1. Who is responsible
Marathon Digital Pte Ltd., Singapore, is responsible for the personal data it handles through the Sparta website, purchase and setup services described here. Contact hello@marathon.sh for privacy questions or requests.
Your organization operates its own Sparta workspace in its Cloudflare account. It is responsible for the policies, evidence, employee records and other information it puts there, including its own notices, permissions, retention and access decisions. This notice does not replace your organization’s privacy notice.
2. Information we handle
Email and purchase records: the email you provide for the free edition or checkout, the edition you are entitled to, order and Stripe payment references, payment or revocation status and relevant timestamps. Stripe collects payment details through its checkout. The Sparta purchase service does not receive your full card number or card security code.
Sign-in and security records: private link and session records, expiration and use status, email delivery status and identifiers, and information needed to protect the service. Cloudflare receives network information such as IP addresses and request details when serving and securing the site. Our setup rate limiter uses a derived IP key.
Installation records: your selected Cloudflare account identifier, release and edition, deployment identifiers, progress, result and installation URL. When you authorize installation, the service processes the Cloudflare authorization token and generates installation secrets needed to provision your workspace.
Correspondence: information you choose to send when asking for help. Please do not email production credentials, raw compliance evidence or unnecessary personal data.
3. Why we use it
We use these records to supply the free or paid edition, verify purchase eligibility, send operational setup links, authenticate access, install the selected release and help recover or support an installation.
We also use necessary records to prevent abuse, investigate payment or security issues, keep appropriate transaction records and meet legal obligations. Setup emails are operational messages; entering an email does not subscribe you to a marketing newsletter.
Where data-protection law requires a legal basis, these purposes rely as applicable on steps to enter into or perform a contract, legal obligations and legitimate interests in securing and operating the service. We use consent where the applicable law requires it.
4. Your self-hosted workspace
The purchase and setup service is separate from the compliance workspace deployed to your account. It does not automatically ingest your workspace’s policy documents, evidence or operational records as part of purchasing or signing in to setup.
Your installation may send data to providers you configure for evidence collection or other features. Public trust-center publication and document sharing are controlled by your organization. Review the installation’s configuration and each connected provider’s terms before using personal or sensitive data.
If you ask us to inspect workspace information for support, that is a separate disclosure you choose to make. Minimize the information you share and agree an appropriate support method first.
5. Providers and disclosures
Cloudflare provides hosting, security, storage, transactional email and the installation infrastructure. The installer uses your authorized Cloudflare access to create and configure resources in your account. Stripe processes payments and provides purchase, refund or dispute events used to manage eligibility.
We disclose information as needed to these providers for the purposes above, to professional advisers where necessary, or where required by law. An authorized corporate reorganization or transfer may also require disclosure subject to applicable safeguards. We do not sell the personal information collected through this Sparta flow.
Cloudflare and Stripe also handle information under their own privacy notices. They may process data in countries outside Singapore or your country. The destination and applicable safeguards depend on the service and arrangement; contact us for information about transfers relevant to your request.
7. Security and retention
The setup flow uses access controls, secure cookies and encryption for sensitive installation credentials. Credentials may be retained in encrypted installation state to support deployment and recovery. Encryption reduces risk but no system can guarantee absolute security. You can manage or revoke authorized access through your Cloudflare account.
We retain purchase, installation and support records for as long as reasonably needed to provide the relevant service, resolve disputes, prevent fraud and meet applicable recordkeeping requirements. Retention depends on the record’s purpose and legal requirements; this notice does not promise a universal automatic deletion period.
A sign-in link, cookie or authorization expiring does not by itself erase all associated database, workflow, email-delivery or provider records. For questions about a particular record or a deletion request, contact hello@marathon.sh. Your organization separately controls retention and deletion in its Cloudflare workspace.
8. Your choices and rights
Depending on the law that applies, you may request access, correction, deletion, restriction or portability of your personal data, object to certain processing or withdraw consent where processing relies on consent. These rights are subject to legal conditions and exceptions.
Email hello@marathon.sh with the request and the email or order concerned. We may need to verify your identity and authority before providing information or changing a record. We may retain information required for legal obligations, security or the establishment or defence of legal claims.
For data held inside a customer’s self-hosted Sparta workspace, contact that organization first. You may also raise a concern with Singapore’s Personal Data Protection Commission or the data-protection authority that applies to you.
9. Updates and contact
We update this notice when the relevant services or practices change. The updated date identifies this version; we will provide any additional notice required by applicable law.
Privacy contact: Marathon Digital Pte Ltd., Singapore. Email hello@marathon.sh.