Who we are

Ethos Engine is operated by Maru Markets ("Maru Markets", "we", "us"), based in Tampa, Florida, United States. We are the controller of the personal data described here. Contact: esh@ethosengine.io or +1 (573) 694-0124.

This policy covers the website at ethosengine.io, the platform at ethosengine.io/app, and emails and calls with us. Our services are for businesses. They are not directed at children, and we do not knowingly collect data from anyone under 18.

What we collect

We collect only what is needed to run the service.

You give us:

Account details: name, work email, and a password (stored only as a hash by our authentication provider; we never see it).
Report inputs: your website, brand name, category, ideal customer, up to three competitor websites, and your target questions.
Order details: what you want placed or produced, the page to link, timing and notes.
Messages and bookings: what you send by email, and the name, email and times you enter when you book a call.
Consent choices: whether you accepted our terms and whether you opted in to product emails, with the time you did so.

Collected automatically:

Technical logs: IP address, browser type, pages requested, timestamps and error data, kept by our hosting and database providers to run and secure the service.
Browser storage: a session token so you stay signed in, and small items that save your place in a form. See the Cookie Policy. No advertising or analytics tracking is in use.

Generated by the service:

Your reports and score history, built from public information about your brand (search results, AI engine answers, press indexes, public link and authority data).
Order and subscription status, and invoices issued by our payment provider.

We do not collect payment card numbers. Payments are handled by Stripe on Stripe's pages.

Why we use it

Purpose	Data	Legal basis (where one is required)
Create and run your account, produce reports	Account details, report inputs, reports	Performance of a contract
Fulfil orders and subscriptions	Order details, status, invoices	Performance of a contract
Scheduling and customer support	Messages, bookings	Performance of a contract
Keep the service secure and working	Technical logs	Legitimate interest (security, debugging)
Send product updates	Email	Consent (opt-in; withdraw any time)
Comply with tax and accounting rules	Invoices, order records	Legal obligation

We do not sell personal data, and we do not share it for cross-context behavioral advertising.

Who processes it

We use service providers who act on our instructions and are bound by data-processing terms:

Supabase (database and authentication; hosted on AWS, United States)
Vercel (website hosting and serverless functions, United States)
Stripe (payments, invoices and subscriptions)
Cal.com (call scheduling)
Resend (transactional email, when enabled)
Google Fonts and jsDelivr (font and script files; your IP address is sent to them when a page loads)
Google (favicon images for publications shown in the platform)

To build your report we send your brand name, website, category and target questions (not your personal details) to data providers and AI engines: OpenAI, Perplexity, SerpAPI (Google results), DataForSEO, Moz, Google PageSpeed Insights, the GDELT Project, Wikidata and Wikipedia.

To fulfil a placement or service order we share the order brief and the business details it needs with the publication or supplier doing the work. We share only what the order requires.

We may also disclose data when the law requires it, to protect our rights, or as part of a sale or reorganisation of the business (you would be told first).

International transfers

We are based in the United States and our providers store data there. If you are in the United Kingdom, the European Economic Area or Switzerland, transfers rely on the standard contractual clauses and data-processing agreements offered by our providers, and on adequacy decisions where they apply.

How long we keep it

Account and report data: while your account is open, then deleted within 90 days of your request to close it.
Orders, subscriptions and invoices: 7 years after the transaction, for tax and accounting.
Support emails and bookings: up to 3 years.
Technical logs: a short period set by our providers, typically 30 days or less.
Consent records: for as long as the consent is relied on, plus 3 years.

Your choices and rights

Access, correct, delete or export your data: email us. We respond within 30 days (45 days for certain requests under US state law).
Opt out of product emails: use the unsubscribe link in any email, or email us.
Withdraw consent at any time; it does not affect what was done before.
Object or restrict processing based on legitimate interest.
Complain to a supervisory authority if you are in the UK or EEA, or to the Florida Attorney General or the Federal Trade Commission in the United States.

We will not treat you differently for exercising any right. We may need to verify who you are first.

Security

Data is encrypted in transit and at rest by our providers. Access to the database is restricted by row-level security so customers can see only their own workspace. Passwords are hashed. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.

Changes

We will post changes here with a new date at the top. If a change materially reduces your rights, we will email account holders first.

Contact

Maru Markets · Ethos Engine · Tampa, Florida, United States · esh@ethosengine.io · +1 (573) 694-0124