Privacy policy · Merlin

This policy explains how Plarza (“we”, “us”) collects, uses and discloses personal information in providing Merlin, an AI assistant for group chats and direct messages, the website at atmerlin.com, and Merlin’s apps for iPhone, Android and the Mac (together, the “Service”). Plarza is a sole trader business based in New South Wales, Australia, and handles personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Merlin stores the messages of everyone in a chat it has been added to, including people who do not have an account. It posts a notice saying so when it joins a chat, except a Discord server, where whoever added it is told instead. Anyone may opt out at any time by sending /forget me in that chat.

Information we collect

Chat content. In each chat Merlin has been added to, we collect:

the text of every message, its sender’s platform identifier, display name and picture, the time it was sent, and any message it replies to;
on Discord, the messages already in the channels Merlin can see when it is added to a server, as well as those sent afterwards;
edits, deletions and emoji reactions;
for attachments, a reference to the file on the chat platform and the text extracted from it, including transcripts of voice notes, audio and video. We do not keep a copy of a file sent on a chat platform. We do keep the files you send Merlin on the website or in its apps; and
the files and notes Merlin writes for the chat, which may include information about its members.

Account information. If you create an account, we collect:

your email address, and your name and profile picture if you sign in with Apple, Google or Discord;
your plan, time zone, and the chat accounts you link;
the people you add as friends: the name you give each, their chat accounts, and whether you trust them;
the IP address and browser or device of each signed-in session;
if you allow notifications in one of Merlin’s apps, an identifier for that device, so we can send them; and
a record of your usage, measured by what each request cost to process. This records how much was processed and when, not what was said.

Connected apps. If you connect an app, such as Gmail, Google Calendar, GitHub, Notion, Linear, Dropbox, mymind or Withings, we store the access credentials for that app, encrypted, including a mymind access key you paste in. Most apps are read only when a request needs them, or when something happens in them that you asked Merlin to watch for. Last.fm listening history, Withings health data (measurements such as weight and blood pressure, sleep and daily activity) and COROS workouts are copied and kept so that Merlin can answer questions about them; unlinking the app deletes the copy. We also log each occasion on which another person’s request reads your connected apps.

Browser sessions. If you connect the Merlin Sync extension in Chrome or Firefox, we sync website logins from all permitted websites. We copy their cookies and available site storage, encrypted, so Merlin can use your website accounts in a cloud browser, which runs in Singapore. Cookies may grant access to your website accounts. The extension does not copy private windows, Firefox containers, browsing history or your password manager. Pausing sync stops new uploads; disconnecting the browser removes its copied sessions and revokes the extension’s access. Sessions can expire or require another sign-in.

Payments. Payments are processed by Polar. We receive your subscription status, not your card details.

How you use the website. We collect what our analytics provider, PostHog, needs to work: which pages you visit, what you click, replays of your visits, your browser and device, the site that sent you, and your approximate location from your IP address. We use it to see how the website is used and where it is confusing or broken. We only record replays of the public pages while you are signed out and, for a new account, of signing up and setting Merlin up for the first time. They hide everything you type and never show your messages. Once you sign in, this is linked to your account and email address, as are account events such as signing up, changing plan or connecting an app. The iPhone, Android and Mac apps send no analytics.

Notifications. If you allow them, Merlin’s apps notify you when Merlin replies. A notification carries the start of the reply, and is delivered through Expo and then Apple or Google.

Cookies. The website sets one cookie to keep you signed in, and one to tell your visits apart for the analytics above. It uses no advertising cookies.

How we use it

We use personal information to:

respond to requests made to Merlin, including searching a chat’s history, running scheduled tasks, and acting in connected apps;
index messages, attachments and notes so they can be searched by meaning as well as by exact words;
maintain each chat’s notes, which Merlin reviews and consolidates once a night;
operate accounts, enforce usage allowances and manage subscriptions;
send sign-in codes and messages about your account or the Service;
secure the Service and prevent abuse; and
comply with the law.

We do not sell personal information, use it for advertising, or use it to train AI models.

Who can see it

Members of the chat. Merlin answers from a chat’s history, so anything said in a chat may be repeated to anyone in that chat. The owner of a chat, being the person who added Merlin to it, and the people they trust can have Merlin change the notes it keeps for that chat. The notes are not shown on the website; those of the chats you own are included in the copy of your data you can download.

