Privacy policy

This policy explains how TalkMerlin handles personal data. It covers three groups of people: our customers and their team members, people who chat on a website that uses TalkMerlin, and visitors of this website, talkmerlin.com.

Who we are

TalkMerlin is run by Ludovic Verbeeck ("we", "us"). Write to [email protected] about anything in this policy.

In short

• Data is stored in the EU, on Hetzner servers.
• Before a visitor starts a chat, nothing is stored on their device.
• Chats are deleted on a schedule: after 30 days on the Free plan, and after 24 months by default on Pro.
• We do not sell personal data and do not use it for advertising.

1. Customers and team members

When you create a TalkMerlin account, or someone invites you to their team, we are the controller of your account data.

What we store

• Your email address and, if you add it, your name.
• Your account: its name, your role (owner or agent), the sites you can see, and your email settings.
• Your sites: their domain names, the chat settings you choose, and your canned replies.
• Whether you are online in the inbox, and when the inbox last saw you.
• The replies you send in chats.
• For Pro: your Stripe customer and subscription IDs and the subscription status. Card details go to Stripe and never reach us.

How you sign in

There are no passwords. We email you a sign-in link that works once. We store only a hash of the link, and delete it a day after it expires. Once you are signed in, the app sets a session cookie on app.talkmerlin.com to keep you signed in. The sign-up and sign-in forms use Cloudflare Turnstile to keep bots out.

Emails we send you

Sign-in links, team invitations, alerts about new and missed chats, and a weekly report for owners. You can turn the alerts and the weekly report off in your profile. Emails sent by our background jobs are kept for 7 days for support, then deleted.

Support access

To help with a support request, our administrator can open the app as a member of your account sees it. Every such session is logged: who opened it, for which account, and when it ended.

Why we use this data

To provide the service you signed up for and to bill you (contract), to meet legal duties such as tax rules (legal obligation), and to keep the service secure and working (legitimate interest).

How long we keep it

For as long as your account is open. To close your account and delete its data, write to [email protected]. Stripe keeps payment records for as long as the law requires.

2. People who chat on a website that uses TalkMerlin

When a website runs the TalkMerlin chat, the owner of that website is the controller of the chat data. We are their processor: we store and process the data only to run the chat for them, under our data processing agreement. To use your rights about a chat, contact the website you chatted with. If you write to us instead, we pass your request on to them.

Before you start a chat

Nothing is stored on your device. To count your visit, we combine your IP address, your browser's user agent and the site with a random value that changes every day, and keep only the result (a hash). The random value of the previous day is deleted, so an older hash can never be traced back. Your IP address itself is not stored.

We also record the pages you view on that site (address, title and the page you came from), your country (from a header that Cloudflare adds, not from a lookup of your IP address), and how often you visited. This lets the website owner see who is on the site right now.

When you start a chat

The chat saves a random ID in your browser's local storage, so the conversation can carry on across pages. We store your messages, any files you send (up to 10 MB each), and your name and email address if you give them. If you rate the chat, we store the rating and your comment.

If you gave your email address and the website replies after you have left, the reply is sent to you by email. You can also ask the chat to email you a copy of the conversation.

A website can ask the chat to recognise you across days, for example after you accept its cookie banner. Only then is the random ID saved before you start a chat.

How long it is kept

• Visits without a chat: deleted 30 days after the last visit.
• Chats on the Free plan: deleted 30 days after the last message.
• Chats on the Pro plan: deleted 24 months after the last message, unless the website owner sets a period between 1 and 120 months.
• Files: deleted with their chat. Files that were uploaded but never sent are deleted after a day.

The website owner can also export or delete your data from their inbox at any time.

3. Visitors of talkmerlin.com

This website is hosted on Cloudflare Pages and sets no advertising cookies. We count visits with TrackTrendy, a cookieless analytics tool. It records the pages viewed, the site you came from, your device and browser type, your country, and clicks on a few links such as Ask an AI. It does not set cookies.

When the TalkMerlin chat runs on this website and you use it, section 2 applies, and we are the controller of that chat.

Links to other services, such as the Ask an AI links to ChatGPT and Claude, take you to sites with their own privacy policies.

Where data is stored

The app and its database run on Hetzner servers in Germany. Files sent in chats are kept in private Hetzner storage in Finland. Emails are sent and received through Amazon Web Services in Frankfurt, Germany. All services that process personal data for us are listed on the sub-processors page. Some of them are US companies. Where data leaves the EU, the transfer is covered by safeguards the GDPR accepts, such as standard contractual clauses.

Your rights

Under the GDPR you can ask for access to your data, a copy of it, a correction, or its deletion. You can also object to how it is used, or ask us to restrict it. Write to [email protected] and we will answer within one month. You can also complain to the data protection authority in your country.

Changes

When this policy changes, we update this page and the date at the top.