Beta policy · 12 September 2026
Privacy notice
Merron is published by Stratexa Media LLC and is currently operating a limited product-validation pilot. This notice explains the data handling for the public MCP connection, private self-service workspace, free assessment and legacy pilot. Further company contact details and a DPA will be added before paid production service is offered.
Public MCP connection
When you use Merron through an MCP-compatible assistant, the selected file excerpts and screening answers in its tool request are sent to Merron. Ask your assistant to show what will be shared and remove secrets and unnecessary personal information first. These public tools perform bounded text inspection and rules-based screening. Merron's application does not persist their inputs, log request bodies, send them to an AI model, or access private workspace cases. Hosting providers can process network metadata and operational logs under their policies. Your AI assistant separately processes and may retain the conversation, submitted excerpts and returned results under its own policies. Public MCP results are not automatically saved to your Merron workspace.
What we collect
For private workspaces we store your account name and email, company and product details, questionnaire answers, uploaded original documents and extracted text, copilot messages, report versions and usage counts. Authentication uses secure session cookies, password credentials handled by Neon Auth, and verification/reset emails. Legacy assessment and pilot-application forms collect the information shown on those forms. Coarse first-party funnel events help us understand the flow; the app does not set analytics cookies.
Why we use it
We process this information to provide your requested workspace and reports, maintain your account, prevent abuse and investigate service failures. The intended legal bases are performance of the requested service, legitimate interests in operating and securing the service, and consent where requested. Do not submit information you are not authorised to share.
Automated processing and AI
When you ask the copilot or generate a report, the case description, answers, extracted document text and relevant conversation/report context are sent to Anthropic. These workspace inputs are not automatically anonymised. Remove unnecessary personal data, secrets, source code and sensitive personal case records before uploading. The model suggests explanations and actions; a versioned rules engine supplies screening classifications only when the required answers are complete. Outputs can contain mistakes and do not establish legal compliance.
Hosting and processors
Merron uses Vercel for application hosting, Neon for the database and managed authentication, and Anthropic for AI generation. The current Merron database is in Frankfurt, Germany. Database location does not mean all hosting, authentication, email or AI processing stays in the EEA. Provider contracts, subprocessor information and transfer terms need to be considered for your intended use. Payments are not enabled in this self-service beta.
Access and sharing
Application access to private cases, originals, chat and reports is restricted to the signed-in case owner. Service providers and authorised operators may access data as needed to operate the service. There are no public document links or automatic submissions to customers, authorities or other third parties. AI processing is an external service as described above.
Retention and deletion
Workspace data remains available until you delete the case or the beta service is retired; automatic age-based deletion is not currently implemented. You can delete originals and extracted text from the case. Quotes already recorded in messages or reports remain until the entire case is deleted. Case deletion removes its documents, messages, reports and run records from the active database. Account details and limited usage counters remain for account administration and abuse prevention. Provider backups and logs may retain information under their own retention schedules. Contact us to request account deletion or information about retained data.
Your choices
You can download your reports and original documents, edit questionnaire answers and delete cases in the workspace. You may also request access, correction, deletion, restriction or a portable copy where applicable, object to processing based on legitimate interests, and complain to your local data-protection authority. We verify requests before releasing or deleting another person's data.
Contact
Privacy requests and questions: leonidmoruz90@gmail.com.