Privacy Policy
Effective 2026-09-05 · Version 2026-09-05
Merovis ("we") operates the Merovis apps and website. This policy explains what personal data we collect, why, and your rights.
Data controller: contact privacy@merovis.app. For any privacy request, write to that address; we respond within 30 days.
What we collect
Your email address and password (hashed); the books and files you upload; your annotations, notes, reading progress, and highlights; the questions and prompts you send to AI features; payment and subscription metadata — website and desktop purchases are processed by Creem, in-app purchases by Apple (App Store) or Google (Play Store); we never see or store your card number, and we store the subscription identifiers and payment-event records those processors return (such as transaction and purchase tokens, and records that may include your processor customer ID and email) to keep your entitlements in sync; limited device/account preferences. If you join the waitlist, we also store your email address, language preference, and your answers to a short reading-habits questionnaire, used to invite you and improve Merovis — ask us to delete them at any time. We process IP addresses transiently for rate-limiting and abuse prevention (kept in short-lived cache, not in our database).
AI features share content with third parties
When you use translation, explain/summarize, PDF table-of-contents, chat, or infographic features, we send the relevant text — selected passages with surrounding context, chapter text, or your typed prompts — to our AI providers: OpenRouter (United States), which may route your request to downstream model providers (such as OpenAI, Anthropic, or Mistral); MiniMax's international API service, operated by Nanonoble Pte. Ltd. (Singapore); and Cloudflare's AI services. Whole-book translation sends the book chapter by chapter. These providers process your content to generate the response and retain it according to their own policies. We do not retain prompts on our servers beyond delivering the response; content you keep — chat history, notes, or AI outputs saved as books or notes — remains part of your data until you delete it. Deleting your account cannot recall content already transmitted to these providers.
Who we share data with (sub-processors)
Cloudflare (hosting, storage, AI services, and bot protection) — various locations; OpenRouter and its downstream model providers (US) — AI; MiniMax international API (Nanonoble Pte. Ltd., Singapore) — AI; Creem (payment processing for website and desktop checkout); Apple (payment processing for App Store in-app purchases); Google (payment processing for Google Play in-app purchases; and when you sign in with Google — we only receive your name, email, and a stable account identifier); Resend (transactional email).
International data transfers
Your data is processed by providers in the United States and other countries. For users in the EEA, UK, and Switzerland, we rely on Standard Contractual Clauses (or an equivalent transfer mechanism) to protect personal data transferred outside those regions.
How long we keep your data
We keep your account data for as long as your account is active. Books you delete are moved to a cloud trash bin and permanently removed after 30 days. You can delete your account and export your data at any time (see below). Note: a small amount of billing and audit data is retained as required for legal, tax, and accounting obligations. Deleted data may persist in platform backups for a limited period before it is overwritten.
Your rights
Depending on where you live, you may have the right to access, correct, delete, export, or restrict the processing of your personal data, and to object to certain processing. To exercise any right, contact privacy@merovis.app. You may also complain to your local data-protection authority.
Merovis is not intended for children under 16. By registering, you confirm you are at least 16 years old.
We protect access tokens with short-lived credentials and store passwords using a one-way salted hash. No security measure is perfect, but we follow current best practices.
We do not use advertising or analytics trackers, and we do not sell your personal data. The website sets a strictly functional login cookie and stores your language and theme choices in your browser's local storage.