Privacy Policy
Effective August 13, 2026
Who we are
Marilou is an AI scheduling assistant operated by mmmnt ("we", "us"). Mari, the assistant, schedules over email and text on your behalf, using the calendars you connect. Questions about this policy go to support@marilou.ai.
What we collect
Your Google identity — name, email address, and profile picture — when you sign in. Calendar data from the calendars you explicitly connect, under the roles you assign them. Phone numbers you add and verify. The messages exchanged with Mari and with the people booking time with you. Billing status from our payment processor — we never see or store card numbers.
There is a plain-language inventory of everything we hold, with where it came from and how long it stays, inside your account under Data & rights.
Google user data
Marilou's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically: calendar data is read and written solely to provide the scheduling you asked for — checking availability, placing holds, and filing bookings on the calendar they belong to. A calendar you mark "Busy only" is read as opaque busy spans; its event contents are never read at any boundary. We never use Google user data for advertising, never sell it, and never let humans read it except with your explicit consent, for security, or where the law requires. Google user data is never used to train generalized artificial-intelligence models.
How your data is protected
Every account gets its own encryption key, and your content is sealed under it. OAuth tokens for your calendars live in an encrypted vault, keyed to your account, outside our identity system. Data moves over TLS everywhere. Third-party calendar contents are treated as transient: what other calendars tell us is used and discarded, never written into our permanent records.
Retention and deletion
Your data stays while your account does. Deleting your account schedules the destruction of your account's encryption key: for 7 days you can change your mind, and everything comes back exactly as it was. After that the key is destroyed and verified destroyed — your conversations, appointments, numbers and connections become permanently unreadable, by anyone, including us. Events already on your Google Calendar stay there: that calendar is yours, and Google holds it.
Your rights
You can export your data — we prepare it and send a time-limited link to your primary email alone. You can delete your account, with the grace window described above. Both controls live in your account under Data & rights, and both work without emailing anyone. If you write to support@marilou.ai instead, we honour that too.
Children
Marilou is not directed at children under 16 and we do not knowingly collect their data. If you believe a child has an account, contact us and we will delete it.
Changes to this policy
If this policy changes materially we will tell you — in the product and by email — before the change takes effect. The effective date above always says which version you are reading.