Privacy notice
This notice explains which personal data Mergelay processes, why it is needed and the choices available to account holders and workspace members.
EffectiveWho is responsible for the data
The Mergelay operator identified at checkout or on an applicable order form is the controller for account, billing, service-security and support data. For repository content and communications processed on a customer’s instructions, that customer determines the purpose of processing and Mergelay acts as its service provider or processor.
Data we process
We process account and workspace details, authentication records, billing status, selected GitHub repository and pull-request data, drafts and edits, approvals, publication settings, delivery results, integration credentials and support messages. Basic technical logs may include request time, browser or device information and security events.
Purposes and legal bases
We use data to provide the contracted service, authenticate users, analyze selected changes, generate and store drafts, enforce approvals, publish approved content, process payment and support users. We rely on performance of a contract for core service operations, legitimate interests for security and reliability, legal obligations for required records, and consent where applicable law requires it. We do not sell repository content or use it for advertising.
Providers and recipients
Data is shared only as needed with hosting, database, authentication, payment, analytics, support, model and delivery providers, and with the GitHub or destination accounts you connect. Repository content needed for analysis or drafting may be sent to the configured model provider. Approved publications are sent only to destinations selected by your workspace. Those providers also process data under their own terms.
Website analytics
If website analytics is enabled, Mergelay uses Vercel Web Analytics to understand aggregate page visits and referral sources. We do not intentionally send repository content, draft text or email addresses in analytics event names or properties. Where local law requires consent for a measurement technology, it will not be enabled before that consent is obtained.
Retention and deletion
Workspace data is retained while the account is active and only as long afterwards as needed to complete deletion, preserve security and delivery records, meet legal or accounting obligations and expire routine backups. The exact period depends on the data category and those operational or legal needs. You can disconnect integrations or request workspace deletion; content already delivered to another provider must be managed with that provider.
International transfers and security
Some providers may process data outside your country. When required, Mergelay relies on contractual or other lawful transfer safeguards offered by those providers. We use access controls, encryption in transit and operational safeguards intended to protect the service, but no online service can guarantee absolute security.
Your rights and choices
Depending on where you live, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent without affecting earlier lawful processing. Email hello@mergelay.com; we may verify that you control the relevant account or workspace. You may also complain to your local data-protection authority, including the CNIL in France.
Changes to this notice
We will update the effective date and provide reasonable notice if a material change affects how existing account data is used.