Merlin AI

GDPR overview

GDPR implementation is concrete and documented. The privacy policy, effective 20 January 2026, has a dedicated EEA, UK and Switzerland version, and a twelve-row table maps each processing activity to its purpose, its legal basis (Art. 6(1)(a) consent, (b) contract, (c) legal obligation, (f) legitimate interest) and the region concerned. A Data Protection Officer is named, Sirsendu Sarkar, reachable at dpo@foyer.work, alongside Article 27 representatives in the EU (Rickert Rechtsanwaltsgesellschaft m.b.H., Bonn) and in the UK (Rickert Services Ltd UK). Access, portability, rectification, erasure, objection and withdrawal of consent are offered, with a documented erasure request answered within 30 days. Transfers rely on standard contractual clauses and adequacy decisions, DPAs are available to enterprise customers, and CCPA rights are covered separately. One reservation: full SOC 2, GDPR and ISO compliance is guaranteed only on plans priced at USD 5 per month or more.

Who owns the data?

Users keep ownership of what they put in. The privacy policy states that You retain ownership of your input prompts and any original content you provide, and that the publisher does not claim ownership of AI outputs generated for you. In exchange, users must hold the rights to whatever they submit and remain responsible for verifying and using the outputs. Foyer Tech Inc. commits to never selling personal data and confirms that account holders keep full ownership of it, with deletion of the account and its data available on request, subject to legal retention obligations. Processing is carried out by the publisher and by the subprocessors it names in its privacy policy.

Reuse rights

Outputs can be reused without asking permission, provided the user holds the rights to the input and checks the result. On the publisher's side, data serves the delivery and personalization of the service, communication, fraud prevention, moderation, legal obligations and, with consent, marketing. The Teams page states that Your data is not being used for training AI models, yet the privacy policy still lists developing, testing and improving its AI models, and aggregating usage patterns to refine them under legitimate interest: a tension worth noting. The extension collects Activity Data (visited URLs, referrer, timestamp, user ID, redirections, browser, operating system, navigation type, HTTP status) under consent and can be switched off in Settings; the content of visited pages is not collected unless a feature explicitly uses it. Personal data is not sold, not shared with data brokers and not used for personalized advertising based on Activity Data. On plans below USD 5 per month, anonymized usage collection can be disabled in the profile settings. Automated decisions covering fraud, moderation, personalization and eligibility can be appealed, with human review within 30 days.

Data retention & training

Hosting summary

The pricing FAQ is the most explicit source: With Merlin, all your data is stored in the United States, and another passage on the same page indicates that data is kept on Google Cloud. The privacy policy is looser, referring only to secure servers located in various regions, a contradiction worth flagging since the two statements do not describe the same footprint. On the delivery side, the front end is hosted on Vercel, Cloudflare provides CDN and security, and jsDelivr serves the assets. International transfers are framed by standard contractual clauses, adequacy decisions and other approved mechanisms. The publisher claims encryption in transit and at rest, access controls and regular security audits, together with ISO 27001, AICPA SOC 2 and GDPR certifications, the latter guaranteed only from the USD 5 per month tier upward. Buyers with a data residency requirement should obtain a written commitment before subscribing, since no region-level guarantee is published.