Privacy notice

The controller of your personal data is Big and Bold Limited, 30-42 Waring Street, Belfast BT1 2ED, United Kingdom (company number NI694643; ICO registration ZB664791).

Contact us about privacy at info@bigandbold.com or by post at the address above.

When Marque processes brand material or content that a client organisation uploads, submits or asks Marque to make, we usually act as a processor on that organisation’s behalf, under our agreement with them. That includes work Big+Bold’s own team makes in Marque for a client, and a signed-off post we publish for a client when it asks. This notice covers the personal data for which we are the controller, and explains generally how client content is handled.

Your account

• Account details. Your name, work email address, organisation, role in Marque (View only, Member, Approver or Admin) and sign-in records (for example the last time you signed in). Accounts are created by invitation from Big+Bold or your organisation’s administrator.
• Groups. If your organisation uses groups (for example a department, a region or an agency), the groups you belong to.
• Signing in with a work account. If your organisation uses Microsoft or Google sign-in, we receive your name, work email address and an account identifier from Microsoft or Google. We never receive your password.
• Directory sync. If your organisation connects its staff directory, the directory sends us your name, work email address, whether your account is active and the groups you are in, so your access follows your directory.

Your brand

• Your Intelligence Architecture. The brand strategy Big+Bold builds with your organisation, and every version of it. It may name people, for example a spokesperson.
• Asset bank files. Files your organisation uploads (for example logos, imagery, guidelines and templates), with descriptions and tags. These may contain personal data if your organisation includes it.
• Your brand kit. If your organisation uses the brand kit: its logos, colours, type and reference images, set up from your asset bank. Font files are stored privately and used only as their licences allow.

What you ask Marque to read

• Content you submit. Text and creative files you submit to Ask Marque, and the reading returned: its notes, its scores and its verdict. Each reading records who asked, when, the audience and where the piece will run, and the group you were in when you asked, so reports by team stay true if you move later.
• Creative files. A creative file read by Ask Marque is not kept, unless an administrator saves it to the asset bank or it is sent for sign-off, when it is kept with the piece so the approver sees exactly what Marque read. If your organisation uses visual checks, the measurements Marque takes (for example colours and logo placement) are kept with the reading. The file itself is not.
• Fix it. When you use Fix it, the rewrite, its reading and the version you chose to keep.
• The media plan check. The text of a media plan you ask Marque to check is kept with the check.

What Marque makes for your organisation

If your organisation uses Marque to make work, we keep:

• Briefs, social posts, content plans, measurement frameworks and marketing plans. Each draft, with its reading, who asked for it, every edit and who made it. Ask Marque reads every draft before anyone sees it. Drafts that fall short of the line are held back: no one at your organisation sees them, and Big+Bold sees them only to check Marque’s readings. A marketing plan also records who made, reviewed and released each part.
• Your plans. Owned channels, key dates and the readings you add against your measures. These may include people’s names you type in, for example the owner of a channel or a measure.
• Simple brand jobs and your templates. The job, its formats and each piece, with its reading. Images drawn for a reading are deleted once the piece is decided, or after 7 days. Pieces that are signed off are filed in your asset bank.
• Smart fields and data merge. Profile details a person adds for use in templates (for example a job title, a phone number or a photo). Rows from a sheet used to make one piece per row (for example names and job titles). Rows are deleted with their job.
• Editing together. While you work in a design, who is in it and which field each person is in. Each change is saved to the design.

Sign-off and comments

If your organisation uses Sign-off and comments:

• The sign-off record. Who sent each piece to whom, the approver’s decision and note, when, and against which version of the Intelligence Architecture, with every version of the piece.
• Comments and mentions. What you write about a piece or a reading, and who you mention.
• Notices. Notices in Marque. If your organisation turns on email notices, an email to the person concerned. Emails name the piece and link to it. They never carry the work, a reading, a note or a comment.

Reports

• Consistency reports and Usage. If your organisation uses them, they are drawn from the readings above, by person, team, channel, audience and agency.
• Asset use. We record each time an asset is opened, downloaded or used in Marque: by whom, which asset and where. It shows your organisation which assets are fresh and in use.

