Privacy Policy

The data controller responsible for the processing of your personal data is:

• Controller: Luis Armando Fraga Guimaraes Barbosa, operating as a self-employed professional (autónomo) in Spain under the trade name MerbIQ (not incorporated as a company)
• Address: Carrer de Pere IV, 105, Sant Martí, 08018 Barcelona, Spain
• Data protection contact: legal@merbiq.com
• Data protection officer (LGPD Art. 41): legal@merbiq.com
• General inquiries: hello@merbiq.com
• Phone: +34 627 272 949
• Website: https://merbiq.com

This Privacy Policy explains how MerbIQ ("we", "us", or "our") collects, uses, stores, and protects your personal data when you use our AI visibility scanning and optimization service (the "Service"), in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Spanish Organic Law 3/2018, the Brazilian General Data Protection Law (Lei nº 13.709/2018, "LGPD") for users in Brazil, and other applicable data protection legislation.

2.1 Data you provide directly

• Account data: email address, name (when provided)
• Scan form data: brand name, domain/URL, city, industry/niche
• Payment data: billing information processed by Stripe (we do not store full card numbers)
• Communications: any messages you send to our support channels

2.2 Data collected automatically

• Usage data: pages visited, features used, scan history, timestamps
• Device data: browser type, operating system, screen resolution, IP address
• Cookies: session identifiers, preferences (see Section 9)

2.3 Data obtained from public sources

• Website crawl data: publicly available information from the domain you submit (structured data, robots.txt, business contact data)
• Search engine data: publicly available search results related to your brand and competitors (via Serper.dev)
• AI platform mentions: information about your brand as returned by AI platforms (ChatGPT, Claude, Gemini, Perplexity, Grok)

2.4 Data generated through our service

• Competitor mentions: business names, domains and frequency that AI platforms mention for your service area
• Query intelligence: search queries used during scans, stored aggregated and anonymized
• Client reviews: reviews submitted by business owners; provided by them and not independently verified by MerbIQ
• Analytics: first-party usage events on our infrastructure, plus Google Analytics 4 loaded only after you accept analytics cookies (Sections 5 and 9)

2.5 Reviews and Merber accounts

MerbIQ lets people ("Merbers") create a free account to review businesses in the network. We process the following on the basis of your consent (Article 6(1)(a) GDPR / Article 7(I) LGPD):

• Merber account: email address and display name; your email is never shown publicly
• Reviews you write: rating, text and the business reviewed, subject to moderation before and after publication
• Social activity: businesses you follow and your review history, visible only as you allow

If you delete your Merber account, your published reviews are ANONYMIZED (your name and account are removed and unlinked) rather than deleted, to preserve the integrity of the reviewed business's reputation and of the content. You may request full erasure of a specific review at legal@merbiq.com (Section 8).

• AI Visibility Scans: we send your brand name, domain, city and industry to OpenAI, Anthropic, Google and Perplexity to query how these platforms represent your brand
• Website Crawling: we crawl the public pages of the domain you submit to analyze technical SEO (Schema.org, robots.txt, NAP)
• Competitor Analysis: we use Serper.dev to identify and verify competitors in your local market
• Results and Reports: we store your scan results so you can access them via your dashboard
• Payments: processed through Stripe; we do not store full card details
• Transactional Emails: we use Resend to deliver results, notifications and confirmations
• Security: we use Upstash Redis for rate limiting to prevent abuse

When MerbIQ provides the Virtual Assistant (chatbot) embedded on a business client's website, that business is the DATA CONTROLLER of its visitors' personal data, and MerbIQ acts as a PROCESSOR on the business's behalf and under its instructions, solely to provide the service. With respect to MerbIQ's own account holders, MerbIQ remains the controller as described in the rest of this Policy.

Purpose

The assistant uses artificial intelligence to answer users' questions by consulting the business's knowledge base, and to provide, support, secure, audit and improve the service.

Data processed

• Messages: the content of the messages the user sends to the assistant
• Identification data: any personal data the user voluntarily provides in the conversation
• Technical data: IP address, session identifier and timestamps needed for the service to function

Legal basis

Legitimate interest (Art. 6(1)(f) GDPR), or the legal basis applicable to the controlling business under the LGPD. We do not request special-category (sensitive) data. Users are advised NOT to share health data or other sensitive personal data in the chat.

Use of AI and sub-processors

The assistant uses AI models (for example, Anthropic Claude) to locate information and generate responses. To deliver the service it relies on the following providers acting as (sub-)processors, each bound by a data processing agreement:

• Anthropic: language model
• OpenAI: text embeddings for knowledge retrieval
• Supabase: database (EU)
• Upstash: rate limiting and queues
• Vercel: hosting

Human review

Conversations may be accessed or reviewed by authorized personnel for support, security, audit and quality-improvement purposes.

