Privacy Policy
Version 1.0, November 5, 2026
Merle is run by BD Nova UG (haftungsbeschränkt), Straße der Jugend 18, 14974 Ludwigsfelde, Germany. For anything about your data, write to support@hellomerle.com. We have not appointed a Data Protection Officer, because GDPR Article 37 does not require one for us.
Two roles
Teams using Merle. For the accounts of people who sign in to Merle, we are the controller.
Their customers. When someone sends a message through a feedback button in another company's product, that company is the controller and we process the message on its behalf. If you sent feedback that way, that company's privacy policy applies, and it is the right place to start with a request about your data.
What we hold about teams
| Data | Why | Basis | Kept |
|---|---|---|---|
| Name, email address and picture, from Google, GitHub or the address you give us | Your account and your team | Art. 6(1)(b) | Until your account or workspace is deleted |
| Sign-in cookie | Keeping you signed in | Art. 6(1)(b) | 7 days |
| Activity log: who did what in a workspace | Accountability and security | Art. 6(1)(f) | 1 year |
| IP address | Limiting abuse and rate limits | Art. 6(1)(f) | Used per request, not added to your records |
What we process for those teams
- What the customer wrote or said, and any picture or recording they chose to add.
- The page they were on, what they tapped, and technical details such as the browser.
- If the team's product signs them in: the name, email address, company and plan it passes to us.
Merle never captures what someone types into the team's product, only its length. It never captures request bodies. Recording starts only when the person taps, and form fields are masked. Voice is turned into text and the audio is not kept.
Pictures and recordings are deleted 30 days after a request closes. Messages stay until the team deletes them or its workspace. A deleted workspace can be restored for 7 days, and is then erased.
Where data is and who handles it
Accounts, messages, pictures and recordings are stored in the EU. These companies handle data for us:
| Company | What for | Where |
|---|---|---|
| Cloudflare | Hosting, storage, turning voice into text, bot checks on signup | Stored in the EU; requests are served from the nearest location |
| Anthropic | Sorting messages and reading them back. It receives the message text and the team's open requests and past answers, not account details | United States |
| Resend | Sign-in links and invitations | EU |
| Google, GitHub | Signing in, if you choose them | United States |
| GitHub, Linear | Issues, if a team connects them. The issue holds what the team's settings send | United States |
Transfers outside the EU rely on the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
Cookies
We set one cookie, which keeps you signed in. We use no advertising or analytics cookies. Your browser also stores small settings, such as your theme and unsent drafts.
Your rights
You can ask to see, correct, delete, restrict or export your data, and you can object to processing based on legitimate interest. Write to support@hellomerle.com. You can also complain to a supervisory authority. Ours is Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg.
Changes
When this policy changes we update the version and date above, and we tell workspace admins about changes that matter.