Privacy Policy

Mersm (“we”, “us”) runs Mersm AI and decides how your personal data is used, so we’re responsible for it under the PDPL. For anything about your privacy, write to contact@mersm.dev.

When you create an account:

• your name and email address;
• your password, which we store only as a one-way hash, never as text;
• if you sign in with Google: the name, email address and profile picture on your Google account;
• your language and display choices, whether you agreed to receive product news, and when you accepted the terms;
• the campaign that brought you to Mersm AI, if the link you followed carried one (such as utm parameters or an ad click id).

When you use the app:

• your workspace, brand and project names, your store links, and the content you upload or create;
• sign-in records: your device’s IP address and browser, and when each session started and ends;
• records of important actions, such as creating a workspace or a brand, kept in an audit log.

We don’t collect payment details during the free beta.

• to create and protect your account, sign you in and verify your email address;
• to provide the service you ask for, including generating images and listings from your content;
• to send the emails the service needs: sign-in codes and links, security notices and important changes;
• to send product news, only if you opted in. You can opt out at any time;
• to keep the service safe: limiting repeated attempts, detecting misuse and investigating problems;
• to understand which campaigns bring people to Mersm AI;
• to meet our legal obligations.

We rely on your consent, on providing the service you signed up for under our Terms of Use, and on our legal obligations, as the PDPL allows. Where we rely on your consent, you can withdraw it at any time.

To produce results, we send the content each request needs, such as product photos, brand details and your instructions, to AI model providers. We send only what the request needs, and we don’t send your name or email address.

We choose providers and settings that don’t use your content to train their models, wherever that choice is offered. We don’t use your content to train models of our own.

We don’t sell your personal data. We share it only with the service providers that help us run Mersm AI, and only for that purpose:

• hosting: our servers and databases run on a server in Germany provided by Contabo;
• email delivery: Hostinger, which sends our sign-in codes, links and notices;
• Google, if you choose to sign in with Google;
• AI model providers, for the requests you make (see “AI processing”).

We may also disclose data when the law requires it, or to protect our users, the public or Mersm.

During the beta, your data is stored on a server in Germany, outside the Kingdom of Saudi Arabia. We transfer it there in line with the PDPL’s rules on transfers outside the Kingdom, and protect it with the measures under “Security”. We may later move it to a server inside the Kingdom.

• Account data: while your account is open. When you ask us to delete your account, we delete your personal data within 30 days.
• Sessions: up to 30 days, or until you sign out.
• Sign-in codes and links: they expire within 30 minutes and work only once.
• Backups: daily backups are kept for 14 days, so deleted data can stay in a backup for up to 14 days before it’s overwritten.
• Audit log: kept for security. Its entries hold internal identifiers, not your name or email address.

We may keep some records for longer where the law requires it.

Under the PDPL, you have the right to:

• know how your personal data is collected and used, which this policy explains;
• get a copy of your personal data;
• correct personal data that’s wrong or incomplete;
• ask us to delete your personal data when we no longer need it;
• withdraw consent you’ve given, such as for product news.

To use these rights, write to contact@mersm.dev from the email address on your account. We’ll reply within 30 days.

If you’re not satisfied with our answer, you can complain to the Saudi Data and Artificial Intelligence Authority (SDAIA).

Mersm AI uses only the cookies it needs to work:

• sign-in cookies that keep you signed in;
• your language and theme;
• the campaign that brought you here, kept for up to 30 days until you sign up.

We don’t use advertising or third-party tracking cookies in the app.

We protect your data with access controls that keep each workspace’s data separate, passwords stored only as hashes, encrypted connections (HTTPS), limits on repeated sign-in attempts, and two-step verification on every staff account.

No system is perfectly secure. If a breach affects your personal data, we’ll tell you and the authorities as the PDPL requires.

Mersm AI is for adults running a business. It isn’t meant for anyone under 18, and we don’t knowingly collect their data.

We’ll post any update here with a new date. If a change matters, we’ll tell you by email or in the app before it takes effect.

This policy is published in Arabic and English. If the two versions differ, the Arabic version prevails.

Questions or requests about your privacy: contact@mersm.dev.