Privacy Policy

Meryn Ltd (“Meryn”, “we”, “us”) operates the Meryn platform at meryn.co.uk: a virtual receptionist service for UK caterers, venues and events businesses. Company number to be confirmed. Registered office: to be confirmed (placeholder: a registered-office mailbox address).

We are in the process of registering with the UK Information Commissioner’s Office (ICO) as a data controller; our registration reference is pending.

Questions about this policy or your data: email [email protected].

This policy covers visitors to our website and everyone who signs up for or uses a Meryn account (“account holders”, “you”). Where one of our account holders uses Meryn to handle their own customers’ enquiries and bookings — the people who call, text or fill in an enquiry form — that account holder’s business is the data controller for those people’s information, and we process it on their instructions as their service provider. If you are one of those callers or enquirers with a question about your data, please contact the business you enquired with directly; if they cannot resolve it, they can put you in touch with us.

• Account and business details: your name, email address and a securely hashed password (we never store or can see your actual password); your business’s name, sector, contact details and address; your team members and their roles.
• Signing in with Google or Microsoft: if you choose this, we receive your account’s unique identifier, name, email address and whether Google or Microsoft has verified that email — never your Google or Microsoft password. If you connect Google Calendar or Microsoft 365, we also read and write the calendar events needed to check availability and create bookings.
• Payment details: handled directly by Stripe, our payment processor. We never see or store your full card number.
• Calls, messages and enquiries: if your business uses the AI receptionist, calls to your number may be recorded and transcribed (callers are told “This call may be recorded” where you have enabled that), and the content — names, phone numbers, email addresses, and what is discussed — is used to qualify the enquiry, make bookings and summarise the call for your team. Text and email enquiries work the same way.
• Technical and usage data: IP address, browser/device information, and the log data needed to run, secure and troubleshoot the service.
• Cookies: a small number of strictly necessary cookies — a signed session cookie that keeps you signed in, and short-lived cookies used only during a Google, Microsoft or HubSpot sign-in or connection flow. We do not use advertising or analytics cookies.

Under UK GDPR, we rely on:

• Performance of a contract — running the service you have signed up for: your dashboard, your AI receptionist, bookings, billing, and the emails/texts the service needs to send you.
• Legitimate interests — keeping the service secure, preventing abuse, and improving it, balanced against your rights.
• Legal obligation — records we must keep for tax, accounting or regulatory reasons.
• Consent — any optional marketing communications; you can withdraw this at any time.

The AI receptionist scores and prioritises enquiries (e.g. hot/warm/cold) to help your team follow up — this only affects the order your team sees leads in. We do not make any automated decision about a person that has a legal or similarly significant effect on them.

We share personal data with the following providers, only as needed for them to do their job for us. We do not sell personal data to anyone.

• Stripe — payment processing and billing.
• Twilio — phone calls, SMS and call recording.
• Resend — transactional email delivery.
• Google / Microsoft — sign-in and, if you connect them, calendar sync.
• HubSpot — only if you choose to connect your CRM.
• OpenRouter — the AI language model that understands and responds to enquiries.
• ElevenLabs — the AI voice used on calls.
• Sentry — error monitoring, to find and fix problems quickly.
• DigitalOcean — hosting, in London, UK.

Some of these providers may process data outside the UK or EEA. Where that happens, we rely on their standard contractual safeguards for international data transfers.

By default, call recordings are kept for 90 days, call transcripts for 365 days, and a contact with no bookings or activity is anonymised after 730 days — each business can change these limits (including turning off automatic deletion) in their own privacy settings. Account and billing records are kept for as long as your account is active, plus whatever period we are legally required to keep financial records afterwards. Deleting your business deletes its data immediately, including cancelling any active subscription.

Under UK GDPR you can ask to access, correct, delete, or receive a copy of your personal data, and object to or restrict some of our processing. Account holders can do most of this themselves — exporting their business’s full data or deleting it entirely — from Settings → Privacy. For anything else, or if you are not an account holder yourself, email [email protected].

We encrypt data in transit and at rest, hash passwords, and restrict access to personal data to what each part of the service needs. No system is perfectly secure, but we take reasonable technical and organisational steps to protect your information.

Meryn is a business tool, not directed at or intended for children, and we do not knowingly collect personal data from children.

We will update this page if our practices change, and update the date at the top. Significant changes will be announced to account holders by email.

If you are unhappy with how we have handled your data, please tell us first at [email protected] so we can put it right. You also have the right to complain to the UK Information Commissioner’s Office at ico.org.uk.