merger

Merger

Privacy policy

Updated October 15, 2026. This notice covers the Merger website, apps, and connected services. Contact support@usemerger.com with privacy questions or requests about your information.

Connecting Google? Read how we handle Google Calendar and Google Meet information, including permissions, sharing, and deletion.

Sign in with Google

Google sign-in is optional. It requests your basic identity (OpenID, email address and profile) so Merger can create your account or sign you in. We receive a Google account identifier, name, email address and verification information. We store the account identifier linked to your Merger account. Your Google password is never shared with Merger. Sign-in does not authorize Google Calendar or Meet access, start a subscription, or activate paid features.

If a Merger account already uses your email, sign in to that account first and connect Google from Profile. We do not automatically merge accounts based only on an email match. Authentication handoffs expire after ten minutes and can be used once. They contain encrypted identity information while pending; Google sign-in does not retain Google access or refresh tokens. Your Merger session remains subject to sign-out and account deletion. You can also remove Merger from your Google Account connections.

Accounts and the waitlist

Joining the waitlist creates a Merger account with your name, email address, and password. Passwords are stored as hashes. After you verify your email, the account is connected to your waitlist entry, including any existing signup date and referral credit for that email. Optional role and firm details help us understand how you plan to use Merger.

We use your email for account verification, access invitations, password recovery, and membership messages. Account creation does not enroll you in optional marketing emails. We record the version of the terms and privacy notice shown when you create your account, along with the submission time.

Your waitlist record includes signup time, referral relationships, and invitation status. An incoming referral code may be stored in your browser for up to 30 days; a short-lived signup draft can save typing between pages. Your signed-in account is the authority for your waitlist status across devices. Shareable referral codes cannot sign you in or activate membership.

Waitlist information is used to operate the rollout and is not sold. Contact support@usemerger.com for account or waitlist removal and information requests.

Authorized Merger staff may also import business contact information into the waitlist before you create an account. Imported records can include a name, email address, firm, role, and information about the import source. Importing a record does not create an account, verify the email address, or start a paid membership. We use these records to manage the rollout and access invitations; you can contact support to request removal.

Account and service information

Merger processes your email address, display name, handle, password hash, and account identifiers to create your account and sign you in. Session cookies keep you signed in. Subscription identifiers, payment status, and billing dates are used to determine access and display your account status.

Google Calendar and Google Meet

Permissions and information accessed. Connecting Google Calendar is optional and uses Google’s OAuth consent flow. Merger now requests permission to view, create, change, and delete events on calendars you own, and to check free/busy availability. The event permission is not restricted to events created by Merger. Merger’s current scheduling features use your primary calendar to create meetings, update or cancel meetings saved in Merger, and check busy time periods. Merger does not import a list of your other Google Calendar events.

If you connected with an earlier version, your existing Google authorization may cover events on all calendars you can access. To replace an older, broader authorization, remove Merger’s access in your Google Account connections, then reconnect Google Calendar in Merger. Reconnecting without first revoking the older authorization may retain its broader permissions.

How we use the information. We send Google the meeting title, description, start and end times, time zone, and attendee names and email addresses you provide. Google returns event identifiers, event details, and Calendar links. If you choose to add Google Meet, we request a Meet link through Google Calendar and save that link with the meeting. These features schedule meetings, invite the attendees you choose, show your saved meetings, and help you check for conflicts. They do not access Google Meet recordings or transcripts. Google processes invitations and updates for the attendees you select.

What we store. Merger stores Google access and refresh tokens encrypted on its servers, along with token expiry and granted-permission information, so the connection can work between visits. Saved meeting records include the title, description, times, time zone, attendees, linked Merger deal or contacts, status, Google event and calendar identifiers, Calendar link, and Meet link. Meeting records are stored on Merger’s servers and displayed in the app. Free/busy time blocks are used for availability checks and are not persisted by Merger.

Sharing and AI. Google receives the information needed to perform the scheduling actions you request, and invited attendees receive the meeting details and links. Merger’s hosting providers process stored connection and meeting information to operate these features. The Calendar connection does not automatically add Google availability or saved meeting records to AI requests. If you include meeting details in an AI prompt, or in messages or deal information you choose to use with optional AI features, that content may be sent to Anthropic to fulfill your request, as described below.

Limited Use. Merger’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google data only to provide or improve the user-facing features you choose, and transfer it only as permitted by those requirements, including to operate those features with your consent, for security, or as required by law. We do not sell Google user data, use it for advertising, or use it to train general-purpose AI models. Human access is limited to your affirmative consent for specific data, security investigations, legal obligations, or aggregated and anonymized internal operations permitted by the Limited Use requirements.

Disconnecting, retention, and deletion. You can disconnect Google Calendar in Merger’s connection settings. Disconnecting removes Merger’s stored Google credentials and pending connection requests and attempts to revoke the Google authorization. If Google’s revocation service is unavailable, local credentials are still removed; you can independently revoke access in your Google Account connections. Merger retains connection credentials only while the connection is active, and removes them when you request account deletion.

