Privacy policy
Here we explain what data we process, why, who sees it and how long we keep it. Above all, how you control it.
The operator's legal details are missing: whatever says “to be confirmed” is filled in before publishing.
The essentials, in plain words
- We use your data to provide the service. We do not sell it, advertise with it or train artificial intelligence with it.
- News, offers and tips emails are optional and you stop them in one click.
- From your profile you can see what you accepted, change your preferences, download your data and delete your account.
- We apply the European standard (GDPR) as a minimum, even though Venezuela has no general data law yet.
- Cookies that are not necessary, such as advertising ones, start off and only turn on if you accept them.
- We measure how much each business is used without naming people or keeping amounts. Recording which parts you use is optional and starts off.
- If a business closes, its documents stay locked for 10 years, because the law requires keeping them, and only open with a valid order.
This summary helps you read; the full text is what counts.
1. Who answers for your data
to be confirmed, RIF to be confirmed, domiciled in to be confirmed, Venezuela, answers for the data of the people who use Merlin: owners and team members.
The data a business records about its customers, suppliers or employees is that business's responsibility; we handle it on its behalf. If you are a customer of a shop that uses Merlin, your request goes to the shop first. If you write to us, we pass it on within 3 business days and help the shop answer it.
2. Laws and standard we follow
In Venezuela your information is protected by the Constitution (articles 28 and 60, which recognize habeas data and privacy), by the principles the Constitutional Chamber of the Supreme Court set in ruling 1318 of 2011 (consent, purpose, quality, limited retention, security and accountability), by the Law on Data Messages and Electronic Signatures and by the Special Law against Computer Crimes.
Because Venezuela does not yet have a general data protection law, we take as a minimum the European Union's General Data Protection Regulation (GDPR), the strictest widely used one. So wherever you live, you get at least what your own law requires.
3. What data we process
Your account data: name, email, phone, encrypted password, language, preferences and the decisions you make about your privacy, with their dates.
Optional data about you: date of birth (to greet you on your birthday), gender, age range and how you heard of us. We ask for it to serve you better and to understand, in overall figures, who uses Merlin. You can leave it out, change it or erase it from your profile.
Business data: name and RIF, branches, registers, products, prices, stock, sales, purchases, documents and the team members with their permissions.
Technical data: paired devices, sign-ins, IP address, browser and a log of sensitive actions (voiding a sale, changing a price, adjusting stock).
Usage data per business: how many operations each business makes per day in each area of the system (sales, inventory, purchasing…). It names nobody and holds no amounts.
Which areas you use, only if you turn on "Help improve Merlin": the areas you used each day, never how many times, what you did or for how much.
How you got here: the campaign or invite link you used, the sign-up steps you went through and, if someone recommended us, who it was.
Payment data for your plan: amount, date, method and reference. We do not keep full card numbers.
What you write to us in support.
We do not collect your precise location, biometric data or data for advertising.
4. What we use it for
To provide the service you signed up for: create your account, sell, keep stock, issue documents, sync your registers and support you. Basis: the contract.
To comply with the law: keep fiscal and payment documents and answer authorities' orders. Basis: legal obligation.
To protect the service: detect unusual access, prevent fraud and stop the same person from opening endless free trials (for this we keep an encrypted fingerprint of the email and the RIF). Basis: legitimate interest, as long as your rights do not weigh more.
To support and improve the service: use the per-business usage figures to see which businesses are active, which need help, where sign-up gets stuck and which areas are used most. Basis: legitimate interest. Those figures name nobody and hold no amounts.
To send you news, offers and tips, record which areas you use, and let Nora, the assistant, read the business's data. Basis: your consent, which you can withdraw at any time without affecting what came before.
To decide where and to whom to advertise Merlin we only use overall figures: how many businesses there are by trade, state or city, and gender and age proportions in groups of at least 10 people. We never upload your personal data to advertising platforms.
5. What we never do
We do not sell or rent personal data. We do not share it for advertising. We do not use your business's data to train artificial intelligence models. We do not make automated decisions that affect you without a person involved.
6. Who can see your data
You and your team, according to the permissions the owner gives them. For example, cashiers do not see costs or margins.
Our staff, only when needed for support or security, under a duty of confidentiality and with every access logged. The usage figures they see hold no amounts.
