Privacy policy

Who we are and what this covers

Last updated: 1 August 2026.

Mercleo Technologies Inc. ("Mercleo", "we", "us") is a Canadian company headquartered in Toronto, Ontario. This policy explains how we collect, use, disclose and protect personal information when you visit mercleo.com or any of our websites, and when you or your organization use the products and services we make available through a Mercleo account (together, the "Services").

This policy is written to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and other Canadian privacy laws that apply to us, including Quebec's private-sector privacy act as amended by Law 25 where it applies.

Our two roles

We handle personal information in two distinct capacities. Which rights apply, and who answers a request, depends on which capacity we are acting in.

Mercleo as controller. For information about our own website visitors, trial users, account holders and billing contacts, Mercleo decides how and why the information is used. This policy governs that information directly.

Mercleo as processor. Our customers use the Services to manage information about their people: members, donors, contacts, job applicants, employees, event attendees, learners. That information belongs to the customer organization, and we process it on their instructions to provide the Services. If your information is in a Mercleo customer's records, that organization decides how it is used. Contact them first with any request, and we will support them in acting on it. See Privacy and your rights in our Trust centre for how that processing relationship works.

Information we collect

When we act as controller, we collect:

• Account information: your name, email address, organization name and sign-in credentials when you create a Mercleo account.
• Billing information: plan, seat and payment records. Card details are collected and stored by our payment processor, Stripe; we do not store full card numbers.
• Inquiries and beta access requests: the name, work email, organization details and anything you tell us about your organization that you submit through our forms, together with your consent to be contacted.
• Website usage: page views and interactions on our websites, measured with Mercleo Pulse, our own analytics product, and with PostHog. Until you grant consent through our consent banner, analytics stores nothing on your device and records no identifier that would recognize you on a later visit; no advertising trackers are placed without it.
• Support and correspondence: messages you send us, and our replies.

How we use it

We use personal information to:

• Provide, operate, secure and improve the Services.
• Set up and administer accounts, seats and workspaces.
• Process payments and manage subscriptions.
• Respond to inquiries and provide support.
• Send transactional messages about your account, and marketing communications only with the consent Canada's anti-spam legislation (CASL) requires; every marketing message includes a working unsubscribe.
• Detect, investigate and prevent fraud, abuse and security incidents.
• Comply with legal obligations.

What we do not do

• We do not sell personal information.
• We do not use our customers' data (their members, donors, applicants or contacts) for our own marketing.
• We do not place tracking cookies, or store anything else on your device for analytics, before consent.

Service providers

We use a small set of third-party providers to run the Services. Each processes only what its role requires:

• Supabase: databases and authentication infrastructure.
• Vercel: website and application hosting, request logs.
• Cloudflare: file storage for documents and uploads.
• Clerk: authentication for certain products.
• Stripe: payment processing and billing.
• Resend: transactional and campaign email delivery.
• Twilio: SMS delivery and phone verification.
• PostHog: product usage analytics.
• Sentry: error reporting and application monitoring.
• Upstash: infrastructure services such as rate limiting.
• Sanity: help-centre content management.
• OpenAI and Anthropic: AI-assisted features, described at /trust/ai.
• Google: maps and address lookups in the products, and advertising measurement for our own marketing.

Where data is processed

Some of our providers process data outside Canada, including in the United States. Information processed in another country is subject to that country's laws, and may be accessible to its courts, law enforcement and national security authorities under lawful process. We use contractual safeguards with our providers, and we publish provider-level detail (regions and data-processing terms) at /trust/subprocessors as it is verified. See also /trust/data-residency.

Retention

We keep personal information for as long as your account is active or as needed to provide the Services, then as required for legal, tax, accounting and security purposes.

When an account is terminated, an export of the account's data remains available for 30 days. After that window we delete the account's data from live systems within a commercially reasonable period; residual copies in encrypted backups are removed as those backups expire on our backup schedule.

Security

We protect personal information with safeguards appropriate to its sensitivity, including encryption in transit and at rest, access controls and monitoring. No system is perfectly secure and we do not claim ours is, but how we approach it is documented at /trust/security, and if a breach affecting your information creates a real risk of significant harm we will notify you and the Privacy Commissioner as the law requires.

Your rights

You may ask us for access to the personal information we hold about you as controller, ask us to correct it, or withdraw consents you have given (withdrawing consent may limit which Services we can provide). Quebec residents have additional rights under Law 25, including data portability and the right to complain to the Commission d'accès à l'information. If you are outside Canada, we honour the rights your local law gives you to the extent it applies to us.

To exercise any of these, contact our privacy officer at privacy@mercleo.com. We respond within the timelines the law sets; under PIPEDA that is normally 30 days. If you are unsatisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada.

If your information is held in a Mercleo customer's records, direct your request to that organization. Requests that reach us directly will be passed to that organization, and we will support it in meeting its statutory deadlines.

Children

The Services are built for organizations and are not directed to children. We do not knowingly collect personal information from children under 13 for our own purposes.

Changes to this policy

We will update this policy as the Services evolve. Material changes are announced on this page with a new "last updated" date, and, where the change meaningfully affects account holders, by notice to the account's administrative contact.

Contact

Privacy officer, Mercleo Technologies Inc., Toronto, Ontario, Canada. Email privacy@mercleo.com.