Disconnecting does not delete events already on Google Calendar or saved Merger meeting history. Canceling a meeting retains its record in Merger. Saved meeting records remain with the associated deal and account until those records are deleted; account deletion includes a recovery period before final deletion and is not immediate for meeting history. Contact support@usemerger.com from your account email to request access to, correction of, or deletion of Google-related information held by Merger. Records in backups may remain until those backups expire, and records needed for legal or security obligations may be retained. Information already delivered to Google or invitees is subject to their own retention and deletion controls; you can manage remaining events in Google Calendar.

How we protect your data

All information exchanged between the Merger apps and Merger’s servers is encrypted in transit using TLS (HTTPS). Sensitive data held on Merger’s servers is encrypted at rest — including the Google access and refresh tokens obtained when you connect Google Calendar, and the credentials for other connected services. Access to production systems and to user data is restricted to a small number of authorized personnel, is limited to the purposes described in this notice, and is logged. Google access and refresh tokens are kept only while your Google connection is active; disconnecting Google Calendar deletes the stored tokens and asks Google to revoke Merger’s access. Meeting records you saved are handled as described in the Google Calendar section above. These safeguards apply to the sensitive data Merger receives from Google and from your other connected accounts.

Messages and connected accounts

Connecting a messaging service lets Merger process the messages, contact details, and connection credentials needed to provide that integration. Information may be processed and stored by Merger’s server infrastructure as well as on your device. Do not assume that connected messages remain only on your computer.

You start each connection yourself by signing in to that service. Merger then operates a per-account connector on its servers that holds the resulting session, so messages can continue to be received and sent while the app is closed. That session is held on Merger’s servers for as long as the connection is active. You can disconnect a service at any time in the app, which removes that stored session, and you can also revoke Merger’s access from the service’s own account settings. Merger connects only to services you have signed in to and does not scrape.

Contacts and deals you save are used to provide the Rolodex and Deal Desk. The connected messaging providers continue to process information under their own privacy policies.

Camera, photos, and your address book

Merger asks for the camera only when you tap the camera button to take a photo in a conversation. Nothing is recorded or uploaded until you take a photo and send it.

When you open the attachment panel, Merger reads your recent photos so it can show them to you. That reading happens on your device, and a photo is uploaded only once you select it and send it. iOS lets you grant access to selected photos instead of the whole library, and Merger works either way. Separately, Merger saves a photo or video to your library only when you choose Save on a message.

Sharing a contact does not give Merger your address book. iOS shows its own contact picker and returns only the single contact you choose; the name, numbers, and addresses you share then become part of the message you send, and are handled like any other message content. Merger does not read, copy, or upload the rest of your contacts from your device. The Rolodex described above is built from your conversations, not from your phone’s address book.

You can change or withdraw any of these permissions at any time in Settings › Merger on your device. Doing so disables only the feature that needs it.

Tracking and advertising

Merger does not track you. The apps and site carry no advertising, no analytics or attribution SDKs, and no advertising identifier, and we do not sell your information or share it with data brokers. We do not use your messages or contacts to train general-purpose AI models.

Optional Claude features

When you use AI assistance or enable an AI scan, your prompt, message content, and relevant contact or deal context may be sent to Anthropic to generate a response or suggestions. These requests can include meeting details you provide in that content. Where the feature uses your Anthropic API key, it uses your Anthropic account. Review the settings before enabling automatic scanning. Anthropic’s policies and the applicable Anthropic account terms govern its processing of those requests. AI results may include contact details or deal information drawn from the content you choose to use.

Billing and DocuSign

Stripe hosts checkout and billing management and processes payment details. Merger receives subscription and payment-status information; card details are entered on Stripe’s hosted pages.

DocuSign sign-in and document activity take place with DocuSign. When you copy or insert Rolodex information into DocuSign, that information is shared with DocuSign. Review recipients and documents before sending.

Support and operational data

Support requests can include your email, report text, and diagnostic information you provide. Service logs may include technical details needed to operate the service, investigate failures, and prevent abuse. Avoid including passwords, API keys, card details, or unnecessary private messages in a report.

Providers and retention

Merger uses hosting, messaging infrastructure, email delivery, and payment providers to operate the service. Information is processed by those providers as needed for their functions. Connected services may process information outside your country.

Data can remain in your account, service logs, or backups after you disconnect a service. Billing or operational records may need to be retained for legal, accounting, or security purposes. Contact support for information about access, deletion, and retention for your account.

Your choices

You can disconnect integrations and control AI scanning in the app. To request access to, correction of, or deletion of account information, contact support from your account email. We may need to verify account ownership. You can manage your subscription separately on the Billing page.

Updates

This notice may change as Merger develops. The date above identifies the current version. See the terms for subscription and cancellation details.