Europe Privacy Policy

Effective Date: 20-Jan-2026
Last Updated: 20-Jan-2026

For individuals outside the European Economic Area, United Kingdom, and Switzerland, you can read this version of our Privacy Policy.

We at Foyer Tech Inc (together with our affiliates, "Foyer," "Merlin," "we," "our" or "us") respect your privacy and are strongly committed to keeping secure any information we obtain from you or about you. This Privacy Policy describes our practices with respect to Personal Data that we collect from or about you when you use our websites https://merlin.foyer.work/, https://www.getmerlin.in, browser extensions (Chrome, Edge, Firefox, Safari), mobile applications (iOS and Android), the AI Note Taker app, our API services, and any other related services (collectively, "Services").

1. Data Controller

If you live in the UK, European Economic Area (EEA) or Switzerland, Foyer Tech Inc, with its registered office at 16192 Coastal Highway, Lewes, DE 19958, United States, is the controller and is responsible for the processing of your Personal Data as described in this Privacy Policy.

EU GDPR Representative

Company: Rickert Rechtsanwaltsgesellschaft m.b.H.
Address: Colmantstraße 15, 53115 Bonn, Germany
Email: [email protected]
Phone: +49 (0)228 74 898 0

UK GDPR Representative

Company: Rickert Services Ltd UK
Address: PO Box 1487, Peterborough, PE1 9XX, United Kingdom
Email: [email protected]

2. Personal Data We Collect

We collect personal data relating to you ("Personal Data") as follows:

Personal Data You Provide: We collect Personal Data if you create an account to use our Services or communicate with us as follows:

• Account Information: When you create an account with us, we will collect information associated with your account, including your name, contact information, account credentials, payment information, and transaction history, (collectively, "Account Information").
• User Content: We collect Personal Data that you provide in the input to our Services ("Content"), including your prompts and other content you upload, such as files, images, web-pages, and audio, depending on the features you use.
• Communication Information: If you communicate with us, such as via email or our pages on social media sites, we may collect Personal Data like your name, contact information, and the contents of the messages you send ("Communication Information").
• Other Information You Provide: We collect other information that you may provide to us, such as when you participate in our events or surveys or provide us with information to establish your identity or age (collectively, "Other Information You Provide").

Personal Data We Receive from Your Use of the Services: When you visit, use, or interact with the Services, we receive the following information about your visit, use, or interactions ("Technical Information"):

• Log Data: We collect information that your browser or device automatically sends when you use our Services. Log data includes your Internet Protocol address, browser type and settings, the date and time of your request, and how you interact with our Services.
• Usage Data: We collect information about your use of the Services, such as the types of content that you view or engage with, the features you use and the actions you take, as well as your time zone, country, the dates and times of access, user agent and version, type of computer or mobile device, and your computer connection. We track and store your usage data at times in accordance with 2.4 below.
• Device Information: We collect information about the device you use to access the Services, such as the name of the device, operating system, device identifiers, and browser you are using. Information collected may depend on the type of device you use and its settings.
• Location Information: We may determine the general area from which your device accesses our Services based on information like its IP address for security reasons and to make your product experience better, for example to protect your account by detecting unusual login activity or to provide more accurate responses. In addition, some of our Services allow you to choose to provide more precise location information from your device, such as location information from your device's GPS.
• Cookies and Similar Technologies: We use cookies and similar technologies to operate and administer our Services, and improve your experience. If you use our Services without creating an account, we may store some of the information described in this policy with cookies, for example to help maintain your preferences across browsing sessions. For details about our use of cookies, please read our Cookie Policy.

2.3 Information from Third Parties

OAuth Providers: When you sign in using Google, Apple, or other OAuth providers, we receive basic profile information.

Cloud Storage Services: When you connect cloud storage accounts (e.g., Google Drive, Dropbox), we access only the files you choose to process.

Analytics Providers: We receive aggregated analytics data about Service usage from our analytics partners.

2.4 Usage data

A. Browsing without providing account details You may browse the Platform without creating an account or directly providing your name, email address, phone number, or other similar details. In such cases, we will collect information that your device and browser automatically share when you visit or use the Platform, such as device identifiers, cookie identifiers, IP address, browser type, language, time zone, operating system, referring/exit pages, and usage/activity data (“Usage Data”).

