Privacy Policy

Effective October 10, 2026

1. Who we are

Marginpanel LLC ("we", "us") operates MarginPanel (the "Service"). This policy explains how we handle personal information when you visit our pages or use the Service. Questions: support@marginpanel.com.

For the business data you upload, such as settlement reports, we act on your behalf as your service provider: we process it only to provide the Service to you.

2. What we collect

Information you give us

• Account: email address and password. Passwords are stored by our authentication provider in hashed form; we never see them in plain text. If you turn on two-step verification, the provider also stores your authenticator's secret key.
• Workspace data: store names, the settlement reports you upload (the original file and the movements we extract: dates, order numbers, product identifiers, quantities and amounts), product costs, seller codes, suppliers, purchase orders and stock counts.
• Billing: when you subscribe, Stripe collects your payment details. We receive your Stripe customer ID, plan, subscription status and billing dates, not your full card number.
• Team: the email address and role of people you invite to a workspace, and who invited them.
• Support: what you send when you contact us.

Information collected automatically

• Technical data: IP address, browser and device type, pages and API requests, and timestamps, kept in our providers' logs for security and troubleshooting.
• Activity records: changes to product costs (the previous and new values) and report deletions are recorded with who made them and when, so workspace owners can trace changes.
• Bot protection: sign-in and sign-up forms may use Cloudflare Turnstile, which checks browser signals to tell people from automated traffic.
• Usage analytics: Cloudflare Web Analytics counts page views without cookies and without tracking you across sites.

3. How we use it

• Provide the Service: sign you in, store your data, calculate your results and show them to the members of your workspace.
• Bill subscriptions and manage trials.
• Keep the Service secure: prevent abuse, fraud and automated sign-ups, enforce rate limits and investigate problems.
• Send service emails, such as account confirmation, password reset, billing and security notices, and changes to these policies. Product news, if we send it, includes an unsubscribe link.
• Answer support requests and improve the Service.
• Comply with law and enforce our Terms.

We do not sell personal information, share it for cross-context behavioral advertising, or use your workspace data for anything other than providing the Service to you.

If you are in a region that requires a legal basis for processing, we rely on: performing our contract with you; our legitimate interests in securing and improving the Service; compliance with legal obligations; and your consent where we ask for it.

4. Who we share it with

We share personal information only with providers that process it for us under contract, and only as needed:

• Supabase: authentication and database.
• Cloudflare: hosting, file storage, security, bot protection (Turnstile) and cookieless analytics.
• Stripe: payments and subscriptions.
• Email delivery providers: account and service emails.

We may also disclose information if required by law or to protect rights and safety, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to the information transferred. Within your workspace, members you or your admins give access to can see the workspace's data and each other's email addresses.

5. Cookies and local storage

The app stores your sign-in session and your light or dark theme choice in your browser's local storage. Our security providers may set strictly necessary cookies, for example for access control or bot protection. We do not use advertising cookies.

6. How long we keep it

• Account and workspace data: while your account is open.
• Reports and costs you delete: removed from the app right away. An activity record is kept while the workspace exists: for reports, the file name, period, row count, who and when; for costs, the previous cost and date, who and when.
• When you delete your account in Settings, the workspaces you own are deleted right away with their stored files. If you ask us by email, we do it within 30 days. Records we must keep for legal, tax or billing reasons are kept as required.
• Accounts that stay without an active plan for 90 days may be deleted, as described in the Terms.
• Backups and technical logs are kept for a limited time and then overwritten.

7. Security

Connections use HTTPS, and our providers encrypt stored data. Each workspace's data is isolated in the database so that only its members can read it, and actions such as editing costs or deleting reports are limited by role. No system is perfectly secure; if we learn of a breach that affects your personal information, we will notify you as required by law.

8. Your choices and rights

You can update your password, export results to CSV and delete your account in the app, and owners and admins can delete reports and costs. You can also ask us to access, correct, export or delete your personal information, or to stop a particular use of it. Depending on where you live (for example California or another US state with a privacy law, or the EEA or UK), you may have these rights by law, along with the right not to be discriminated against for using them and to appeal our decision.

Email support@marginpanel.com from the address on your account. We may need to verify your identity, and we respond within the time the law requires, usually 30 to 45 days. If you are a member of someone else's workspace, we may refer requests about that workspace's data to its owner. You may also complain to your local data protection authority.

9. Where data is processed

We are based in the United States, and our providers process data in the United States and other countries where they operate, with safeguards required by applicable law.

10. Children

The Service is for businesses and adults. It is not directed to anyone under 18, and we do not knowingly collect personal information from them.

11. Changes to this policy

We will post updates here with a new effective date. For material changes, we will notify account owners by email or in the app before they take effect.

12. Contact

Marginpanel LLC · support@marginpanel.com