Privacy notice
Effective 3 October 2026 · Contact info@marshalos.co.uk
Registered address, company number and VAT status are awaiting confirmation. Paid orders and subscriptions are not open while these details are incomplete.
Who handles your information
Marshalos Ltd operates this website and business workspace. Contact info@marshalos.co.uk about your information or privacy rights. Our registered address and company number are being confirmed before paid services open.
Information we use
We use account identifiers, your email and profile name, business details, workspace entries, quote requests and correspondence. Workspace records may contain contact details that you choose to add. Hosting and authentication providers also process technical data such as IP addresses, security events and timestamps. Do not upload passwords, payment card details, identity evidence, medical information or other sensitive records to the workspace.
Purposes and lawful bases
We process account and workspace information to provide the service and answer your requests, relying on the contract with you or steps taken at your request before a contract. We rely on legitimate interests to protect accounts, investigate misuse, maintain the service and handle ordinary business enquiries, balanced against your rights. We process records required by law under legal obligation. Where consent is required for optional marketing or tracking, we obtain it separately; creating an account is not marketing consent.
Service providers and transfers
Supabase provides authentication and database services; the Marshalos database is hosted in the London region. Netlify provides website hosting, server functions and access to hosted AI models; Google Gemini may process questions submitted to the Flightdesk assistant. When payments are enabled, Stripe will process payment information and share transaction and subscription identifiers with us; we do not store full card details. Providers may use support systems or subprocessors outside the UK. Where required, transfers must be covered by an adequacy decision or appropriate contractual safeguards. Contact us for details of the arrangements applicable to your information.
How long we keep records
Workspace information is kept while your account is active or until you remove it. Account deletion removes associated workspace and request records from the active database. Provider backups and security logs follow the provider retention schedules. Transaction and dispute records may be retained separately for legal and accounting purposes; the applicable period depends on the transaction and legal requirements. We retain enquiry correspondence only as long as needed to resolve the enquiry and relevant follow-up.
Your rights
Depending on the circumstances, you can request access, correction, erasure, restriction, portability or object to processing based on legitimate interests. You can withdraw consent for consent-based processing without affecting earlier lawful use. Download your workspace data from Business profile or contact us; we may need to verify your identity. We normally respond within one month, subject to lawful extensions. You can complain to the Information Commissioner’s Office at ico.org.uk.
Business records you add
When you put customer or employee information into your workspace, you remain responsible for having a lawful basis, providing appropriate notices and keeping records accurate. Marshalos processes these workspace records to provide the service on your instructions, subject to the data-processing terms. Account administration and our own business records are handled by Marshalos as controller.
Hosted Flightdesk business assistant
When you send a Flightdesk question, the question and a short slice of recent assistant conversation are sent through Netlify AI Gateway to the Google Gemini model to generate a reply. No API key, model or special software is needed on your device. The chat remains in the browser page memory and is not saved as an account transcript. We do not send customer records, private uploaded files or full workspace data to the model. Netlify and the model provider process the message to provide the response, and may operate outside the UK under their applicable terms and transfer safeguards. Server-side abuse controls store limited hashed visitor or account identifiers and usage counts, not message content. Please do not submit passwords, bank card data, medical details or sensitive third-party information. If hosted AI is unavailable, authored guidance works in the browser. Tasks only save to Supabase after your confirmation. Downloading a chat creates a copy you control.
Security and changes
Access to workspace records is restricted to the owning account. Keep a strong unique password, use trusted devices, sign out of shared devices and limit the information you store. No internet service can guarantee absolute security. We update this notice when our processing changes and communicate material changes where appropriate.
Official guidance: Online selling · Returns & refunds · Data protection