Privacy Policy

Last updated: 30 July 2026

What we collect

When you create a MergeCase account, we collect the email address you sign up with and the business name you provide. As you use the product, we store the data you enter — clients, bookings, services, staff and payment records — so we can render the app for you.

What we don't do

These promises cover your account data and your clients' data — the records you enter into the product:

We do not sell your data, ever.
We do not share it with advertisers or data brokers.
We do not use your data, or your clients' data, to train AI models.
We do not read individual booking content for any commercial purpose.

We run no analytics and no tracking of any kind inside the product. Once you are signed in, what you do on the dashboard — the pages you open, the bookings you edit, the clients you look up — is not measured and is not sent anywhere. Visitor statistics are limited to our public marketing pages and are described under Analytics below.

Payment data

We never store full credit card numbers on our servers. All card information is handled directly by Stripe, our PCI-compliant payment processor. We only see and store the last four digits, brand, and expiry date for display purposes.

Email & communications

We send transactional emails (booking confirmations, password resets, receipts) to the addresses you and your clients provide. Customer email goes through our service provider Resend. We don't send marketing emails to your clients on your behalf.

Hosting & infrastructure

MergeCase runs on Vercel (application hosting) and Supabase (database). Data is stored in encrypted form at rest and in transit.

Your rights

You can request a full export of your account's data, or permanent deletion of your account, at any time by emailing mergecase.service@gmail.com. We respond within 7 days.

Analytics

We use Google Analytics 4, provided by Google, on our public marketing pages — the home page, About, Terms, Privacy, FAQ and Blog — and on the sign-up page, so we can tell how many visitors go on to create an account. It records the addresses of pages visited, the referring site, an approximate geographic location derived from your IP address, and your device and browser type. Google Analytics 4 does not store IP addresses. The details you type into the sign-up form are never sent to it.

It is deliberately not loaded anywhere else. The signed-in dashboard, the sign-in screen, and the booking pages your clients use are all excluded, so no in-product activity, client record or booking is ever seen by our analytics provider.

You can opt out for every site you visit by installing Google's Analytics Opt-out Browser Add-on, or by blocking analytics cookies in your browser settings. Blocking them does not affect any MergeCase feature.

Cookies

We use two kinds of cookies:

Essential — authentication and your language preference. The product cannot work without these.
Analytics — set on our public marketing pages only. Google Analytics uses first-party cookies (_ga and _ga_*) to tell returning visitors apart and group requests into sessions. These are never set while you are using the dashboard. See Analytics above for how to refuse them.

We do not use cookies to build advertising profiles, and we do not run third-party advertising or retargeting tags.

Changes to this policy

If we make material changes to how we handle data, we'll notify you via email and in-product notice at least 14 days in advance.

Contact

Questions or concerns about your privacy? mergecase.service@gmail.com.