by the European Commission or the adequacy decision of the European Commission. The controller has concluded a data processing agreement (DPA) with each of these service providers.
Beyond the above, the controller does not transfer personal data to anyone, unless required to do so by law (for example in the case of a request from an authority or a court), or unless you expressly consent to it.
The controller does not use personal data to train artificial intelligence, and does not sell personal data to third parties.
5. Data security
The controller applies technical and organizational measures proportionate to the risk to protect the data. These include encrypted data transmission, storage of passwords in irreversible form, restriction of access on a per-user basis, separate storage of the access credentials used for the service, regular backups and logging.
The controller investigates any personal data breach that comes to its knowledge in the manner prescribed by law, records it in its register and, where necessary, notifies the authority and/or the data subjects.
6. Your rights
You may exercise the following rights in connection with the processing of your data:
- Access (Article 15 GDPR): you may request information about which of your data we process, for what purpose and for how long, and you may request a copy of these data.
- Rectification (Article 16): you may request the correction of your inaccurate data and the completion of your incomplete data.
- Erasure (Article 17): you may request the erasure of your data. The controller may refuse erasure if the processing of the data is necessary for compliance with a legal obligation or for the exercise of legal claims (typically in the case of invoicing data).
- Restriction of processing (Article 18).
- Data portability (Article 20): you may request the data that you provided and that are processed on the basis of the performance of a contract or of consent in a structured, machine-readable format.
- Objection (Article 21): you may object to processing based on legitimate interest.
- Withdrawal of consent (Article 7(3)): in the case of data processed on the basis of consent (newsletter), you may withdraw your consent at any time.
You may send your request to szabolcs@marveen.io. The controller fulfills the request within 30 days at the latest or, where justified, informs you of the reason for the delay. The information is provided free of charge; in the case of a manifestly unfounded or excessive request, the controller may charge a fee or refuse to act on the request.
For identification purposes, the controller may ask you to send the request from the e-mail address associated with your account.
7. Remedies
Complaint to the controller
Please contact us first at szabolcs@marveen.io. Most issues can be resolved most quickly this way.
Complaint to the supervisory authority
Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH, Hungarian National Authority for Data Protection and Freedom of Information) Address: 1055 Budapest, Falk Miksa utca 9-11. Postal address: 1363 Budapest, Pf.: 9. Telephone: +36 (1) 391-1400 E-mail: ugyfelszolgalat@naih.hu Website: https://naih.hu
Judicial remedy
You may bring proceedings before the regional court (törvényszék) competent for your place of residence or place of stay. The proceedings are free of court fees.
8. Amendment of this notice
The controller may amend this notice unilaterally. It notifies registered users of any material amendment by e-mail or in the application at least 15 days before the amendment enters into force. The notice in force at any given time is available at https://marveen.io/adatkezelesi.
This document has been prepared in Hungarian and English. In case of any discrepancy, the English version prevails.