Beta policy · 14 September 2026
Privacy notice
Merron is published by NLA Digital OÜ (registry code 17006260), Valukoja tn 8/2, 11415 Tallinn, Estonia, and is currently operating a limited product-validation pilot. This notice explains the data handling for the public MCP connection, private self-service workspace, free assessment and legacy pilot. Further company contact details and a DPA will be added before paid production service is offered.
Public MCP connection
When you use Merron through an MCP-compatible assistant, the selected file excerpts and screening answers in its tool request are sent to Merron. Ask your assistant to show what will be shared and remove secrets and unnecessary personal information first. These public tools perform bounded text inspection and rules-based screening. Merron's application does not persist their inputs, log request bodies, send them to an AI model, or access private workspace cases. Hosting providers can process network metadata and operational logs under their policies. Your AI assistant separately processes and may retain the conversation, submitted excerpts and returned results under its own policies. Public MCP results are not automatically saved to your Merron workspace.
Optional GitHub and private MCP connections
Where enabled, GitHub imports use a separate read-only GitHub App. You choose repositories in GitHub, then product folders and files in Merron. We store your GitHub account identifier, encrypted authorization credentials, temporary scan drafts and the source excerpts you accept, including repository, commit and line references. GitHub source is not executed. Accepted excerpts become part of the case and are included in future copilot and report requests to Anthropic. Private MCP keys let an AI client you choose read one case, its selected evidence and latest saved report; that client may retain the data under its own policies. Keys expire after 30 days and can be revoked from Connections. Merron stores their hashes, not the original keys. Public MCP tools remain separate.
What we collect
For private workspaces we store your account name and email, company and product details, questionnaire answers, uploaded original documents and extracted text, copilot messages, report versions and usage counts. Authentication uses secure session cookies, password credentials handled by Neon Auth, and verification/reset emails. Legacy assessment and pilot-application forms collect the information shown on those forms. Coarse first-party funnel events help us understand the flow; the app does not set analytics cookies.
Why we use it
We process this information to provide your requested workspace and reports, maintain your account, prevent abuse and investigate service failures. The intended legal bases are performance of the requested service, legitimate interests in operating and securing the service, and consent where requested. Do not submit information you are not authorised to share.
Automated processing and AI
When you ask the copilot or generate a report, the case description, answers, extracted document text and relevant conversation/report context are sent to Anthropic. These workspace inputs are not automatically anonymised. Remove unnecessary personal data, secrets and sensitive personal case records. Review source-code excerpts before accepting them as case evidence. The model suggests explanations and actions; a versioned rules engine supplies screening classifications only when the required answers are complete. Outputs can contain mistakes and do not establish legal compliance.
Hosting and processors
Merron uses Vercel for application hosting, Neon for the database and managed authentication, and Anthropic for AI generation. The current Merron database is in Frankfurt, Germany. Database location does not mean all hosting, authentication, email or AI processing stays in the EEA. The current list of providers, what they process and where is on the subprocessors page (/subprocessors). Provider contracts and transfer terms need to be considered for your intended use. Payments are not enabled in this self-service beta.
Access and sharing
Application access to private cases, originals, chat and reports is restricted to the signed-in case owner, with limited case-reading access through private MCP keys the owner explicitly creates. Service providers and authorised operators may access data as needed to operate the service. There are no public document links or automatic submissions to customers, authorities or other third parties. AI processing is an external service as described above.
Retention and deletion
Workspace data remains available until you delete the case or the beta service is retired; automatic age-based deletion is not currently implemented. You can delete originals and extracted text from the case. Quotes already recorded in messages or reports remain until the entire case is deleted. Case deletion removes its documents, messages, reports and run records from the active database. Account details and limited usage counters remain for account administration and abuse prevention. Disconnecting GitHub removes stored GitHub credentials and cancels pending imports; accepted evidence stays saved. The case’s repository-removal control deletes all its repository snapshots, conversations and reports because those outputs can contain source quotes. Uploaded documents and questionnaire answers remain. Temporary drafts stop being usable after 24 hours; expired draft records are removed when the maintenance task runs. Provider backups and logs may retain information under their own retention schedules. Contact us to request account deletion or information about retained data.
Your choices
You can download your reports and original documents, edit questionnaire answers and delete cases in the workspace. You may also request access, correction, deletion, restriction or a portable copy where applicable, object to processing based on legitimate interests, and complain to your local data-protection authority. We verify requests before releasing or deleting another person's data.
Contact
Privacy requests and questions: leonidmoruz90@gmail.com.