If you choose to register, place an order, submit a request, subscribe, post reviews/feedback, or otherwise use features that require details, you will provide certain information (and you may no longer be able to use the Platform in an anonymous or pseudonymous manner for those features). Wherever practicable, we indicate which fields are mandatory and which are optional. You may choose not to provide optional information; however, you may not be able to use certain services/features that require it.

B. Usage data, analytics, and internal research We may automatically collect and analyse Usage Data about how you interact with the Platform (for example, pages viewed, clicks, searches, time spent, purchase journey steps, error logs, and performance metrics). We use this to:

• operate and improve the Platform and user experience;
• understand usage trends and demand;
• maintain security, prevent fraud, and troubleshoot issues;
• measure the effectiveness of content, features, and promotions.

Where feasible, we analyse such information in aggregated form to understand broad patterns. Aggregation reduces the ability to identify individuals, but some Usage Data (such as IP address or cookie identifiers) may still be capable of being linked to a user/device.

C. User-generated content (reviews, feedback, forums) If you choose to post messages, reviews, comments, feedback, or other content on the Platform (including in message boards, chat rooms, public review areas, or similar features), we will collect and store the information you submit.

• Please avoid posting sensitive personal information in public areas.
• Content you post in public areas may be visible to others depending on the feature design.

We retain such information as reasonably necessary to provide customer support, respond to queries, enforce our terms, resolve disputes, comply with law, and improve the Platform.

2.5 Merlin Extension – Browsing Activity Data If you install the Merlin browser extension and grant the required permissions, the extension collects browsing activity data for pages you visit while the extension is installed and enabled (“Browsing Activity Data”). This may include:

• URL – the web address of each page visited
• Previous URL – the page you were on immediately before visiting the current page
• Referrer – how you reached the page (e.g., via a search engine results page or another website)
• Timestamp – the date and time when you visited the page
• User ID – a unique identifier associated with your Merlin account/profile (or extension installation)
• Redirects – whether your browser was automatically routed through one or more intermediate pages before reaching the final page
• Browser information – browser name/version (e.g., Chrome 120)
• Operating system – device OS (e.g., macOS, Windows, Linux)
• Navigation type – how you navigated (e.g., typed URL, clicked a link, used the back/forward button, reload)
• HTTP status code – whether and how the page responded (e.g., 200, 301, 404)

Storage: Browsing Activity Data is transmitted to our servers and stored in our backend systems and databases.

We do not collect the content of the webpages you visit unless you explicitly use a feature that requires us to process page content (and we will disclose that separately). We do not require you to provide this information to merely browse the internet, but the Extension cannot provide certain features and functionality unless Extension Activity Data is collected and processed. You may disable or remove the Extension at any time through your browser settings, which will stop further collection by the Extension. We retain Extension Activity Data only for as long as reasonably necessary for the purposes described above, unless a longer retention period is required by applicable law or for establishing, exercising, or defending legal claims.

User-Facing Feature & Data Minimisation (Extension Activity Data). We collect and process Extension Activity Data only to the extent strictly necessary to provide the Extension’s user-facing functionality that you actively use on the page you are viewing (for example, enabling page-aware features and requested actions within the Extension). We do not collect Extension Activity Data for unrelated background profiling or any purpose that is not directly connected to delivering the Extension’s user-facing features. Where feasible, we limit collection to the minimum data required for the selected feature and apply technical and organisational controls to reduce the scope, volume, and retention of such data. Merlin collects the URLs of pages you visit while the Extension is enabled to power page-aware features you use. You can turn this off anytime in Settings or by uninstalling the Extension.

2.6. Links to Third-Party Sites

The Platform may contain links to third-party websites/apps/platforms (“Third-Party Sites”). Third-Party Sites may collect information about you (including through cookies or similar technologies) and may have their own privacy practices. We do not control and are not responsible for the privacy practices, security, or content of Third-Party Sites. We recommend reviewing the relevant third party’s privacy policy before sharing information with them.

We may also use third-party service providers (for example, analytics, fraud prevention, hosting, customer support, advertising delivery/measurement) who process information on our behalf under contractual obligations.

