Chocolatecake Privacy Policy

1. Where data is processed

These are distinct processing paths. Visiting the website does not authorize collection of internal Customer records or transmission to a model. Installing the product does not grant Markr access to internal records.

2. Scope and processing roles

This policy covers personal information processed directly by Marker Inc. (Markr) through the public website, product inquiries, contracting and support. Operational data managed by a Customer in its internal Chocolatecake deployment is subject to that Customer’s privacy notice and operating policies.

Providing an installed product does not give Markr the right to collect or inspect all internal Customer data. Where a Customer entrusts personal-information processing to Markr for maintenance or another service, a separate agreement will define the purpose, access, safeguards, return and deletion, and Markr will act within that scope.

3. Information and purposes

The public website has no account registration, login, payment or inquiry form. Inquiries arrive through email sent by the individual; clicking a contact button does not send a message. Do not send unnecessary personal information, passwords, API keys or signing keys. Support material should have personal information removed where possible. Markr does not use confidential material supplied to it for advertising or general-purpose model training.

4. Data within a Customer deployment

Depending on the Customer’s configuration and features, the internal system may process accounts and roles, requesters and handlers, approval, publication and access history, audit records, and assistant conversations and tool-call records. The actual fields, purposes, access and retention depend on the deployed version and the Customer’s operating policies.

Requests for access, correction, deletion or restriction of this information should first go to the organization’s privacy contact. If Markr receives a request concerning entrusted processing, it will cooperate with the Customer. This website notice does not replace the Customer’s own legal notice, consent or outsourcing obligations.

5. Agents, models and data transfers

An employee’s coding agent and the console assistant may connect to a model or gateway selected or contracted by the Customer. Authorized information such as questions, task context and tool results may be sent to that model. The Customer must review the destination, data scope, processing country, retention and training terms and obtain the necessary legal basis and organizational permission.

An internal model processes calls through the internal connection. Selecting an external model or gateway may send information outside the Customer’s network. The gateway operator and final model provider may be different parties. Provider logging, subprocessors and use for training depend on their contracts and settings; this notice does not determine or guarantee those arrangements.

A Customer model connection is not inherently a transfer to Markr. Any material Markr receives through a separate support process is handled for its distinct purpose and scope. Data sent to external collection or inspection environments must also stay within the authorized task; cross-network artifact transfer and model transmissions are separate processing paths.

6. Browser storage and website access

The public website and documentation use browser local storage (localStorage) to remember language and appearance. Preferences may remain until removed by the browser or by clearing site data. You can restrict storage through browser settings, although preferences may then stop persisting.

The current public-site code includes no advertising or visitor-analytics cookies, analytics scripts or collection of internal Customer records. It also includes no feature that combines browser preferences with Customer records to track visitors. Delivering a web page sends connection information such as the IP address and requested URL to the server. Any public-hosting access or security logging and its retention must be disclosed according to the actual operating configuration.

7. Retention and deletion

The retention policy for general deployment inquiries is up to one year after the discussion closes, with earlier deletion when the information is no longer needed. This covers inquiry emails and attachments. Deletion and expiry settings for mailboxes, forwarded copies and backups must be verified against this policy before public operation. Contract records and entrusted Customer data require separately defined fields and periods for contractual and legal needs. The general-inquiry period does not apply indiscriminately to internal operational records.

Deletion methods must match the storage media and actual operating procedures. The scope of deletion for electronic records and email attachments, and the point at which backup copies expire, must be verified before operational use. Records required for a legal obligation or actual dispute are identified by basis, scope and period, separated from other use, and deleted when that need ends. Retention and expiry of backup copies are also covered.

8. Disclosures, providers and international processing

The markr.ai domain used by [email protected] routes incoming email through Google mail servers. Inquiry messages, attachments and information needed to deliver email, such as sender and recipient addresses, pass through that receiving path. Public mail-routing records alone do not establish the contracting entity, actual storage countries, forwarding, backup or retention settings.

Markr does not sell personal information or disclose it to third parties for advertising. Where there is a lawful basis, such as a valid legal request or separate processing requested by the individual, processing is limited to what is necessary. Outsourced tasks such as email and hosting require appropriate contractual and operational safeguards.

Public-operation email and hosting providers and processing countries, and any international-transfer recipient, basis, purpose, information, method, period and refusal options, must be disclosed against the actual contracts. This document remains a review draft pending confirmation of those arrangements. Model, inspection and email services independently selected by the Customer are governed by its agreements and those providers’ policies.

9. Safeguards and individual rights

Safeguards for public operation include purpose-limited access, account and connection protection, encrypted transport, retention and deletion controls, and responsible personnel. Actual implementation must be checked against the operating configuration; drafting this notice does not establish that those safeguards have been validated or implemented. For entrusted processing, the agreed safeguards and incident procedures apply. We will follow any legally required notification or reporting procedures.

Individuals and authorized representatives may request access, correction, deletion, restriction and, where applicable, withdrawal of consent for personal information processed directly by Markr. We will request only the minimum verification of identity or authority and respond under applicable legal time limits and procedures. Any legal restriction and available action will be explained.

Requests concerning information supplied to Markr can be sent to the contact below. Requests about internal Customer systems go through that organization’s contact. Website and product information can be read without sending personal information by email.

10. Contact and policy changes

Markr privacy contact: [email protected]

Material changes to purposes, information, retention or providers will identify the revision date, changes and when they apply. We will provide additional notice or seek consent where required. Changes to entrusted processing follow the applicable agreement and the Customer’s lawful instructions.