Privacy Policy

Last updated: 2026-07-12

This Privacy Policy explains how Mambo Marketing ("Mambo", "we", "us") collects, uses, and discloses information about you when you use the Scorecard platform (the "Service").

1. Data Controller

Mambo Marketing acts as the data controller for consultant account data and as a data processor for client company data uploaded by consultants.

2. Information We Collect

From Consultants

• Account information: name, email address, Firebase UID
• Usage data: pages visited, features used, timestamps
• Uploaded content: PDF, DOCX, and PPTX documents you upload for analysis

From Clients (via Share Link)

• Access events: IP address, user agent, timestamp, token identifier
• Optional interactions: action item status updates you choose to submit

3. How We Use Information

We use information to:

• Provide the Service (generate assessments, render scorecards)
• Improve the Service (aggregate, anonymized usage analysis)
• Communicate with you about the Service
• Comply with legal obligations

We do not sell personal information. We do not permit our AI subprocessors to train their models on your data.

4. Subprocessors

The Service relies on the following third-party subprocessors.

• OpenAI — LLM inference for tactic assessment and recommendation generation, and storage of uploaded documents in per-company vector stores used to answer assessment queries.
• Perplexity — web research for benchmark discovery and competitive-intelligence analysis.
• Google Cloud Platform — hosting, Cloud SQL, Firebase Authentication.

5. Data Retention

• Consultant account data: retained until account deletion is requested (email privacy@mambomedia.com).
• Company data: retained until the consultant deletes the company, or until account deletion is requested.
• Uploaded documents: stored in OpenAI vector stores for as long as the associated company record exists in the Service, and automatically deleted when the associated company is deleted. Account deletion is available on request via privacy@mambomedia.com and includes deletion of the account's companies and their documents.
• Assessment results and share tokens: retained for the life of the associated company.
• Access logs: pruned after 90 days.
• Backups: 14 days (automated daily) + 7 days of write-ahead logs for point-in-time recovery.

6. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate personal data
• Delete your personal data
• Receive a portable copy of your personal data
• Object to or restrict certain processing

To exercise these rights, email privacy@mambomedia.com. We will respond within 30 days.

7. Security

We apply industry-standard controls: encrypted data in transit (TLS 1.2+) and at rest (Google-managed keys), role-based access control, isolated per-tenant queries, mandatory audit logs on share token access, and security-focused monitoring with alerting on anomalous activity.

8. International Transfers

The Service is hosted in Google Cloud Platform regions in the United States. If you are located outside the United States, your data may be transferred to and processed in the United States, which may have different data protection laws. We rely on Standard Contractual Clauses where applicable.

9. Children's Privacy

The Service is not directed to individuals under 18. We do not knowingly collect information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or an in-app notice. The "Last updated" date at the top reflects the current version.

11. Contact

Privacy questions or data subject requests: privacy@mambomedia.com.