3. How We Use Your Personal Data

We use the information we collect to:

3.1 Provide and Improve Our Services

• Process your requests and provide AI-generated responses
• Personalize your experience and remember your preferences
• Develop, test, and improve our AI models and Services
• Analyze usage patterns to enhance functionality

3.2 Communicate with You

• Send service-related notifications and updates
• Respond to your inquiries and provide customer support
• Send marketing communications (with your consent where required)
• Inform you about new features and offerings

3.3 Ensure Safety and Security

• Detect, prevent, and address fraud, abuse, and security issues
• Monitor and enforce compliance with our Terms of Service
• Protect our users, employees, and the public

3.4 Business Operations

• Process transactions and payments
• Provide customer support
• Conduct business analytics
• Manage our business relationships

3.5 Comply with Legal Obligations

• Respond to legal requests and prevent harm
• Comply with applicable laws and regulations
• Establish, exercise, or defend legal claims

We may also aggregate or de-identify Data so that it no longer identifies you and use this information for the purposes described above, such as to analyze the way our Services are being used, to improve and add features to them, and to conduct research. We will maintain and use de-identified information in de-identified form and not attempt to reidentify the information, unless required by law.

3.6 Use of Merlin Extension Browsing Activity Data

We use Activity Data to:

• provide and operate Merlin’s user-facing features within the extension (for example, enabling requested functionality tied to the page you are on);
• maintain security and integrity of the service, detect abuse/fraud, and troubleshoot issues;
• monitor performance (including error and success rates using HTTP status codes), and improve reliability and user experience; and
• perform analytics and internal research to improve our services (including aggregated analysis).

We will limit collection and use of Activity Data to what is necessary for the stated, specific purposes and in line with applicable law.

3.7 Sharing and Transfers of Extension Data

We may share Activity Data with our vetted service providers (data processors) only to the extent necessary to provide or improve Merlin’s services, comply with law, or protect against fraud/abuse, under contractual confidentiality and security obligations. We do not sell Activity Data and do not transfer it to data brokers or use it for personalized advertising.

3.8 Consent and Withdrawal for Extension Data

Where required under applicable law, we process Activity Data based on your consent, which must be free, specific, informed, unconditional and unambiguous and limited to what is necessary for the specified purpose. You can withdraw consent at any time by disabling the relevant extension setting, signing out, or uninstalling the extension (as applicable). Withdrawal will not affect processing already carried out prior to withdrawal, but we will stop processing going forward unless required by law.

4. Your Rights

You have the following statutory rights in relation to your Personal Data:

• Access your Personal Data and information relating to how it is processed.
• Delete your Personal Data from our records.
• Rectify or update your Personal Data.
• Transfer your Personal Data to a third party (right to data portability).
• Restrict how we process your Personal Data.
• Withdraw your consent—where we rely on consent as the legal basis for processing at any time.
• Lodge a complaint with your local data protection authority (see below).

You have the following rights to object:

• Object to our processing of your Personal Data for direct marketing at any time.
• Object to how we process your Personal Data when our processing is based on legitimate interests.

You can exercise some of these rights through your Merlin account. If you are unable to exercise your rights through your account, please submit your request to [email protected].

We hope that we are able to address any questions or concerns you may have. If you have any unresolved complaints with us or our Data Protection Officer, you can reach out to the Irish Data Protection Commission as our lead supervisory authority, or your local supervisory authority. For any unresolved complaints relating to the UK you can reach out to the Information Commissioner's Office and for Switzerland, to the Federal Data Protection and Information Commissioner.

A note about accuracy: Services like Merlin generate responses by reading a user’s request and, in response, predicting the words most likely to appear next. In some cases, the words most likely to appear next may not be the most factually accurate. For this reason, you should not rely on the factual accuracy of output from our partner's models which you are using. Please feel free to reach out to us on [email protected] in case of any requests.

