Privacy Policy
What personal data Mergehand processes, why and for how long – and what we don't do with it.
1. Who we are
The controller is Daniel Vančo, place of business Kukučínova 4, 920 41 Leopoldov, Slovakia, Company ID (IČO) 50676750. Contact us about personal data at support@mergehand.com; all our details are on the company information page. We have not appointed a data protection officer, as the law doesn't require one for our processing.
2. Our two roles
- Controller – for data we process for our own purposes: accounts and sign-ins of Members, billing, support, security, running the Service and analytics of visits to our website. This policy covers that data.
- Processor – for personal data in the content our customers put into Mergehand or connect to it: code, issues, comments, merge requests and run output, which can name authors, reviewers or other people. There the customer is the controller and the Data Processing Agreement applies. If your data is in such content, please contact the organization that uses Mergehand first; we help it answer you.
3. What we process, why and for how long
| Purpose | Data | Legal basis (Art. 6(1) GDPR) | How long |
|---|---|---|---|
| Account and providing the Service | Name, email, password hash, role, settings, two-factor authentication secret (encrypted), your organization's name, acceptance of the Terms (version and time) | (b) contract | While the account exists; deleted within 30 days after you ask |
| Signing in and account security | Sessions with IP address and browser; history of sign-ins and failed attempts | (f) legitimate interest in security | Sessions until they expire (at most 90 days); sign-in history 180 days |
| Record of actions | Who did what in a project and when, with email and IP address | (f) legitimate interest in security and proof | 365 days |
| Operating the Service | Server and runner logs and error reports, which can include your email and task IDs | (f) legitimate interest in running the Service | Logs 30 days; resolved errors 90 days |
| Protecting sign-up from abuse | IP address, email domain, Cloudflare Turnstile check | (f) legitimate interest in preventing abuse | Not stored in our database; rate limits in server memory for at most 24 hours |
| Free trial once per person | Trial dates and usage counts | (f) legitimate interest in preventing repeated trials | While the account exists |
| AI account of a runner | A one-way hash (SHA-256) of the runner's AI account ID; the account's email and plan, shown only to the runner's owner | (f) legitimate interest in detecting one AI account shared by several Mergehand accounts, which the AI provider's terms forbid | While the runner is connected and 30 days after it is revoked; a block until it is lifted |
| Service emails | Address, subject and content of emails we send | (b) contract | 90 days |
| Browser notifications | Push address of your browser and a device label | Your consent in the browser | Until you switch them off or the browser stops accepting them |
| Support | Your emails and attachments | (b) contract; (f) legitimate interest in handling requests | 2 years after the request is closed |
| Website analytics (mergehand.com) | Pages visited, referring page, device, browser and approximate location derived from your IP address, the identifiers in Google Analytics cookies (Google Analytics 4) | (a) your consent in the cookie banner | Collected only after you click “Accept”; kept in Google Analytics for 14 months |
| Billing | Organization, plan, seats, payment provider references | (b) contract; (c) legal obligation | As long as accounting and tax law requires, up to 10 years |
Card and billing details are collected by Sold through Link, LLC (Stripe) as merchant of record. It processes them as an independent controller under its own privacy policy; we never see card numbers.
Where we rely on legitimate interest, you can object at any time (section 7). Providing account data is needed to conclude the contract; without it we can't provide the Service.
4. Who receives the data
- Our service providers, who process data only on our instructions: Hetzner Online GmbH (hosting in Germany), Amazon Web Services EMEA SARL (sending emails, Frankfurt), Cloudflare, Inc. (DNS, receiving emails to our addresses, sign-up protection), Infomaniak Network SA (our support mailbox, Switzerland) and Google Ireland Limited (Google Analytics on the website mergehand.com, only after your consent). Details are on the subprocessors page.
- Sold through Link, LLC and Stripe for payments and invoices, as independent controllers.
- Content delivery in the application: icons are loaded from jsDelivr and avatars from your code host or Gravatar, which receive your IP address when your browser loads them.
- Browser push services (for example Google, Mozilla or Apple, depending on your browser) deliver notifications if you switch them on; the content is encrypted.
- Advisers and authorities where the law requires it.
Services your organization connects – Anthropic as your AI provider, code hosts, issue trackers and chat webhooks – receive data from your organization's runners and integrations under your organization's own agreements with them. They are not our recipients.
5. Transfers outside the EEA
Our server and database are in the European Union. Cloudflare, Amazon Web Services and Stripe have parent companies in the United States; transfers rely on the EU–US Data Privacy Framework and on the European Commission's standard contractual clauses (Decision 2021/914). Google Analytics data may be transferred to Google LLC in the United States under the EU–US Data Privacy Framework and the standard contractual clauses. Infomaniak is in Switzerland, which the European Commission recognizes as providing adequate protection.
6. Cookies and local storage
- The application sets one cookie,
mh_session, which keeps you signed in (HttpOnly, Secure, SameSite=Strict, at most 90 days). It is strictly necessary, so it doesn't need consent. - The application stores your choices – such as theme, density, layouts and filters – in your browser's local storage. They don't leave your device unless you sync preferences to your account.
- The website mergehand.com remembers your theme and your cookie choice in local storage. Only if you click “Accept” in the cookie banner, it loads Google Analytics, which sets the cookies
_gaand_ga_<ID>(2 years) to tell visits apart and measure how the website is used. If you click “Reject” or don't choose, no analytics cookies are set and nothing is sent to Google. You can change your choice at any time with “Cookie settings” at the bottom of every page; withdrawing consent deletes these cookies. - The sign-up page uses Cloudflare Turnstile to block automated sign-ups. Cloudflare processes your IP address and browser signals for that check.
7. Your rights
You have the right to access your data, correct it, have it deleted, restrict its processing, receive it in a portable format and object to processing based on legitimate interest. Where processing is based on consent, you can withdraw it at any time. Write to support@mergehand.com; we answer within one month. You can also complain to the Office for Personal Data Protection of the Slovak Republic or to the authority in your country.
8. What we don't do
- We don't sell personal data and don't use it for advertising.
- We don't use your data or your organization's content to train AI models.
- We don't make decisions about you based solely on automated processing.
9. Security
We protect data with encryption, access control and isolation described on the security page and in the technical and organizational measures. If a breach puts your rights at high risk, we tell you without undue delay.
10. Changes
We publish changes to this policy here with a new date. We email owners and admins of organizations about material changes at least 30 days before they take effect.