This policy covers merlinfield.com, app.merlinfield.com, and the data we handle for customers. It says what we collect, why, how long we keep it, and what you can ask us to do with it.
Merlinfield, Inc., a Delaware corporation, at 3 E 3rd Ave, Ste 308, San Mateo, CA 94401. Write to us at hello@merlinfield.com, or by post.
For the site and your account, we decide how your data is used. For the data a customer sends us for an X-ray, a shadow period, or a guarantee, we act only on the customer's instructions, as their processor under our DPA.
On the site: basic request logs (IP address, browser, pages requested, time). We use no advertising trackers.
When you contact us, book a call, or sign in: your name, work email, company, and what you tell us.
For an X-ray: the files you upload, such as usage exports, invoices, and unit counts. For a shadow period: call metadata from our exporter, which sends an allowlist of fields and never prompt or completion text. For a guarantee: your model calls pass through our endpoint to the provider, and we keep their metadata, never their text.
To answer you, run the X-ray and any shadow period or guarantee you sign up for, bill for it, keep the service secure, and meet our legal obligations. We rely on our contract with you, or our legitimate interest in running and protecting the service.
Sell your data, use it to train models, or use one customer's data to price another's.
The services that host and run Merlinfield, under contracts that limit them to that work, and, during a guarantee, the model providers your calls go to. Every one is on the subprocessors page. Otherwise, we share data only when the law requires it.
On AWS in the United States (us-east-1), encrypted in transit and at rest. Personal data from the EU or the UK moves under the Standard Contractual Clauses.
X-ray files: 90 days after the last step they fed, whether your report, a shadow period, or a guarantee. Shadow-period metadata: 90 days after the period ends, unless a guarantee starts. Guarantee metadata: for the term and 90 days after. Account, contract, and billing records: as long as the law requires. Site logs: up to 30 days.
You can ask to see, correct, export, or delete your data, or object to how we use it. Write to hello@merlinfield.com. We reply within 30 days. You can also complain to your local data protection authority.
The site sets no cookies. The app sets only the cookies it needs to keep you signed in.
When this policy changes, we update the date above. If a change matters to how we use your data, we tell customers and signed-in users by email 30 days before it takes effect.