Privacy Policy

Account data: your email address, and the authentication details needed to sign you in.

Website data you submit: the URLs you paste, and the material we retrieve from those pages in order to build a brand profile. That includes page text, screenshots, colors, fonts and logo files.

Campaign data: the briefs you write, the brand profiles you edit, and the ad sets generated for you.

Billing data: handled by our payment processor. We receive a customer reference, your plan, and the status of your payments. We never see or store your full card number.

Technical data: IP address, browser type, and basic usage events, used to keep the service running and to detect abuse.

This section covers the part of Merova that is unusual, and it is the part worth reading closely.

When you paste a URL, we retrieve that page in order to read the brand from it. If the site belongs to someone other than you, any personal data appearing on those public pages, such as a founder's name on an about page or a photograph of staff, may be processed incidentally as part of that retrieval.

We retrieve only publicly accessible pages. We do not attempt to bypass logins, paywalls or access controls, and we honour standard crawling directives.

You are responsible for having the right to submit the URLs you submit. The Terms of Service set out what that means.

To provide the service you asked for: reading a site, generating a brand profile, and producing ad sets. This is performance of our contract with you.

To take payment and keep billing records, which is both contractual and a legal obligation.

To keep the service secure, prevent abuse, and control the cost of generation. This is our legitimate interest.

To improve output quality. Where we use generated assets or your edits for that purpose we do so in aggregate, and you can opt out by writing to us.

We use third-party providers to run the service. Each receives only what it needs, and each processes data on our instructions under a data processing agreement.

OpenAI, to read the site and write ad copy. Page text and screenshots from the sites you submit are sent to this provider as part of generation.

RunPod, to generate the imagery in your ad sets.

Vercel, to host and serve the application.

Supabase, to store your account, brand profiles and generated assets, and to send sign-in emails.

Stripe, to take payment and manage subscriptions.

We do not sell your personal data, and we do not share it for cross-context behavioural advertising.

We operate from the United States, and your data is processed there and in the other countries where the providers listed above run their infrastructure.

If you are in the European Economic Area or the United Kingdom, using Merova means your personal data is transferred outside it. We rely on the European Commission's Standard Contractual Clauses together with the UK Addendum as the safeguard for those transfers.

Account data: for as long as your account is open, and for a short period afterwards to settle billing and handle disputes.

Generated assets and export files: 30 days, after which exports are purged. Your campaigns stay re-generatable from the records we keep.

Billing records: for as long as tax and accounting law requires.

When you delete your account we remove your personal data on the schedule above, except where we are legally required to retain it.

You can ask us to give you a copy of your data, correct it, delete it, or export it. You can object to processing based on legitimate interests, and withdraw consent where we relied on it.

If you are in the European Economic Area or the United Kingdom you may also complain to your local supervisory authority. If you are in California you have rights of access, deletion, correction and portability, and the right not to be treated differently for exercising them.

To exercise any of this, write to privacy@merovaai.com. We respond within the period the applicable law requires, and within 30 days at the latest.

The marketing site sets only what is needed to serve the page. The application sets a session cookie so that you stay signed in.

We do not run advertising or analytics cookies. If that changes, this section will name the tool and what it collects, and you will be asked to consent before it loads.

We encrypt data in transit, restrict access to production systems, and keep the number of people who can reach customer data small.

No service can promise perfect security and we will not claim otherwise. If a breach affects your personal data we will notify you and the relevant authority as the law requires.

Merova is a business tool and is not directed at anyone under 16. We do not knowingly collect their data. If you believe a child has given us data, write to us and we will delete it.

If we change this policy we update the date at the top. For material changes we will tell you by email before they take effect.

Privacy questions and data requests: privacy@merovaai.com

Everything else: support@merovaai.com