Privacy Policy

Data We Collect

• User Queries & Interactions: We store user queries and interactions to improve our services, provide better responses, and enhance the user experience. This data is used solely for the purpose of service improvement and is handled in accordance with our data protection policies.
• Metadata: We collect timestamps, IP addresses, device/browser details, and related metadata for security and analytics purposes.
• User-Uploaded Content: Documents, text input, videos, and related data uploaded or provided by users for processing and interaction. We strongly recommend scrubbing any personally identifiable information (PII) from content before uploading.
• Your Organization's Role and Ours: For the content your organization uploads to Mereon or records with it, including any personal information in that content, your organization is the controller and Mereon processes it on your organization's behalf and according to its instructions. Your organization is responsible for having the rights and consents that content needs, including from people who appear in a recording, as our Terms of Service describe.
• Payment Information: Billing is handled by Stripe; we do not store payment details.
• Model Training: We use third-party model providers (see the subprocessor list in Section 3). Through their terms or our account settings with each provider, we ensure they do not train their models on your content, and we do not use customer data to train or fine-tune models.

• Uploaded Content & Generated Responses: Retained until the user deletes them.
• Organization Deletion: When an organization owner requests deletion, the organization enters a 30-day retention period during which the request can be reversed. After that period, the organization's uploaded content and generated responses are permanently deleted, within 30 days of the original request. Logs, analytics, and metadata may be retained for operational, security, and compliance reasons.
• Model providers: When we send content or queries to a model provider to operate the service, that provider may process the data under its terms. Where the provider offers zero data retention (or equivalent) for API traffic, we enable it so prompts and outputs are not retained by the provider after the request completes, subject to the provider's documented exceptions (for example safety or legal requirements).

We do not sell user data. We share data with the service providers (subprocessors) below only as necessary to operate the service. Each processes data for the stated purpose under its own terms. Each provider name links to its data-processing terms.

• Hosting & Storage: Amazon Web Services (AWS) for application hosting, database, and file storage.
• Authentication: Google and Microsoft for single sign-on and identity.
• Model Providers: OpenAI, Anthropic, Google, Mistral, xAI (Grok), and TypeSafe process your content and queries to generate answers, lessons, quizzes, and related AI features. TypeSafe returns a decision rather than generated text, and is used to judge whether two topics in your knowledge base describe the same thing. We do not permit these providers to train their models on your content.
• Transcription & Voice: AssemblyAI and Deepgram (speech-to-text) and ElevenLabs (voice) process the audio and video you provide. ElevenLabs also turns the text we narrate, in lesson videos and recorded demos, into speech.
• Media Delivery: Cloudflare for video streaming, image delivery, and related processing.
• Background Processing: Trigger.dev runs the background jobs that process your uploads, including transcription, indexing, and content extraction. Your content passes through it while those jobs run.
• Email & SMS: Resend (email) and Twilio (SMS) for transactional and notification messages.
• Payments: Stripe for billing and subscriptions. We do not store payment card details.
• Analytics & Monitoring: Mixpanel and GrowthBook (product analytics and feature flags) and Sentry (error monitoring, which may include session diagnostics).
• Integrations You Connect: If you choose to connect them, Confluence, SharePoint and Slack exchange data to import or sync the content you authorize.

Mereon offers a command-line tool, @mereon/demo, that your developers can run on their own computers to record a demo of a change to your app and file it in your organization. It runs on the computer it is installed on, and it sends data only when someone runs one of its commands. It collects no analytics and does not check for updates.

• To Mereon: the sign-in it completes in a browser, the recordings, screenshots, narration text and step details it uploads, and the announcements it sends. Mereon handles them as it handles any other content your organization provides, and turns narration text into speech with ElevenLabs.
• To ElevenLabs, directly: narration text, but only when the person running the tool gives it their own ElevenLabs key. That use is under their own ElevenLabs account and terms, and does not pass through Mereon.
• To Playwright's download servers: a request for the browser the tool records with, the first time it records on a computer.

The tool keeps its Mereon sign-ins, and any ElevenLabs key it is given, in files on that computer that only the signed-in user can read. Signing out of an organization revokes that sign-in with Mereon and removes it from the computer, and leaves sign-ins to other organizations and an ElevenLabs key in place. Signing out of everything revokes every sign-in and deletes those files, the ElevenLabs key included, and the key can also be removed on its own. If Mereon cannot be reached, signing out still removes the sign-in from the computer, and the user can end it from their connected apps in Mereon. The tool's open-source license covers its code, and this policy covers what Mereon does with what the tool sends.

• Data Encryption: Data is encrypted in transit. Sensitive data, such as passwords, is encrypted at rest.
• Breach Notification: In the event of a data breach, affected users will be notified within 72 hours of discovery.
• Compliance: We do not currently claim compliance with GDPR, CCPA, HIPAA, or other regulatory frameworks.

• Data Access: Users can log in to view their generated training content but cannot export data at this time.
• Account & Data Deletion: An organization owner can delete their organization, and its data, directly from account settings. If your organization is managed by a partner, you can contact us to request deletion.

• Cookies: We use cookies and similar browser storage for authentication and for product analytics.
• Third-Party Tracking: We use Mixpanel and GrowthBook for analytics and Sentry for error monitoring, which may collect usage and browsing data.

• Model Training: We do not use customer data to train or fine-tune models, and our model providers do not train on your content.
• Risk Mitigation: Mereon does not automate decision-making processes. Generated outputs are for informational purposes only, and users are responsible for verifying content before application.

For privacy-related inquiries, contact us.

Mereon reserves the right to update this Privacy Policy. Changes will be posted on this page.

By using Mereon, you acknowledge and agree to this Privacy Policy.