Merve Platform — Privacy Notice
Version 1.0 · Last updated 8 June 2026
This Privacy Notice explains how MERVE LTD ("Merve", "we", "us") — a company incorporated in England and Wales (company number 16438843), whose registered office is at 9 York Place, Leeds, LS1 2DS — collects and uses personal data in connection with the Merve platform (the "Platform") and our website at merve.app.
This Notice should be read alongside our Terms and Conditions. Capitalised terms not defined here have the meanings given in those Terms.
1. Our role under data-protection law
We act in two different roles depending on the personal data:
1.1 We are the controller of personal data that we determine the purposes and means of processing for our own business — for example, the personal data of the individuals who register an Account, the people who contact us, and the visitors to merve.app. This Notice describes that processing.
1.2 We are a processor of personal data that our Customers (and their Authorised Users) upload to, create on, or process through the Platform. The Customer is the controller of that personal data and is responsible for providing privacy information to their own Authorised Users and end users. Our processor obligations are set out in Clause 10 of the Terms.
If you are an Authorised User or learner using a Merve-powered space operated by one of our Customers, please consult that Customer's privacy notice for information about how your personal data is processed in connection with their use of the Platform.
2. The personal data we collect
2.1 Account data. When you register an Account or sign in, we collect your name, email address, password (stored as a salted hash), profile photo (if you provide one), organisation name, role, and authentication-provider identifiers where you sign in with Google or Microsoft.
2.2 Subscription and billing data. When you take a paid Plan we collect billing contact details, billing address, VAT identifiers (where applicable), and limited payment metadata (card brand, last four digits, expiry). Card numbers and other payment details are handled by our payment processor and are not stored on our systems.
2.3 Usage and telemetry. As you use the Platform we record device, browser, IP address, language, time-zone, and event-level telemetry about feature usage and errors. This includes server logs, security logs, and product-analytics events.
2.4 Content you create. Any content you create or upload through your Account — including documents, media, comments, settings and AI-assisted output — is processed to provide the Platform. Where this content contains personal data of third parties, you are the controller of that data and we process it as your processor under Clause 10 of the Terms.
2.5 Support and communications. When you contact us we keep a record of your correspondence (including email, in-app messages, and call notes) and the information you choose to share.
2.6 Marketing data. Where you sign up to the waitlist, request a demo, or opt in to marketing, we collect the information you submit and a record of your communication preferences.
2.7 Cookies and similar technologies. We use cookies and similar technologies as described in Section 8.
3. How we use personal data and our lawful bases
We use personal data only where we have a lawful basis under the UK GDPR. The bases we rely on are:
| Purpose | Personal data | Lawful basis |
|---|---|---|
| Providing the Platform and your Account | Account data, usage and telemetry, content you create | Performance of a contract with you (or the organisation you represent) |
| Taking payment and managing your Subscription | Subscription and billing data | Performance of a contract; legal obligation (tax and accounting) |
| Securing the Platform, preventing abuse, and investigating incidents | Account data, usage and telemetry, security logs | Legitimate interests in protecting Merve, our Customers, and end users |
| Improving the Platform and developing new features | Aggregated and anonymised usage data; limited identifiable telemetry | Legitimate interests in operating and improving our service |
| Responding to your enquiries and providing support | Support and communications data | Legitimate interests in supporting our users; performance of a contract |
| Sending product updates and operational emails | Account and contact data | Legitimate interests in keeping you informed about the service you use |
| Sending marketing emails (where you have opted in) | Marketing data | Consent (which you may withdraw at any time) |
| Complying with our legal and regulatory obligations | Any of the above, as required | Legal obligation |
Where we rely on legitimate interests, we have carried out a balancing test and consider that our interests are not overridden by your interests, rights or freedoms. You may ask us for further information about that assessment at any time.
4. AI features
The Platform includes a moderated AI layer. Where AI features process personal data, that processing is carried out on the Customer's instructions and through sub-processors we engage for that purpose (see Section 5). We do not use Customer Content, or personal data processed on a Customer's behalf, to train AI models except on the Customer's documented instructions.
5. Sharing personal data
We share personal data only as follows:
5.1 Sub-processors and service providers. We share personal data with the sub-processors and service providers that help us run the Platform (for example hosting, video delivery, email delivery, payment processing, analytics, customer support, and AI providers). Each is bound by written terms requiring appropriate confidentiality, security and data-protection commitments. An up-to-date list of our sub-processors — including the name of each provider, the categories of personal data they process, and the country in which they process it — is available on request: contact us at privacy@merve.app.
5.2 Within your organisation. Where you use the Platform under an organisation Account, administrators of that organisation may access usage and audit information relating to Authorised Users.
