This policy explains how Covalent API Pty Ltd (trading as Marbles) collects, uses, holds and discloses personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
We collect information you provide when you create an account, connect a bank feed through the Consumer Data Right, connect a payments provider, import data from Xero or MYOB, connect an AI assistant through MCP, or contact us. This includes your name, email, business name, ABN, and the financial, payroll and contact data you store in Marbles. If you run payroll in Marbles, this includes employee names, tax file numbers, superannuation details and pay information you enter.
We also collect limited technical data automatically: IP address, browser type, device information, and usage patterns within the product. This helps us improve the service and diagnose issues.
We do not collect sensitive personal information beyond what is required to operate the platform features you use. Employee data entered for payroll is held on your behalf as the employer and processed only to run payroll and meet your STP and superannuation obligations.
Your data is used to operate the Marbles platform: reconciling and coding transactions, matching documents, generating invoices and reports, running payroll, preparing BAS-ready figures, and powering the automation and AI that perform this work. Where you connect an AI assistant such as Claude, your data is made available to that assistant only within the permissions you grant. We do not sell your data. Aggregated, de-identified patterns may be used to improve classification quality.
We may use your email address to send transactional notifications (reconciliation summaries, approval requests, security alerts, billing) and, with your consent, product updates. You can opt out of marketing communications at any time.
Marbles' primary customer records, accounting data and financial data are stored encrypted at rest and in transit in Australia on AWS Sydney infrastructure (ap-southeast-2). Our primary AI inference occurs in Australia; we absorb the additional cost of local inference as part of our commitment to data security. We use specialist service providers located outside Australia, including in the United States, for limited functions: primarily product analytics, certain AI features and other limited use cases. We review our material subprocessors and apply appropriate contractual, privacy and security controls to the information they process. Marbles is ISO 27001 certified.
We retain your data for the duration of your service and for 7 years following account closure, consistent with ATO record keeping requirements. You may request earlier deletion of non financial personal data (name, email, contact details) at any time, and you can export your full records on any plan.
Under the Australian Privacy Principles, you have the right to access the personal information we hold about you, correct inaccurate information, and make a complaint if you believe we have mishandled your data. We will respond to access and correction requests within 30 days.
To exercise any of these rights, contact us at hello@marbles.ltd. If you are unsatisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
For privacy questions, data access requests, or complaints: hello@marbles.ltd
Covalent API Pty Ltd · Sydney, Australia · ABN 65 652 751 598
This policy was last updated October 2026. We will notify active customers by email of any material changes before they take effect.