Retention

Assistant conversations are kept for 12 months, or for the period instructed by the controlling business, after which they are deleted or anonymized.

Your rights

To exercise your rights over data processed by the Assistant on a business's website, contact that business (the controller); MerbIQ will support the request as processor. See Section 8.

We share personal data with the following processors, each bound by a Data Processing Agreement (Art. 28 GDPR):

We do not sell, rent, or trade your personal data to any third party.

Some processors are located in the United States. Transfers outside the EEA are protected by Standard Contractual Clauses (Decision 2021/914), the EU-U.S. Data Privacy Framework where applicable, and supplementary safeguards following EDPB recommendations.

For users located in Brazil, international transfers are carried out in accordance with Article 33 of the LGPD. You may request a copy of the relevant safeguards at legal@merbiq.com.

After the retention period, data is securely deleted or anonymized. Anonymized aggregated data may be retained for statistics and product improvement.

Under Articles 15-22 GDPR you have the following rights. To exercise them, contact legal@merbiq.com. We respond within 30 days.

• Access (Art. 15): a copy of the personal data we hold about you
• Rectification (Art. 16): correction of inaccurate or incomplete data
• Erasure (Art. 17): deletion of your data, subject to legal retention
• Restriction (Art. 18): restrict processing in certain circumstances
• Portability (Art. 20): your data in a machine-readable format (JSON or CSV)
• Object (Art. 21): object to processing based on legitimate interest
• Withdraw consent (Art. 7): withdraw consent at any time without affecting prior processing
• Complaint: lodge a complaint with the Spanish Data Protection Authority (AEPD - https://www.aepd.es) or your local supervisory authority

Users located in Brazil have equivalent rights under Article 18 of the LGPD (confirmation, access, correction, anonymization or deletion, portability, information on sharing, and revocation of consent), and may complain to the Brazilian National Data Protection Authority (ANPD - https://www.gov.br/anpd).

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA") gives you the rights below. We extend the core of these rights to all users regardless of location.

• Right to know: the categories and specific pieces of personal information we collect, the sources, the purposes, and the categories of third parties we share it with (see Sections 2 and 5)
• Right to delete: request deletion of the personal information we collected from you, subject to legal exceptions
• Right to correct: request correction of inaccurate personal information
• Right to opt out: opt out of the "sale" or "sharing" of personal information
• Right to limit: limit the use of sensitive personal information
• Non-discrimination: we will not discriminate against you for exercising any of these rights

We do NOT sell your personal information and we do NOT share it for cross-context behavioral advertising within the meaning of the CCPA/CPRA. Analytics cookies load only after you accept them (Section 9).

To exercise these rights, contact legal@merbiq.com. You may use an authorized agent to submit a request on your behalf; we may verify your identity and the agent's authority. We respond within the timeframes required by law.

• Strictly necessary cookies: required for the Service (authentication, CSRF). No consent required under Art. 5(3) ePrivacy
• Functional cookies: remember preferences such as language and theme. Basis: legitimate interest
• Analytics cookies: we use Google Analytics 4, set only after you choose "Accept All", never if you choose "Essential Only". IP addresses are anonymized

You can manage cookies in your browser settings. We do not use advertising cookies or cross-site advertising trackers.

We implement appropriate technical and organizational measures (Art. 32 GDPR):

• Encryption in transit (TLS 1.2+) and at rest
• Database hosted in the EU with row-level security
• Secrets stored as environment variables, never in client code
• Rate limiting and anti-abuse protection
• Regular security reviews and dependency updates
• Payments handled exclusively by PCI DSS-compliant Stripe

• Authority notification: we notify the AEPD (and, for Brazil, the ANPD) within the legal deadline of a breach posing a risk to data subjects
• Data subject notification: if the breach is likely to result in a high risk, we notify you without undue delay
• Internal record: we keep a register of all breaches (Art. 33(5) GDPR)

The Service is for businesses and professionals and is not directed at individuals under 16. We do not knowingly collect data from children under 16. If you believe a child has provided us with data, contact legal@merbiq.com.

Our scans use automated processing to generate scores and recommendations. These are informational and do not produce legal effects within the meaning of Article 22 GDPR. No automated decision-making is used for account access, pricing, or eligibility.

We may update this Policy. For material changes we will notify you by email or a prominent notice before they take effect. The "Last updated" date reflects the latest revision.

• Data protection contact: legal@merbiq.com
• Postal address: Carrer de Pere IV, 105, Sant Martí, 08018 Barcelona, Spain

If unsatisfied with our response, you may lodge a complaint with the AEPD (https://www.aepd.es), the ANPD in Brazil (https://www.gov.br/anpd), or your local supervisory authority.