5.3 Legal and safety. We may share personal data with law-enforcement, regulators, courts, or other authorities where we are required to by law, or where we reasonably consider disclosure necessary to investigate fraud or abuse, to enforce our Terms, or to protect the rights, safety or property of Merve, our Customers, end users, or the public.
5.4 Corporate transactions. If we are involved in a merger, acquisition, financing, reorganisation, bankruptcy, or sale of all or part of our business, personal data may be transferred as part of that transaction, subject to appropriate confidentiality arrangements.
We do not sell personal data, and we do not share it for third-party advertising purposes.
6. International transfers
The Platform is hosted in the UK and the EU. Some of our sub-processors are based in, or process personal data in, countries outside the UK and EEA. Where personal data is transferred outside the UK or EEA, we put in place an appropriate transfer mechanism — typically the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses — together with any supplementary measures we consider necessary to protect the data.
7. How long we keep personal data
We keep personal data only for as long as we need it for the purposes set out in this Notice, and then delete or anonymise it. In particular:
- Account data: kept while your Account is active and for a reasonable period afterwards to allow for re-activation, dispute resolution and security investigations.
- Customer Content (where we act as processor): retained for the duration of the Subscription, and deleted or returned after termination as described in Clause 11.5 of the Terms.
- Subscription and billing records: kept for as long as required by UK tax and accounting law (typically at least six years).
- Support and communications: kept for as long as we need to provide a continuous record of our interactions with you, and to handle any future enquiries or disputes.
- Marketing data: kept until you withdraw consent or otherwise tell us to stop.
- Server logs and security logs: kept for a limited period sufficient to investigate incidents and meet our legitimate-interest purposes.
We may keep personal data for longer where we are required to by law, or where we need to in order to establish, exercise or defend legal claims.
8. Cookies and similar technologies
We use a small number of cookies and similar technologies to:
- Operate the Platform — for example session cookies that keep you signed in, security cookies, and load-balancing cookies. These are strictly necessary and cannot be disabled through our cookie controls.
- Remember your preferences — for example your theme, language or layout choices.
- Measure how the Platform is used — for example to count visits, measure feature uptake, and detect errors. We use privacy-respecting analytics that minimise the personal data we collect.
We do not use advertising or cross-site tracking cookies. Where required by law, we ask for your consent before setting non-essential cookies. You can manage cookies through your browser settings; blocking strictly necessary cookies may prevent parts of the Platform from working.
9. Your rights
Under the UK GDPR you have rights in respect of your personal data, including the right to:
- Be informed about how your personal data is processed (this Notice).
- Access the personal data we hold about you, and receive a copy.
- Rectify inaccurate or incomplete personal data.
- Erase your personal data in certain circumstances (the "right to be forgotten").
- Restrict processing in certain circumstances.
- Object to processing carried out on the basis of legitimate interests (including profiling) or for direct-marketing purposes.
- Data portability — receive your personal data in a structured, commonly used and machine-readable format, and ask us to transmit it to another controller where technically feasible.
- Withdraw consent at any time, where we rely on your consent. Withdrawing consent does not affect the lawfulness of processing before the withdrawal.
- Lodge a complaint with a supervisory authority, including the UK Information Commissioner's Office (ICO) at ico.org.uk.
To exercise any of these rights, contact us at privacy@merve.app. We may need to verify your identity before responding, and we will respond within the timeframes required by law.
If your personal data is held by a Customer using the Platform (for example, because you are an Authorised User of a Customer's space), please direct your request to that Customer in the first instance — they are the controller of that personal data.
10. Children
The Platform is sold to organisations and to individuals acting in a business or professional capacity (see Clause 2.4 of the Terms) and is not directed at children. Where a Customer uses the Platform to deliver content to children, the Customer is the controller of that personal data and is responsible for ensuring an appropriate lawful basis (including, where required, verified parental or guardian consent) and for providing appropriate privacy information to children and their parents or guardians.
11. Security
We maintain appropriate technical and organisational security measures designed to protect personal data against unauthorised or unlawful processing, loss, destruction, damage or disclosure. These include access controls, encryption in transit and at rest where appropriate, network and application security controls, secure software-development practices, and ongoing monitoring. No security measure is perfect, and you are responsible for the security of your Account and credentials.
12. Changes to this Notice
We may update this Notice from time to time. When we make material changes, we will let you know — for example by email or by a prominent notice on the Platform — before the changes take effect. The "Last updated" date at the top of this Notice tells you when it was last revised.
13. Contact us
You can contact us about this Notice or any privacy matter at:
MERVE LTD 9 York Place Leeds, LS1 2DS United Kingdom
Email: privacy@merve.app
If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) — ico.org.uk.