Privacy Policy

Effective July 7, 2026

Marivant is operated by BCK Systems LLC ("Marivant," "we," "us"). This policy explains what information we collect, how we use it, how we share and protect it, and the choices and rights you have. It covers the public website at marivant.io and the Marivant platform at app.marivant.io (together, the "Services").

We act in two different roles, and this policy should be read with that in mind:

• We are the controller of information about the people who visit our site, request access, and hold accounts — we decide how that information is used, and this policy governs it.
• We are a processor (a "service provider" under California law) for the client information a brokerage puts into the platform ("Customer Data"). We handle Customer Data only on that brokerage's instructions, under our customer agreement and Data Processing Addendum (DPA) — not for our own purposes.

Region-specific rights for the EEA/UK and for California are set out in sections 9–11. Questions any time: legal@marivant.io.

1. Information we collect

Information you give us (we are the controller)

• Access applications: when you request access, the name, work email, brokerage, approximate number of active listings, and role you submit.
• Account information: if your brokerage is onboarded — your name, email, phone (optional), and brokerage affiliation.
• Support and communications: what you send us by email or through the Services, and, if you use voice features, the audio of that interaction.

Information we collect automatically (we are the controller)

Standard technical logs (IP address, browser type, pages and features requested, timestamps) and in-product usage events (features used, errors), which we use to operate, secure, and improve the Services. The marketing site stores a single preference in your browser — your light/dark theme choice — and sets no advertising or cross-site tracking cookies.

Customer Data (we are the processor)

The working data you and your team put into the platform — client records, notes, saved searches, shortlists, brochures, and similar materials, which may include information about your own buyers and sellers. The brokerage decides what Customer Data to put in; we process it to provide the Services.

Information we generate

The analysis, summaries, valuations, and other Outputs the Services produce from the above, including with AI assistance.

2. How we use information, and our legal bases

• To provide, operate, and secure the Services and manage accounts — to perform our agreement with you (GDPR Art. 6(1)(b)).
• To review access applications and communicate with you about the Services — our legitimate interest in evaluating and onboarding customers, and to take steps at your request (Art. 6(1)(b) and (f)).
• To secure, debug, prevent abuse, and improve the Services — our legitimate interest in a safe, working product (Art. 6(1)(f)).
• To meet legal obligations and enforce our Terms of Service (Art. 6(1)(c) and (f)).

Where the law requires consent (for example, certain marketing or any non-essential cookies), we rely on your consent and you can withdraw it at any time. We do not sell personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined under California law.

3. Customer Data stays yours

Customer Data belongs to the brokerage that provides it. We process it only to provide and support the Services to that brokerage, on its documented instructions, and we never make one brokerage's Customer Data visible to another. We do not sell it, use it for advertising, or use it to train AI models. If you are an individual whose information appears in a brokerage's Customer Data (for example, a buyer or seller working with a broker), the brokerage is the controller of that information — please contact them to exercise your rights, and we will help them respond. A DPA governing our handling of Customer Data is available to brokerage customers on request.

Contributed Market Data is different from Customer Data. When a brokerage chooses, per record, to contribute a sold price to Marivant's member data co-op, that record is shared inside the member pool de-identified — without the contributing brokerage's name or any client's personal information — under the co-op terms in the Terms of Service. Contributed records are commercial market facts (a vessel, a date, a price or price band); they are never public, never sold, and never attributed. Any personal information that appears in a contribution's private notes stays with the contributing brokerage and is handled as Customer Data.

4. AI processing

Marivant's analyst and voice features are powered by third-party AI providers — currently Anthropic (text analysis) and ElevenLabs (voice). When you use those features, the relevant query and supporting context are processed by those providers under agreements that prohibit them from using your data to train their models. These features are decision support for a human broker, not automated decisions that produce legal or similarly significant effects about anyone; a person is always in the loop. AI output is generated assistance, not advice, and can be wrong — see the Terms.

