Privacy policy
Marmanda collects only what the service needs to work. No data is sold, and no advertising is served.
Last updated: 9 September 2026
Data controller
The controller of your data is the publisher of the service, identified in the legal notice. Any request about your data goes to the contact address stated there.
Data collected
Account data: email address, first name, last name and hashed password. Legal basis: performance of the contract. Retention: for the life of the account, then twelve months.
Garden data: name, declared location, dimensions, aspect, soil, watering, crop preferences, generated plans and the crop journal. Legal basis: performance of the contract. Retention: for the life of the account.
Billing data: the payment provider's customer identifier, amounts, dates and subscription status. No card number is received or stored. Legal basis: legal obligation and performance of the contract. Retention: ten years for accounting records.
Technical data: connection logs needed to keep the service secure. Legal basis: legitimate interest in securing the service. Retention: twelve months at most.
Audience measurement data: pages viewed, journeys, browser and non-directly identifying technical information. It is sent to Google Analytics and PostHog only after your consent. Retention: up to fourteen months in Google Analytics and according to the configured PostHog retention period.
Recipients and processors
Your data is accessible only to the publisher and to its technical processors, bound by contract and confidentiality: the service host, the Stripe payment provider and, only after consent, Google Analytics and PostHog for audience measurement. No data is transferred, rented or sold to another party.
Location and transfers
Service data is hosted in Switzerland by Infomaniak Network SA. Switzerland is covered by a European Commission adequacy decision. Google Analytics and PostHog may process data in the United States after consent; those transfers are governed by their applicable contractual mechanisms and safeguards.
Security
Traffic is encrypted in transit, passwords are stored as non-reversible hashes, and access to gardens is filtered by owner before any read or write.
Your rights
You have the right to access, correct, erase, restrict, object to and port your data, as well as the right to set instructions about its fate after your death. These rights are exercised by writing to the contact address; you get an answer within one month.
Deleting your account
You can ask for your account to be deleted at any time. The gardens, plans and journal entries attached to it are then deleted, except for the accounting records the law requires us to keep.
Complaints
If an answer does not satisfy you, you may lodge a complaint with the French data protection authority, the CNIL.