5. Data Transfers

Merlin processes your Personal Data on servers located outside of the EEA, Switzerland and the UK for the purposes described in this Privacy Policy. This includes processing and storing your Personal Data in our facilities and servers in the United States. While data protection law varies by country and these countries may not offer the same level of data protection as your home country, we apply the protections described in this policy to your Personal Data regardless of where it is processed. When transferring Personal Data outside of the EEA, Switzerland or the UK, we rely on the following transfer mechanisms to comply with applicable data protection law:

• We rely on the European Commission's adequacy decisions pursuant to Article 45(1) GDPR when transferring your Personal Data to any country that has been considered to provide an adequate level of protection.
• For other jurisdictions, we rely on the Standard Contractual Clauses ("SCCs") as approved by the European Commission pursuant to Article 46(2)(c) GDPR and on the UK Data Transfer Addendum.

For more information or to obtain a copy of the appropriate safeguards we have in place when transferring Personal Data, please contact us at [email protected].

6. Retention

We'll retain your Personal Data for only as long as we need in order to provide our Services to you, or for other legitimate business purposes such as resolving disputes, safety and security reasons, or complying with our legal obligations. How long we retain Personal Data will depend on a number of factors, such as:

• Our purpose for processing the data (such as whether we need to retain the data to provide our Services);
• The amount, nature, and sensitivity of the information;
• The potential risk of harm from unauthorized use or disclosure;
• Any legal requirements that we are subject to.
• We retain Activity Data only for as long as necessary to fulfil the purposes described above, resolve disputes, enforce our terms, and comply with legal obligations. Where feasible, we apply shorter retention periods for raw browsing logs and retain only aggregated or de-identified analytics thereafter.

7. Security

We implement commercially reasonable technical, administrative, and organizational measures designed to protect Personal Data from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. However, no Internet or email transmission is ever fully secure or error free. Therefore, you should take special care in deciding what information you provide to the Services. In addition, we are not responsible for circumvention of any privacy settings or security measures contained on the Service, or third-party websites.

8. Legal Bases for Processing

8.1

8.2

9. Disclosure of Personal Data

We may disclose your Personal Data in the following circumstances:

• Vendors and Service Providers: To assist us in meeting business operations needs and to perform certain services and functions, we may disclose Personal Data to vendors and service providers, including providers of hosting services, customer service vendors, cloud services, content delivery services, support and safety monitoring services, email communication software, web analytics services, payment and transaction processors, and other information technology providers. Pursuant to our instructions, these parties will access, process, or store Personal Data only in the course of performing their duties to us.
• Business Transfers: If we are involved in strategic transactions, reorganization, bankruptcy, receivership, or transition of service to another provider (collectively, a "Transaction"), your Personal Data may be disclosed in the diligence process with counterparties and others assisting with the Transaction and transferred to a successor or affiliate as part of that Transaction along with other assets.
• Government Authorities or Other Third Parties: We may share your Personal Data, including information about your interaction with our Services, with government authorities, industry peers, or other third parties in compliance with the law (i) if required to do so to comply with a legal obligation, or in the good faith belief that such action is necessary to comply with a legal obligation, (ii) to protect and defend our rights or property, (iii) if we determine, in our sole discretion, that there is a violation of our terms, policies, or the law; (iv) to detect or prevent fraud or other illegal activity; (v) to protect the safety, security, and integrity of our products, employees, users, or the public, or (vi) to protect against legal liability.
• Affiliates: We may disclose Personal Data to our affiliates, meaning an entity that controls, is controlled by, or is under common control with Foyer. Our affiliates may use this Personal Data in a manner consistent with this Privacy Policy.
• Business Account Administrators: When you join a Merlin Teams or business account, the administrators of that account may access and control your Merlin account, including being able to access your Content. In addition, if you create an account using an email address belonging to your employer or another organization, we may share the fact that you have an account and certain account information, such as your email address, with your employer or organization to, for example, enable you to be added to their business account.
• Other Users and Third Parties You Interact or Share Information With: Certain features allow you to interact or share information with other users or third parties. For example, you can share Merlin AI conversations with other users via shared links. You can also send information to third-party applications, such as via integrations, or for searching the web to help answer questions that benefit from more recent information. Information you share with third parties is governed by their own terms and privacy policies, and you should make sure you understand those terms and policies before sharing information with them.

10. Children

Our Services are not directed to, or intended for, children under 14. We do not knowingly collect Personal Data from children under 14. If you have reason to believe that a child under 14 has provided Personal Data to Merlin through the Services, please email us at [email protected]. We will investigate any notification and, if appropriate, delete the Personal Data from our systems. Users under 18 must have permission from their parent or guardian to use our Services.