5. Service providers and subprocessors

We rely on a small set of vendors to run the Services, each under contract, each receiving only what it needs:

• Vercel — hosting and delivery
• Supabase — database, authentication, and storage
• Resend — transactional email
• Anthropic — AI text processing
• ElevenLabs — AI voice

When we engage these providers to process Customer Data, they act as our subprocessors under terms that pass through the protections in our customer agreement. We may add or change providers as the business evolves and will keep this list current; brokerage customers can ask to be notified of subprocessor changes under the DPA. We may also disclose information if required by law, to enforce our terms, or in connection with a merger or sale of our business.

6. International data transfers

We are based in the United States, and our providers may process data there and in other countries. Where we transfer personal information out of the EEA or the UK, we rely on an approved transfer mechanism — the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, and/or the EU-US Data Privacy Framework where the receiving provider is certified. You can ask us for more information about these safeguards.

7. Retention

We keep personal information only as long as we need it for the purposes above, then delete or anonymize it. In practice: access-application data is kept while we evaluate and onboard applicants and for a reasonable record-keeping period after; account and contact data is kept while the account is active; technical logs are kept for a limited period for security and troubleshooting. Customer Data is kept for as long as the brokerage's account is active and, when the account closes, is deleted or returned on request, subject to legal retention requirements and routine backups that age out.

8. Security

We use appropriate technical and organizational measures to protect personal information: encryption in transit and at rest, role-based and least-privilege access, tenant isolation between brokerages, and monitoring, with production-data access limited to those who need it to operate the Services. No method of transmission or storage is ever completely secure, so we cannot guarantee absolute security; if we learn of a breach affecting your personal information, we will notify you and any regulator as required by law.

9. Your rights — EEA and UK

If the GDPR or UK GDPR applies to you, you have the right to access, correct, delete, restrict, or object to our processing of your personal information, to receive it in a portable format, and to withdraw any consent you have given. To exercise these rights, email legal@marivant.io; we will respond within one month, extendable where the law allows, and we may need to verify your identity first. You also have the right to complain to your local data-protection authority (in the UK, the Information Commissioner's Office). Where your information sits inside a brokerage's Customer Data, direct your request to that brokerage as the controller — we will assist them.

10. Your rights — California

If you are a California resident, the CCPA/CPRA gives you the right to know and access the personal information we collect, to correct or delete it, to opt out of any "sale" or "sharing" of it, to limit the use of sensitive personal information, and to not be discriminated against for exercising these rights. As noted above, we do not sell or share personal information, so there is nothing to opt out of; if that ever changes, we will post a "Do Not Sell or Share My Personal Information" choice and honor opt-out preference signals (including Global Privacy Control). To make a request, email legal@marivant.io; we will confirm receipt within 10 business days and respond within 45 days (extendable to 90 with notice), after verifying your identity, and you may use an authorized agent.

11. Cookies and choices

We keep cookies and tracking to a minimum. The marketing site stores only your light/dark theme preference and uses no advertising or cross-site tracking cookies; the platform uses the cookies necessary to keep you signed in and the Services working, plus first-party usage analytics to operate and improve them. Because we do not use advertising cookies, there is nothing to opt out of for advertising; you can also control cookies through your browser settings.

12. Children

The Services are business tools for licensed professionals and are not directed to anyone under 18, and the marketing site is not directed to children. We do not knowingly collect personal information from children; if we learn that we have, we will delete it.

13. Changes

If we change this policy, we will update the date above and, for material changes affecting platform customers, notify account holders by email (and, where the change affects consent-based processing, ask for fresh consent). Continued use of the Services after a change means you accept the updated policy.

14. Contact

BCK Systems LLC (operator of Marivant), a California limited liability company · Rancho Mirage, California · legal@marivant.io. If you are in the EEA or UK, you may also raise a concern with your local data-protection authority (in the UK, the Information Commissioner's Office).