Privacy policy | Mercleo

Who we are and what this covers

Last updated: 5 October 2026.

Mercleo Technologies Inc. ("Mercleo", "we", "us") is a Canadian company based in Guelph, Ontario. This policy explains how we collect, use, disclose and protect personal information when you visit mercleo.com or any of our websites, and when you or your organization use the platform and services we make available through a Mercleo account (together, the "Services").

This policy is written to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and other Canadian privacy laws that apply to us, including Quebec's private-sector privacy act as amended by Law 25 where it applies.

Our two roles

We handle personal information in two distinct capacities. Which rights apply, and who answers a request, depends on which capacity we are acting in.

Mercleo as controller. For information about our own website visitors, trial users, account holders and billing contacts, Mercleo decides how and why the information is used. This policy governs that information directly.

Mercleo as processor. Our customers use the Services to manage information about their people: members, donors, contacts, job applicants, employees, event attendees, learners. That information belongs to the customer organization, and we process it on their instructions to provide the Services. If your information is in a Mercleo customer's records, that organization decides how it is used. Contact them first with any request, and we will support them in acting on it. See Privacy and your rights in our Trust centre for how that processing relationship works.

Information we collect

When we act as controller, we collect:

Account information: your name, email address, organization name and sign-in credentials when you create a Mercleo account.
Billing information: plan, seat and payment records. Card details are collected and stored by our payment processor, Stripe; we do not store full card numbers.
Inquiries and beta access requests: the name, work email, organization details and anything you tell us about your organization that you submit through our forms, together with your consent to be contacted.
Website usage: page views and interactions on our websites, measured with Mercleo's own analytics (the same Analytics area the platform ships) and with PostHog. Where the law requires consent first, our analytics store nothing and send nothing until you allow them. Elsewhere they start in a cookie-free mode that sets no cookie and keeps nothing that outlives the browser tab. No advertising or cross-site tracking is placed in either case. The full list of what is stored, and for how long, is in our Cookie policy.
Support and correspondence: messages you send us, and our replies.

How we use it

We use personal information to:

Provide, operate, secure and improve the Services.
Set up and administer accounts, seats and workspaces.
Process payments and manage subscriptions.
Respond to inquiries and provide support.
Send transactional messages about your account, and marketing communications only with the consent Canada's anti-spam legislation (CASL) requires; every marketing message includes a working unsubscribe.
Detect, investigate and prevent fraud, abuse and security incidents.
Comply with legal obligations.

What we do not do

We do not sell personal information.
We do not use our customers' data (their members, donors, applicants or contacts) for our own marketing.
Where the law requires consent before analytics, we place no tracking cookies and store nothing on your device for analytics until you allow it. Elsewhere, our first-party analytics set a session key on arrival and you can turn them off at any time — see the cookie policy.

Service providers

We use a small set of third-party providers to run the Services. Each processes only what its role requires:

Supabase: databases and authentication infrastructure.
Vercel: website and application hosting, request logs.
Cloudflare: file storage for documents and uploads.
Clerk: authentication for parts of the platform.
Stripe: payment processing and billing.
Resend: transactional and campaign email delivery.
Twilio: SMS delivery and phone verification.
PostHog: product usage analytics.
Sentry: error reporting and application monitoring.
Upstash: infrastructure services such as rate limiting.
Sanity: help-centre content management.
OpenAI (served on Microsoft Azure) and Anthropic: AI-assisted features, described at /trust/ai.
Google: maps and address lookups in the platform.

Where data is processed

Some of our providers process data outside Canada, including in the United States. Information processed in another country is subject to that country's laws, and may be accessible to its courts, law enforcement and national security authorities under lawful process. We use contractual safeguards with our providers, and we publish provider-level detail (regions and data-processing terms) at /trust/subprocessors as it is verified. See also /trust/data-residency.

Retention

We keep personal information for as long as your account is active or as needed to provide the Services, then as required for legal, tax, accounting and security purposes.

When an account is terminated, an export of the account's data remains available for 30 days. After that window we delete the account's data from live systems within a commercially reasonable period; residual copies in encrypted backups are removed as those backups expire on our backup schedule.

Community features and messages

Organisations that use Mercleo may offer their members community features: a member directory, discussion spaces, comments, reactions and direct messages between members.

What we store. When you post, comment, react, list yourself in a directory or send a message, we store that content and the time it was sent, on behalf of the organisation that runs the community.
Who can see it. Posts and comments are visible to the members who can access that space. You choose whether you appear in the member directory, and which profile details other members can see. A direct message can be read by the people in that conversation. The organisation's staff can review a message only when someone reports it, to deal with the report. If you have email notifications on, the person you message may get an email with a short preview of it; deleting a message later does not remove emails already sent, and anyone can turn previews off in their notification settings.
Blocking. If you block a member, you and that member can no longer see each other anywhere in the organisation's portal, and neither of you can message the other.
How long we keep it. Your posts, comments and messages are kept until you delete them, the organisation deletes them, or your account with that organisation is closed. Deleted content is removed from our live systems straight away and from backups within 30 days.
The organisation's role. For community content, the organisation that runs the community decides how it is used and is the controller. Mercleo processes it for them under our Data Processing Addendum.

Security

We protect personal information with safeguards appropriate to its sensitivity, including encryption in transit and at rest, access controls and monitoring. No system is perfectly secure and we do not claim ours is, but how we approach it is documented at /trust/security, and if a breach affecting your information creates a real risk of significant harm we will notify you and the Privacy Commissioner as the law requires.

Your rights

You may ask us for access to the personal information we hold about you as controller, ask us to correct it, or withdraw consents you have given (withdrawing consent may limit which Services we can provide). Quebec residents have additional rights under Law 25, including data portability and the right to complain to the Commission d'accès à l'information. If you are outside Canada, we honour the rights your local law gives you to the extent it applies to us.

To exercise any of these, contact our privacy officer at privacy@mercleo.com. We respond within the timelines the law sets; under PIPEDA that is normally 30 days. If you are unsatisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada.

If your information is held in a Mercleo customer's records, direct your request to that organization. Requests that reach us directly will be passed to that organization, and we will support it in meeting its statutory deadlines.

Children

The Services are built for organizations and are not directed to children. We do not knowingly collect personal information from children under 13 for our own purposes.

Changes to this policy

We will update this policy as the Services evolve. Material changes are announced on this page with a new "last updated" date, and, where the change meaningfully affects account holders, by notice to the account's administrative contact.

Contact

Privacy officer, Mercleo Technologies Inc., 236 Watson Rd S, Guelph, ON N1L 1C1, Canada. Email privacy@mercleo.com.