GoHighLevel access
MARVIN installs as a GoHighLevel app. Every data permission it requests is read-only. The one write permission, oauth.write, lets MARVIN mint location tokens from an agency installation and uninstall itself when you disconnect from Settings.
| Permission | What MARVIN uses it for |
|---|---|
contacts.readonly | Contacts and lead attribution |
opportunities.readonly | Pipeline stages, booked, showed, closed, and revenue |
calendars.readonly | Calendar names for booking reports |
calendars/events.readonly | Appointments, shows, and who booked them |
conversations/message.readonly | Call metadata: dials, pickups, speed to lead, recordings |
locations/customFields.readonly | Custom field names used for attribution |
users.readonly | User names on calls and appointments |
locations.readonly | Location names and time zones |
oauth.readonly | Installation and token lifecycle |
oauth.write | Location tokens from an agency install, and uninstalling MARVIN when you disconnect |
Meta access
You connect Meta by signing in with Facebook. MARVIN requests a single permission, ads_read, for read-only ad reporting, and you choose which ad accounts to import inside MARVIN. MARVIN cannot create, edit, or pause ads.
Tokens
Authorization tokens are stored encrypted on MARVIN's servers so scheduled imports can run. They are never sent to browser code or to AI providers.
MCP access for agents
MARVIN MCP is read-only. Each request is authenticated with an agency MCP token, and the token decides which agency's data is returned. Reporting tools default to the last 30 days, date ranges are capped at 365 days, and you can revoke or replace a token from Settings at any time.
Chat and AI features
When you ask MARVIN a question in chat, relevant reporting data may be sent to the AI processors that generate the answer. The Privacy Policy describes those processors and how the data may be used.
Payments
Billing runs through Stripe Checkout. Card details are entered with Stripe; MARVIN never receives them.
Disconnecting and deleting data
Disconnecting an integration stops future imports but does not delete history already in MARVIN. To delete data, follow the data deletion process, and say whether you want an integration disconnected, historical data deleted, or both.
Who operates MARVIN
MARVIN is operated by TCM Strategy LLC. Security questions go to alex@tcmstrategy.com. See also the Privacy Policy and Terms of Service.