11. Account Registration and Login

We offer users the ability to register and log in to our platform either by creating a dedicated account or by using a third-party authentication provider such as Google.

11.1 Standard Registration

When registering using the standard form, the following personal data is collected and marked with an asterisk (*) to indicate that it is required for account creation:

• Name* – Used to personalize your account and communications.
• Email Address* – Used for account identification, communication, and password recovery.
• Password* – Used to securely access your account. Passwords are stored in encrypted form and cannot be accessed by us.

These data fields are mandatory in order to create and maintain a secure user account.

11.2 Login via Google (OAuth)

As an alternative, you may choose to log in using your existing Google account. If you do so, we will receive certain information from Google, specifically:

• Your full name
• Email address
• Google profile picture (optional)

This data is used solely for authentication and account creation/login purposes. We do not gain access to your Google password or any other data from your Google account beyond what is explicitly authorized.

11.3 Legal Basis

The legal basis for processing your data during registration or login is:

• Article 6(1)(b) GDPR – processing is necessary for the performance of a contract (i.e., the creation and maintenance of your user account).
• For Google login, the data transfer is also based on your explicit consent under Article 6(1)(a) GDPR, provided through the OAuth flow.

11.4 Data Retention

We retain your registration data for as long as your account remains active. You may request deletion of your account at any time.

12. Data captured on our mobile apps

We capture the following data across our mobile apps (Merlin AI, Notetaker app, Wallflower)

1. Firebase analytics – Firebase Analytics help us understand how users interact with our website by collecting information about mouse movements, clicks, and scrolling behavior.
2. Facebook events – Facebook events helps us measure, optimize, and build audiences for our advertising campaigns. It allows us to track conversions from Facebook ads, Optimize ads based on collected data, build targeted audiences for future ads and remarket to qualified leads who have already taken action on our app.
3. TikTok events – Tiktok events help us measure, optimize and build audiences for our advertising campaigns on tiktok.
4. Microsoft Clarity - Microsoft Clarity also help us understand how users interact with our website by collecting information about mouse movements, clicks, and scrolling behavior.

13. Social Media Links (Twitter/X, LinkedIn, Instagram, Youtube)

Our website includes icons or buttons that link to our official profiles on social media platforms, including:

X (formerly Twitter)

LinkedIn

Instagram

Youtube

These buttons function solely as external links. When you click on one of these icons, you are redirected to the respective platform. No personal data is transferred to these platforms simply by visiting our website.

Please note that once you are on these external sites, their own privacy policies and terms of service apply. We do not control how these platforms collect or process your personal data.

14. Changes to the Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will publish an updated version and effective date on this page, unless another type of notice is required by applicable law.

15. How to Contact Us

Please contact [email protected] if you have any questions or concerns not already addressed in this Privacy Policy. Alternatively, you can write to us at [email protected] or the address above under Section 1 (Data Controller).

You can contact our Data Protection Officer at [email protected] in matters related to Personal Data processing.

Data Protection Officer:
Name: Sirsendu Sarkar
Email: [email protected]
Phone: +91-8953348922

EU Representative:
Rickert Rechtsanwaltsgesellschaft m.b.H.
Colmantstraße 15, 53115 Bonn, Germany
Email: [email protected]
Phone: +49 (0)228 74 898 0

UK Representative:
Rickert Services Ltd UK
PO Box 1487, Peterborough, PE1 9XX, United Kingdom
Email: [email protected]

Procedure for Data Withdrawal via Erasure and Objection

You have the right to request the withdrawal of your data through erasure of your personal data held by us. This means we will delete all personal data pertaining to you from our systems, subject to any legal obligations for data retention.

To initiate a request for data erasure:

1. Send an email to [email protected]
2. CC [email protected]
3. Include "Data Erasure Request" in the subject line
4. Provide your account email and any relevant details

We will respond to your request within 30 days and complete the erasure within the timeframes required by applicable law.

You also have the right to object to the processing of your personal data where we rely on legitimate interests or use your data for direct marketing purposes. To exercise this right, contact us at [email protected] and [email protected]