Other chats. Merlin sees only the chat it is in. Each of your direct messages with Merlin, on the website and on each chat app you link, is its own conversation, and they share what Merlin remembers about you. In them, Merlin may read every chat you are in, including its files, but it only posts where you asked it. In any other chat, it may search your other chats only if you have allowed it in that chat yourself, and you approve each search. Nobody else can allow it for you.

Connected apps. A connected app is unavailable in every chat until you enable it there. In a group, other members receive only information that does not disclose the content of your data, such as a time when everyone is free, unless you approve otherwise at the time. Merlin will not send, create or change anything in a connected app without your confirmation.

Us. Data is encrypted in transit, and the disk of the server it is stored on is encrypted. Within the database, app credentials and browser sessions are encrypted again, with a key kept apart from it. Backups are encrypted before they leave the server. Data is not end-to-end encrypted, and messages are readable by the Service so that Merlin can search and answer from them. We access it only where necessary to operate or secure the Service, or where required by law.

Authorities. We disclose personal information to law enforcement or other authorities only where required by law.

Service providers

We share personal information with the following providers, only as needed to run the Service:

OpenRouter (United States), which routes requests to AI models.
OpenAI (United States), which provides the AI model.
Microsoft (United States and Europe) and Amazon (United States), which run the same AI model when OpenAI is unavailable. Microsoft also transcribes audio.
Meta (United States), which makes pictures you ask for.
Apple (United States), which provides sign-in with Apple.
Google (United States), which indexes text for search, watches and listens to videos and songs Merlin is asked about, provides sign-in with Google, and provides Gmail and Google Calendar if you connect them.
Exa (United States), which performs web searches and retrieves web pages.
Browserbase (United States), which runs Merlin’s web browser, in Singapore.
Resend (United States), which sends sign-in codes and other email from us.
Expo (United States), which passes notifications to Apple and Google for delivery to Merlin’s apps.
Polar (United States), which processes payments as merchant of record.
PostHog (United States), which stores and analyzes how the website is used.
Proton (Switzerland), which stores off-site backups. Backups are encrypted before they are sent, and Proton cannot read them.

Discord, Telegram, Slack and Matrix deliver messages to and from Merlin, and the apps you connect receive the requests you approve. Each handles that information under its own privacy policy. On Matrix, Merlin’s account is on a server we operate, which keeps its own copy of the rooms Merlin is in.

Where it is stored

The Service runs on servers we operate in Sydney, Australia. The providers above are located overseas, in the countries listed, with the cloud browser in Singapore, and personal information is disclosed to them as described in this policy.

How long we keep it

Messages are kept until they are deleted on the chat platform, until their sender sends /forget me in that chat, or until the chat’s owner deletes the chat. They do not expire otherwise.
Unlinking a chat account deletes everything kept from it: its direct messages with Merlin, the messages and files it sent in any chat, and its picture. Unlinking a connected app deletes it and the data copied from it.
When Merlin loses access to a channel, or the channel is deleted, what was kept from it is deleted.
Earlier versions of Merlin’s notes are kept for 30 days after they are replaced. Events received from connected apps you asked Merlin to watch are kept for 30 days.
Usage records, and the log of each time your connected apps were read, are kept for 400 days. A signed-in session ends after 90 days.
When Merlin is removed from a chat, the chat is archived with its history, which its owner may restore or delete from the dashboard.
Deleting your account deletes your account information, friends, connected apps and the data copied from them, and synced browser sessions. Messages you sent remain in the chats where you sent them. To delete those, send /forget me in each chat. To delete the history of chats you own, delete those chats before deleting your account.
Deleted information may remain in encrypted backups for up to ten months, after which it is overwritten.

Your rights

Opt out. Send /forget me in any chat to delete your messages there and stop new ones being stored. No account is needed.
Access. Download a copy of your data from your account settings, or ask us for one. We email you a code first, to check it is you.
Correction. Change your account details in your account settings, or ask us to correct information we hold about you.
Deletion. Delete your account from your account page, or ask us to delete information we hold about you.

Requests may be made to merlin@plarza.com. We may need to verify your identity before acting on one, and will respond within 30 days. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner, or to the data protection authority where you live.

Age

The Service is not intended for anyone under 18, and we do not knowingly allow them to create accounts.

Changes

We will post any change to this policy on this page and update the date above. If a change is material, we will notify account holders by email before it takes effect.

Contact

Plarza, New South Wales, Australia
merlin@plarza.com