Privacy Policy

Last updated: 9 September 2026

1. Introduction

This Privacy Policy explains how Rahee, Inc. ("we", "us", or "our"), a Delaware corporation, collects, uses, stores and protects your information when you use Marlow (the "Service") — a travel service you reach over WhatsApp or Slack, together with our website.

By using the Service, you agree to this Policy. Marlow is invite-only and in beta.

2. Who this is for

The Service is intended for adults booking travel for work. It is not intended for anyone under 18, and we do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it promptly.

3. Information we collect

We aim to keep collection minimal. Depending on how you use the Service, we may collect:

Invite requests

When you ask for an invite on our website, we collect the email address or phone number you give us, and anything you tell us about your next trip. That request is delivered to a private internal channel on Discord, where we read and action it. Discord holds the message contents on our behalf. If we do not invite you, we delete the request.

Account and contact information

Your name, email address, phone number, and — if you use Marlow in Slack — your Slack user and workspace identifiers.

Traveller and booking information

The details an airline requires to issue a ticket: your legal name as it appears on your passport, date of birth, passport number and expiry, nationality, frequent flyer numbers, and a tax number where the ticket needs one. Also your itineraries, tickets, booking references and travel history with us.

Messages

The messages you send us in WhatsApp or Slack, and our replies. That thread is the product, so we store it.

Preferences

What you choose — cabin, seat, airline, the departure times you take and the ones you refuse, and roughly what you pay on a route. This is inferred from the options you pick, not from a form you fill in.

Calendar information, only if you connect it

If you connect Google Calendar, we read events inside the window of a trip you have coming up. We store the start and end times of those events and the email domains of the people on them. We do not store what the events say — not the title, not the description, not the notes, not the attendees' full addresses.

Payment information

Card details are collected and held by our payment processor, not by us. We hold the last four digits, the card brand and the outcome of the transaction, so that we can talk to you about a booking.

Technical information

Device and connection details and usage statistics, collected automatically to keep the Service working and to understand how it is used.

4. How we use your information

To find, price, book, ticket and reissue flights on your instruction.
To watch trips you have booked with us or forwarded to us, and to tell you when something moves.
To learn your preferences so that later trips take one sentence instead of ten questions.
To answer you when you ask for help, including when a person picks up the thread.
To operate, maintain, secure and improve the Service.
To comply with legal, tax and airline settlement obligations.

We do not use your information to advertise to you, and we do not build a profile of you for anyone else's purposes.

5. What we never do

We never ask for access to your inbox, and we never read your mail. A confirmation you forward to us is a message you chose to send.
We never write to your calendar. We do not add, move or cancel anything on it.
We never read your calendar outside a trip window.
We never store the content of your meetings.
We never sell or rent your personal information, and we never share it with advertisers or data brokers.
We never use your data to train a general-purpose AI model, and our providers are contractually prohibited from doing so.

6. Google user data

Connecting Google Calendar is optional. Everything in the Service works without it.

The scope we request

One scope: read-only access to your Google Calendar events. We request no other Google scope. We do not request Gmail access of any kind.

What we do with it

We use it for a single purpose: to notice when something inside your trip window moves, so that we can tell you your flight no longer works and come back with the fix. We read events only within the dates of a trip you have coming up. Outside that window we do not read your calendar.

What we store and what we discard

We store event start and end times and the email domains of attendees, inside your trip windows only. We discard event titles, descriptions, locations, notes, attachments and full attendee addresses. Read-only access shows us changes from the moment we start watching; it gives us no history of anything before that.

Limited Use

Marlow's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer Google user data to third parties except as necessary to provide or improve the Service, to comply with applicable law, or as part of a merger or acquisition. We do not use Google user data for advertising, and we do not allow humans to read it except with your explicit consent for a specific thread, where necessary for security, to comply with applicable law, or where the data has been aggregated and anonymised.

Revoking access

You can revoke our access at any time — tell us in the thread, or remove it from your Google account's security settings. When you revoke it, we stop reading immediately and delete the event times and domains we held.

7. Slack

If you use Marlow in Slack, you or a workspace administrator install the Marlow Slack app. What that means in practice:

What we receive: messages sent to Marlow — in a direct message, or in a channel where Marlow is mentioned or has been added. We also receive the basic profile and workspace identifiers needed to know who is talking to us.
What we do not receive: messages in channels Marlow has not been added to, direct messages between other people, and files you have not shared with Marlow.
What we post: our replies, in the same conversation.
Your workspace's rules apply too. Slack retains and may log conversations under your organisation's own settings and policies, which we do not control.
Removing it: uninstalling the Marlow app from your workspace ends our access at once. Tell us and we will delete the thread history we hold.

8. WhatsApp

If you use Marlow on WhatsApp, we receive the messages you send to our business number, your WhatsApp display name and phone number, and delivery information about our replies. WhatsApp carries the conversation and handles it under its own terms, which we do not control. Blocking our number ends the conversation; tell us and we will delete the thread history we hold.

9. Use of artificial intelligence

We use third-party AI providers to interpret what you have asked for and to draft replies.

What we send: your message, the trip context needed to answer it, and your stored preferences. Where a step does not need identifying details, we do not send them.
What we do not send: your passport number, your payment details, or the content of your calendar events.
On what terms: our providers operate under enterprise agreements that prohibit training on our data and prohibit any use beyond generating a response for us. Data is transmitted over encrypted connections and is not retained by them beyond what is needed to produce that response.
A person is in the loop. Marlow is early. Before a fix reaches you during a disruption, a person reviews it.

You should not send us sensitive personal information that a booking does not require.

We do not sell or rent your personal information. We share only what is needed, with:

Airlines and ticketing systems — your traveller details, because a ticket cannot exist without them.
Our booking and consolidation partners — the same details, to issue and service the ticket.
Our payment processor — the transaction.
The messaging platform you chose — WhatsApp or Slack, as described above.
Discord — invite requests made on our website, delivered to a private internal channel.
Infrastructure and analytics providers — hosting, storage, error monitoring and product analytics, processing on our behalf under contract.
AI providers — as described in section 9.
Legal and corporate — where the law requires it, or as part of a merger, acquisition or sale of assets, in which case we will tell you.

11. Data storage and transfer

Your data is stored on servers in the United States, and may be processed in India and other jurisdictions where we or our providers operate. Where personal data is transferred out of the UK or the European Economic Area, we rely on standard contractual clauses.

12. Retention

Trips, tickets and the records behind them: seven years, because tax and airline settlement require it.
Preferences: for as long as you use the Service.
Calendar event times and domains: deleted when the trip window closes, or immediately if you revoke access.
Messages: two years.
Invite requests we did not act on: deleted.

13. Security

We use reasonable technical and organisational safeguards to protect your information, including encryption in transit, access controls, and separation of payment data into our processor's systems. No method of transmission or storage is completely secure, and we do not claim otherwise.

14. Your rights

Depending on where you live, you may have the right to access, correct, port or delete your personal information, and to object to or restrict certain processing. These rights arise under laws including the California Consumer Privacy Act, the General Data Protection Regulation, and India's Digital Personal Data Protection Act.

Ask in the thread or write to support@hellomarlow.ai, and we will answer within the period the applicable law requires, and in any case within one month.

Deleting everything means the Service stops knowing you, and trip one starts over.

15. Changes to this Policy

If this changes in a way that affects what we do with your data, we will tell you in the thread before it takes effect, and update the date above.

16. Contact

Rahee, Inc., a Delaware corporation. Email support@hellomarlow.ai, or type @human in the thread.