The providers who help us deliver the service (next section), each only with what it needs.
An authority, only with a valid order. Two people on our team review it, access lasts 2 hours at most, covers only what the order asks for and goes in a register. Unless the order forbids it, we tell you when it opens.
7. Providers who help us
Servers and database: Contabo (region to be confirmed). Network protection and domain names: Cloudflare (global). Service emails: Resend (United States). Backups: provider to be confirmed. The Nora assistant, only if the owner turns it on: Anthropic (United States), which neither keeps the data nor trains on it.
Each processes data only for what we entrust it with. We give 30 days' notice before adding a provider that processes personal data.
8. Data outside Venezuela
Our servers and most of our providers are outside Venezuela. To protect those transfers we use contracts with data protection clauses, encryption in transit and at rest, and we choose providers with recognized standards.
9. Emails and notices
Security, billing and document-change messages always arrive, because you need them.
Product news, offers and tips are three separate options, never pre-ticked, and you can change them in your profile. Every email has a link to stop receiving it in one click; after that, the address gets no more of that kind of email unless you turn it on again.
11. How long we keep data
Account data: while the account is active. When closed, it is deleted after the 30-day grace period. Only an empty record stays, without your name or email, so sales and logs still add up.
Business data: while the business exists in Merlin. When closed, after the 30-day grace period we delete the data that identifies its customers and suppliers, and the rest is kept as the next point says.
Sales, fiscal documents, books, movements, payment records and files of a closed business: 10 years from the closure, in a restricted archive that only opens with a valid order, then deleted. We apply the strictest period in Venezuelan law; if a shorter one is confirmed, we will adjust it and publish it here.
The history of what you accepted: kept for 10 years, without your IP, your browser or data that identifies you directly, because a claim could arise in that period and it serves as evidence for both sides.
Usage figures per business: they name nobody and are kept with the rest of the business data. Which areas you used: up to 35 days; if you turn the option off, it is erased at that moment.
Technical and security logs: up to 12 months. Backups: up to 35 days; if we ever restore one, we re-apply deletions before using it.
12. Your rights
You can know what data we hold and why, correct it, delete it, object to a use, ask us to restrict processing, receive it in a file you can take to another system, and withdraw a consent at any time. You can also go to court through habeas data.
You do almost everything yourself from your profile: see your consents, change your preferences, download your data and delete your account. For the rest, write to to be confirmed from your account's email.
We answer within 15 business days at most, free of charge. We may ask for something to confirm it is you.
13. How an account or a business is closed
From your profile you request closure, confirm with your password and get an email with a link to cancel it. You can download a copy of your data first. For 30 days the account stays locked but intact; then we delete the data and send you a receipt.
If you are on a business's team, your personal data is deleted, but the sales and movements you made stay in the business with an anonymous reference, because they belong to the business.
If you own a business, before closing your account you must transfer it to an admin or close it. Both of you confirm a transfer with your password and it happens 72 hours after the request; until then either of you can cancel it.
To close a business, the owner asks and confirms with their password. The business stops selling at the end of its day and there are 30 days to cancel. After that it is closed, as "How long we keep data" explains.
We do not finish a closure while there is a court or tax order or a fraud under investigation. If a register has unsent sales, we wait up to 7 more days so they are not lost; if they do not arrive, we close and record it.
If you are a customer of a shop, the shop can anonymize you: your name, ID, phone, email, address and notes are deleted, and your sales stop identifying you. What was already printed on a fiscal document does not change, because the law forbids it.
14. Minors
Merlin is for people 18 or older. If we learn an account belongs to a minor, we close it and delete its data.
15. How we protect data
Encryption in transit and in backups, strict isolation between businesses in the database, encrypted passwords, PINs and two-step verification, least privilege for our staff and an audit trail that cannot be edited.
16. If something goes wrong
If a security incident puts your data at risk, we tell you without delay, and within 72 hours of learning of it, with what happened, how it may affect you and what we are doing.
17. Changes to this policy
Each version carries its date and earlier ones stay published. If a change widens the use of your data, we tell you 30 days ahead and ask you to accept it; if it is a use based on consent, we never turn it on without your permission.
18. Contact
Privacy: to be confirmed. Support: to be confirmed. Controller: to be confirmed, RIF to be confirmed, to be confirmed, Venezuela.