Privacy Policy

Information we collect

Identifiers. Your mobile telephone number, which is used to sign you in and to send the messages described in our terms, and the display name you choose.

Gathering information. The gatherings you create or are invited to, including titles, descriptions, dates, locations, your votes, your attendance response, and your answers to questions asked by a host.

Contact organization. The friend groups and contact labels you create. These are visible only to you.

Information provided by others. Names and telephone numbers entered by a host in order to issue an invitation. If you were invited in this way, the number was provided to us by the person who invited you.

Usage information. Limited product analytics recording which screens are used and whether actions succeed or fail, associated with an internal account identifier. We do not record your name or telephone number in analytics, and links to specific gatherings are removed before analytics data is transmitted.

How we use this information

We use personal information to authenticate you, to display your gatherings, to allow participants in a gathering to see who is attending, to send the messages described in our terms, and to monitor whether the service is functioning correctly.

We do not use personal information for advertising, we do not build advertising profiles, and we do not engage in automated decision-making that produces legal or similarly significant effects.

Consent

We collect and use personal information with your consent, which you provide when you create an account. Consent to receive text messages is separate and optional: it is given by selecting a box that is not selected for you, may be left unselected without affecting your account, and is recorded together with the date it was given.

You may withdraw consent at any time by disabling messages in your profile settings, by replying STOP to a message, or by requesting deletion of your account. Withdrawal of consent may prevent the service from functioning, as a telephone number is the only means by which Merri identifies you.

Disclosure of personal information

Other participants in a gathering can see your display name, your attendance response, your votes, and any answers you provide to questions a host has designated as visible to all attendees. Your friend groups and contact labels are never disclosed to other users.

We use the following service providers to operate Merri: Supabase (database and authentication), Twilio (text messaging), Vercel (hosting), Google (location suggestions when you enter a place name), and PostHog (analytics and error reporting). These providers process personal information on our behalf, under contract, and are not permitted to use it for their own purposes.

We may disclose personal information where required to do so by law, by court order, or by a lawful request from a government authority.

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under United States state privacy law.

Where your information is stored

Your account and your gatherings are stored in a database hosted in Canada, in the Montréal region.

Certain service providers operate in the United States, including Twilio, Vercel, Google, and PostHog. Personal information handled by those providers is transferred outside Canada and, while outside Canada, may be accessible to foreign courts, law enforcement agencies, and government authorities under the laws of the jurisdictions in which those providers operate. By using Merri, you acknowledge this transfer.

Retention

We retain your account information and associated gatherings until you request deletion. When a host deletes a gathering, that gathering and all content associated with it are removed. When you request deletion of your account, we remove your profile and the personal information associated with it, except where retention is required by law.

Security

Access to the database is restricted by row-level security so that an account can retrieve only its own information. Data is encrypted in transit, and we do not store passwords, as the service does not use them.

No method of transmission or storage is entirely secure, and we cannot guarantee absolute security. You should take this into account when deciding what information to provide.

Your rights

You may request access to the personal information we hold about you, request that it be corrected if it is inaccurate, and request that it be deleted. To exercise any of these rights, contact us by email. We will respond within thirty days, as required under PIPEDA.

If you are a resident of a United States state with a comprehensive privacy law, including California, Colorado, Connecticut, Texas, and Virginia, you have the right to know what personal information we have collected, to obtain a copy of it, to request its correction or deletion, and to opt out of its sale or of sharing for cross-context behavioural advertising. As stated above, we do not sell or share personal information, so no opt-out is necessary. We will not discriminate against you for exercising any of these rights.

You may designate an authorized agent to submit a request on your behalf. We may ask you to verify your identity before acting on a request, which for most users means confirming control of the telephone number associated with the account.

Questions and complaints

Please contact us first so that we have the opportunity to resolve your concern. If you are not satisfied with our response, you may lodge a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca. Residents of the United States may also contact the attorney general of their state.

Children

Merri is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will delete it. A parent or guardian who believes we may hold such information should contact us.

Changes to this policy

We may update this policy from time to time. Where a change materially affects how we handle personal information, we will provide notice within the service before it takes effect, and we will update the date shown at the top of this page.