Privacy Policy

Who We Are

Marathon Simplicity is a digital marketing and CRM agency based in Arlington, TX. We help trade businesses — HVAC, plumbing, electrical, roofing, and landscaping companies — generate more leads and automate their follow-up. This policy covers our client portal and any services delivered through it.

Information We Collect

We collect information that is necessary to provide our services:

• Business information — company name, owner name, trade, address, phone, and email provided when you onboard.
• Lead and contact data — names, phone numbers, and emails of your customers that flow through our system via missed calls, inbound texts, or manual entry.
• Appointment data — scheduled estimates or service calls managed through the platform.
• Communication records — SMS and campaign messages sent through your Twilio number via our platform, and transactional emails sent on your behalf.
• Photos and files — images uploaded to job records, accounting entries, or your business website through the client portal.
• Billing information — your subscription plan and payment method, processed securely through Stripe. We do not store full card numbers — Stripe handles all payment data.
• Facebook Ads data — if you are on the Dominator plan and choose to connect your Facebook account, we store an access token and read your ad account performance data (spend, clicks, impressions, campaigns) to display inside your dashboard. We do not create, modify, or delete your ad campaigns.
• Account credentials — your login email and a securely hashed password managed by Supabase Auth.

How We Use Your Information

• To operate your client dashboard and display your leads, appointments, and reviews.
• To send automated SMS follow-ups on your behalf via Twilio.
• To send transactional email notifications (e.g., new lead alerts) via Resend.
• To generate performance reports and ROI calculations for your account.
• To contact you about your account, billing, or service updates.

Third-Party Services

We use a small number of trusted services to operate the platform. Each handles data under their own privacy policies:

• Supabase — database and authentication (supabase.com)
• Stripe — payment processing and subscription billing. Stripe stores your payment method and billing details under their own PCI-compliant systems (stripe.com)
• Twilio — SMS messaging on your behalf (twilio.com)
• Resend — transactional email delivery (resend.com)
• Meta / Facebook — if you connect your Facebook Ads account on the Dominator plan, we access your ad performance data through the Meta Marketing API. Your Facebook credentials are governed by Meta's Data Policy (facebook.com/policy)
• Anthropic — AI-powered features such as review reply generation and the CRM assistant use Anthropic's Claude API. Data sent to Claude is used only to generate the requested output and is not used to train Anthropic's models (anthropic.com/privacy)
• Vercel — web hosting and deployment (vercel.com)
• Railway — Twilio relay server hosting (railway.app)
• Upstash — rate limiting via Redis to prevent abuse (upstash.com)

We do not share your data with these services beyond what is required to provide the service you signed up for.

SMS Messaging & TCPA Compliance

Marathon Simplicity sends automated SMS messages on behalf of our clients to their customers (e.g., missed call text-backs, appointment reminders, and follow-up sequences). These messages are sent only to individuals who have a prior business relationship with the client or who have opted in to receive communications.

Every automated SMS we send includes or is preceded by a clear opt-out mechanism. Recipients can reply STOP at any time to stop receiving messages. Reply HELP for assistance. Message and data rates may apply.

We comply with the Telephone Consumer Protection Act (TCPA) and all applicable carrier guidelines. We do not send unsolicited bulk SMS and do not send messages to numbers on the National Do Not Call Registry.

Website Hosting for Clients

Clients on eligible plans may publish a single-page business website through our platform. This site is hosted on our infrastructure and is publicly accessible. Any business information, services, pricing, and photos you add to your website will be visible to anyone with the link. You are responsible for ensuring the content you publish is accurate and that you have the rights to any photos you upload.

Billing & Subscriptions

Marathon Simplicity offers subscription plans (Starter, Growth, Dominator) billed monthly through Stripe. Some plans include a 14-day free trial. Your payment method is stored securely by Stripe — we never see or store your full card number.

You can manage, upgrade, or cancel your subscription at any time from the Account page inside your portal. If you cancel, your access continues until the end of the current billing period, after which your portal account will be paused.

Facebook Ads Integration (Dominator Plan)

Clients on the Dominator plan may optionally connect their Facebook Ads account. When connected, we store an OAuth access token and use it to read your ad account performance data (spend, impressions, clicks, leads, and active campaigns) to display inside your Marathon Simplicity dashboard.

We do not create, modify, pause, or delete your Facebook campaigns. We only read performance data. You can disconnect your Facebook account at any time from the Paid Ads section of your portal, which immediately deletes the stored token from our system.

Facebook access tokens expire approximately every 60 days. When your token expires, we stop reading data until you reconnect.

AI-Powered Features

Some features use Anthropic's Claude AI model, including the CRM assistant chat and automated review reply suggestions. When you use these features, relevant data (such as review text, business name, or CRM context) is sent to Anthropic's API to generate a response.

Anthropic does not use this data to train their models. All AI-generated content is suggestions only — you review and control what is published or sent. See Anthropic's privacy policy at anthropic.com/privacy.

Data Security

All data is stored in Supabase (PostgreSQL) with Row Level Security (RLS) enabled. This means your account can only access your own data — no other client can see your leads, contacts, or reports. Connections are encrypted in transit (HTTPS/TLS). Passwords are never stored in plain text.

Data Retention

We retain your data for the duration of your engagement with Marathon Simplicity. If you end your service, you may request deletion of your data and we will remove it within 30 days, except where retention is required by law.

Your Rights

You have the right to:

• Access the data we hold about your business.
• Correct inaccurate information.
• Request deletion of your account and associated data.
• Ask what data we have collected and how it is used.

Contact Us

If you have any questions about this Privacy Policy or want to make a data request, contact us at:

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top. Continued use of the platform after changes means you accept the updated policy.