This is an earlier version and is no longer in effect. Read the current version.
Privacy policy
Here we explain what data we process, why, who sees it and how long we keep it. Above all, how you control it.
The operator's legal details are missing: whatever says “to be confirmed” is filled in before publishing.
The essentials, in plain words
- We use your data to provide the service. We do not sell it, advertise with it or train artificial intelligence with it.
- News and offers emails are optional and you stop them in one click.
- From your profile you can see what you accepted, change your preferences, download your data and delete your account.
- We apply the European standard (GDPR) as a minimum, even though Venezuela has no general data law yet.
- Cookies that are not necessary, such as advertising ones, start off and only turn on if you accept them.
This summary helps you read; the full text is what counts.
1. Who answers for your data
to be confirmed, RIF to be confirmed, domiciled in to be confirmed, Venezuela, answers for the data of the people who use Merlin: owners and team members.
The data a business records about its customers, suppliers or employees is that business's responsibility; we process it on its behalf. If you are a customer of a shop that uses Merlin, your request goes to the shop first, and we help it answer.
2. Laws and standard we follow
In Venezuela your information is protected by the Constitution (articles 28 and 60, which recognize habeas data and privacy), by the principles the Constitutional Chamber of the Supreme Court set in ruling 1318 of 2011 (consent, purpose, quality, limited retention, security and accountability), by the Law on Data Messages and Electronic Signatures and by the Special Law against Computer Crimes.
Because Venezuela does not yet have a general data protection law, we take as a minimum the European Union's General Data Protection Regulation (GDPR), the strictest widely used one. So wherever you live, you get at least what your own law requires.
3. What data we process
Your account: name, email, phone, encrypted password, language, preferences and the privacy decisions you make, with their date.
Optional data about you: birth date (to greet you on your birthday), gender, age range and how you heard of us. We ask for it to serve you better and to understand, as overall figures, who uses Merlin. You can leave it out, change it or erase it from your profile.
The business: name and RIF, branches, registers, products, prices, stock, sales, purchases, documents and the team members with their permissions.
Technical data: paired devices, sign-ins, IP address, browser and an audit trail of sensitive actions (voiding a sale, changing a price, adjusting stock).
Your plan's payments: amount, date, method and reference. We do not store full card numbers.
What you write to support.
We do not collect your precise location, biometric data or data for advertising.
4. What we use it for
To provide the service you signed up for: create your account, sell, keep stock, issue documents, sync your registers and support you. Basis: the contract.
To comply with the law: keep fiscal and payment documents and answer authorities' orders. Basis: legal obligation.
To protect the service: detect unusual access, prevent fraud and stop the same person from opening endless free trials (for this we keep an encrypted fingerprint of the email and the RIF). Basis: legitimate interest, as long as your rights do not weigh more.
To send you news and offers, measure usage to improve, and let Nora, the assistant, read the business's data. Basis: your consent, which you can withdraw at any time without affecting what came before.
To decide where and to whom to advertise Merlin we only use overall figures: how many businesses there are by trade, state or city, and gender and age proportions in groups of at least 10 people. We never upload your personal data to advertising platforms.
5. What we never do
We do not sell or rent personal data. We do not share it for advertising. We do not use your business's data to train artificial intelligence models. We do not make automated decisions that affect you without a person involved.
6. Who can see your data
You and your team, according to the permissions the owner gives them. For example, cashiers do not see costs or margins.
Our staff, only when needed for support or security, bound by confidentiality and with every access logged.
The providers who help us deliver the service (next section), each only with what it needs.
An authority, only with a valid order. If the law allows, we tell you before handing anything over.
7. Providers who help us
Servers and database: Contabo (region to be confirmed). Network protection and domain names: Cloudflare (global). Service emails: Resend (United States). Backups: provider to be confirmed. The Nora assistant, only if the owner turns it on: Anthropic (United States), which neither keeps the data nor trains on it.
Each processes data only for what we entrust it with. We give 30 days' notice before adding a provider that processes personal data.
8. Data outside Venezuela
Our servers and most of our providers are outside Venezuela. To protect those transfers we use contracts with data protection clauses, encryption in transit and at rest, and we choose providers with recognized standards.
9. Emails and notices
Security, billing and document-change messages always arrive, because you need them.
Merlin news and offers are two separate options, never pre-ticked, and you can change them in your profile. Every email has a link to stop receiving it in one click; after that, the address never gets that kind of email again.
11. How long we keep data
Account data: while the account is active. When closed, it is deleted after the 30-day grace period.
Business data: while the business exists in Merlin. When closed, it is deleted after the 30-day grace period, except for the following.
Fiscal documents and payment records: the period Venezuelan law requires (to be confirmed), in a restricted archive.
The history of what you accepted: kept, without data that identifies you directly, for the period in which a claim could arise (to be confirmed), as evidence for both sides.
Technical and security logs: up to 12 months. Backups: up to 35 days; if we ever restore one, we re-apply deletions before using it.
12. Your rights
You can know what data we hold and why, correct it, delete it, object to a use, ask us to restrict processing, receive it in a file you can take to another system, and withdraw a consent at any time. You can also go to court through habeas data.
You do almost everything yourself from your profile: see your consents, change your preferences, download your data and delete your account. For the rest, write to to be confirmed from your account's email.
We answer within 15 business days at most, free of charge. We may ask for something to confirm it is you.
13. How an account is deleted
From your profile you request deletion, confirm with your password and get an email with a link to cancel it. For 30 days the account stays locked but intact; then we delete the data and send you a receipt.
If you are on a business's team, your personal data is deleted, but the sales and movements you made stay in the business with an anonymous reference, because they belong to the business.
If you are an owner and there are other admins, you first transfer the business or close it. If you are the only owner, deleting your account closes the business: the subscription stops renewing and, after the 30 days, its data is deleted, except the documents the law requires us to keep.
We do not delete while there is a court or tax order, a fraud under investigation or unsent sales on a register; we tell you if that happens.
14. Minors
Merlin is for people 18 or older. If we learn an account belongs to a minor, we close it and delete its data.
15. How we protect data
Encryption in transit and in backups, strict isolation between businesses in the database, encrypted passwords, PINs and two-step verification, least privilege for our staff and an audit trail that cannot be edited.
16. If something goes wrong
If a security incident puts your data at risk, we tell you without delay, and within 72 hours of learning of it, with what happened, how it may affect you and what we are doing.
17. Changes to this policy
Each version carries its date and earlier ones stay published. If a change widens the use of your data, we tell you 30 days ahead and ask you to accept it; if it is a use based on consent, we never turn it on without your permission.
18. Contact
Privacy: to be confirmed. Support: to be confirmed. Controller: to be confirmed, RIF to be confirmed, to be confirmed, Venezuela.