Connected services

If your organisation connects one of these services, we receive what Marque needs to work with it:

• Your social accounts (LinkedIn, Facebook Pages, Instagram and X). The account or page name and its identifier, and an access token, which we encrypt before it is stored. We never receive your password. For each post: what was posted, to which account, when, who posted it and the network’s reference for it. Disconnecting deletes the token and asks the network to revoke it. If you remove Marque’s access in Facebook or Instagram, Meta tells us, and we delete the access tokens we hold for you. The record of what your organisation posted stays with its sign-off record.
• Slack and Microsoft Teams. When you ask Marque in a channel: your chat identifier, name and work email address (to link you to your Marque account) and the message you sent. A file you attach is read and not kept, as in Marque itself.
• Your assistant, the API and webhooks. Who set up each connection or key, when it was last used and what was asked. Webhooks send your organisation’s systems Marque’s references, verdicts and links, never the work itself.
• Asset libraries. Files your organisation imports from its digital asset manager, with their names and details.
• The connections log. Who connected, linked, renewed or removed each connection, and when.

Each of these services is your organisation’s own, under its own terms with the service. Its own privacy notice explains how it handles your data.

Pilot applications and waitlist sign-ups

If you apply for the pilot or join the waitlist, we collect your name, work email, organisation, how you heard about Marque, and optionally your job title, website and a message. If you arrived through a campaign link, we also keep the campaign tags it carried (its source, medium and campaign name). Campaign tags travel in the page address only. They are never kept in a cookie or in your browser’s storage. To prevent abuse we keep a one-way code made from your IP address and the day, used only to limit repeated applications. It’s kept with your application, for the same period: 12 months after the application is decided, or after you join the waitlist.

Our website

• Visit statistics. On our public pages (not inside Marque), Vercel Web Analytics counts page views: the page, the site that referred you, your country, and your browser and device type. It sets no cookies. A visit is recognised for up to 24 hours by a code made from the request, which isn’t stored, so it can’t identify you. We also count pilot applications, waitlist sign-ups and clicks on Request a demo, with no names or email addresses.
• Embedded video. Big+Bold’s showreel plays in Vimeo’s player. The player loads only when you choose to watch it, with Vimeo’s do-not-track setting on. Vimeo then receives your IP address and browser details and may set its own cookies, as described in Vimeo’s privacy policy.

Technical data

Error reports with personal details removed (no names, email addresses, IP addresses or cookies). Sign-in session cookies, which are essential to keep you signed in. Server logs kept by our hosting providers.

We don’t use advertising or analytics cookies, and we don’t sell personal data.

Ask Marque reads work with a language model, against your brand’s Intelligence Architecture. Marque writes drafts with a language model too, and Ask Marque reads every draft before anyone sees it. The models are provided by Anthropic (see “Who we share it with”).

• Marque advises. People decide. Marque’s readings and verdicts are about content, never about a person. Marque makes no decision about you that has legal or similarly significant effects.
• A person signs off what is published. Marque never approves a piece on its own. The sign-off record says who did.
• What Marque records about its own work. Marque keeps a record of every draft it wrote, its reading, and who signed it off, so your organisation can show how a piece was made.
• Training. We don’t use your content to train models. Anthropic’s commercial terms don’t allow it to train models on what we send, and our Voyage AI account is opted out of Voyage’s use of our data for training.

We use the following service providers (processors) to run Marque. They act on our instructions and under data processing terms:

Services your organisation connects. When your organisation connects its social accounts, Slack, Microsoft Teams, Microsoft or Google sign-in, its staff directory, an assistant or an asset library, Marque sends that service only what the connection needs: a reply in the channel, a post your organisation signed off, a request for a file.

Big+Bold’s team. Big+Bold’s administrators and strategists can see each client organisation’s data in Marque, to set it up, support it and make work for it when asked.

We may also disclose personal data where required by law, or to protect our rights or the safety of others.

Some providers process data outside the UK, in the United States and the European Union, and the services your organisation connects may too. Where that happens we rely on a safeguard UK law provides for the transfer: UK adequacy regulations for the European Union and, for the United States, the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it, or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses in the provider’s data processing terms. Contact us for the safeguard a provider uses.

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• delete it;
• restrict or object to our processing, including processing based on legitimate interests;
• data portability, where applicable;
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects. Marque makes none.

Contact us at info@bigandbold.com to use these rights. If your data is held for your organisation, we may refer your request to them. An administrator can disconnect a connected service at any time, which deletes its tokens.

You can also complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113). We’d appreciate the chance to resolve your concern first.

Access to each organisation’s data is restricted to that organisation’s users, by role and group, and to Big+Bold administrators. Data is encrypted in transit, and files are stored privately with time-limited links. Access tokens for connected services are encrypted before they are stored, and no one signed in to Marque can read them. Changes to connections are logged.

We’ll post updates on this page and change the “Last updated” date. When we add a part of Marque that collects new personal data, we update this notice before it is switched on.