Privacy Policy

1. Introduction

MERENA (“MERENA,” “we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use MERENA and MERENA+ (including MERENA+ Family), use our mobile application or the MERENA browser extension, or receive our emails, text messages and notifications (collectively, our “Services”).

Please read this Privacy Policy carefully. By accessing or using our Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please discontinue use of our Services.

2. Information We Collect

2.1 Information You Give Us

• Account and contact details: your name, email address, password (or your Google account, if you sign in with Google), mobile phone number, and ZIP code. We may suggest a ZIP code based on your approximate location, which you can change.
• Your online life: the devices you use and the online accounts and services you tell us about, for example your bank, email provider, social media, shopping, health care, cloud and gaming accounts, along with your answers about your security habits. We use this to match alerts to you and to calculate your Safety Score. Some of these choices, such as health care or banking providers, can reveal sensitive information about you, so only add what you are comfortable sharing.
• Payment information: if you subscribe to MERENA+, your card is collected and processed by our payment processor, Stripe. We do not receive or store your full card number. We keep your plan, billing dates and subscription status.
• Tools you use: the email address you check for data breaches, the links you check, the passwords you test, and the images you ask us to examine. A password you test is sent over an encrypted connection to be scored and is not stored. When you are signed in, we keep a record of the breach and link checks you run, including the email address or link checked, so they appear in your history and count toward your Safety Score.
• Screenshots of your apps: if you use “Add apps from a screenshot,” the screenshot is sent to MERENA and our AI model providers (see Section 5.1) once, to read the names of the apps in it, and is not stored. You choose which of the apps we find are added to your profile. If you are not signed in yet, your choices are kept in your browser until you create your account.
• Messages to us: your conversations with MERENA, feedback you send, replies to our text messages, and emails to our team.
• Daily challenges: when you are signed in, your daily challenge scores and completion dates.

2.2 Information About Other People

• MERENA+ Family: if you add people to your household, you give us their name, whether they are an adult or a child or dependent, and, if you choose, their email address and phone number, along with the devices and online accounts you add for them. Before you add someone, you must confirm that you are their parent or legal guardian or that you have their permission, and we keep a record of that confirmation. Household members do not get their own MERENA login. If you add an adult's email address, we email them once so they can confirm they know they were added; that email includes your name. We do not send emails or texts to children or dependents you add.
• Sharing an alert: if you share an alert, we collect the recipient's email address and any note you include, and send them that alert in your name. We keep the recipient's email address so we know who received a shared alert. They can unsubscribe from any future email.

Only give us information about another person if you have the right to do so.

2.3 Information Collected Automatically

When you use our Services, we and our analytics and advertising partners automatically collect certain information, including:

• Device information (browser type, operating system, device type)
• IP address and approximate location (country, region, city and ZIP code)
• Usage data (pages visited, time spent on pages, buttons and links clicked, referring URLs, and the ad or campaign that brought you to us)
• Whether our emails and texts were delivered, and which links in them you clicked. Links in our texts are unique to each recipient so we can tell which ones were opened.
• Error and diagnostic reports when something on our Services breaks
• Cookies and similar technologies (see Section 6)

We use your country, based on your IP address, to restrict access to our Services from countries subject to U.S. sanctions.

2.4 Information From Other Sources

• Google, if you sign in with Google (your name and email address)
• Data breach databases, such as Have I Been Pwned, which tell us whether an email address you check appears in known breaches
• Stripe, which tells us whether a payment succeeded and your subscription status
• Advertising partners, which tell us when you arrived from one of their ads

2.5 Chatting With MERENA

MERENA's chat is powered by artificial intelligence. When you chat with MERENA, we collect the messages you send and the responses generated, and we keep your conversation history in your account so you can return to it. If you are not signed in, your conversation is kept only in your browser. We also keep records of conversations, linked to your account, in a monitoring tool we use to troubleshoot problems and improve the quality of answers.

If you attach an image, such as a screenshot, to a message, the full image is sent to MERENA to answer that message and is not stored. We keep a small thumbnail with the conversation so you can see what you shared. MERENA may suggest a change to your profile, but nothing is changed until you review it and choose Apply.

Your messages, along with the parts of your profile MERENA needs to answer them, are sent to the AI model providers that generate responses (see Section 5.1). We do not use your conversations to train artificial intelligence models.

2.6 MERENA Browser Extension

The MERENA browser extension brings MERENA's tools to the pages you visit. The features below collect information only when you use them:

• Ask MERENA: the text you select, the surrounding paragraph, and the page's title, address and description are sent with your question.
• Check a link or image: the link, or the image and the address it came from, is sent to MERENA and our service providers for analysis.
• Sign-in: your MERENA account credentials are used to sign you in. If you are signed in on our website, you can instead connect the extension with one click: we give the extension a one-time code, which it exchanges for its own session, so your password is not shared with it. Either way, the session is stored in the extension on your device.
• Chat while signed in: each message you send includes the address of the website open in your current tab (for example, https://www.example.com, not the specific page), so MERENA can help with the site you're on.
• Password walkthrough (MERENA+): when you ask MERENA to help you change a password, we use that website address to prepare the steps. The extension finds and outlines the buttons to click on your device. It does not click or type for you, and nothing on the page, including your password, is sent to us.
• Usage analytics: we record when you use the extension's features (for example, that you ran a link check, the link checked, and the page it was on). The extension does not send analytics about the other pages you browse.

Browsing and email information is collected only through MERENA Account Finder, described below.

2.7 MERENA Account Finder

Account Finder, part of MERENA+, suggests the online accounts you have so your alerts match your real accounts. It works from a list of well-known companies and websites that we maintain. Nothing it finds is added to your profile until you confirm it in MERENA, and you can say an account isn't yours. The browser sources below work only when you are signed in to MERENA in the extension, and each can be turned off at any time there. Private Scan and a connected mailbox work only when you start them.

• Browsing history (on by default when you are signed in): once a day, the extension reads the past year of your browser history on your device. For websites on our list, it sends us the website's name, the days you visited, and how often. Page addresses, page titles, searches, and anything you type are never sent. Websites that are not on our list never leave your device.
• Websites as you use them (on by default when you are signed in): when you visit a website on our list, the extension records the website's name and the day. On those websites it also notes when a sign-in form is submitted. It never reads or sends your password or username. Websites that are not on our list are not recorded.
• Your inbox (off unless you turn it on): when you have Gmail, Outlook.com, Hotmail, Yahoo Mail or AOL Mail open in your browser, the extension looks at the list of emails on screen. For senders on our list, it sends us the sender's domain (for example, chase.com, not the full email address), the day the email arrived, and the subject line with long numbers and email addresses removed. We use the subject line only to tell an account email from an advertisement, and we do not store it. The extension never opens your emails or reads their contents, and emails from other senders never leave your device. Work and school Outlook accounts are not included.
• Connected mailbox (only if you connect one): if you connect an Outlook.com mailbox, we read the sender, date and subject line of your messages through Microsoft, with the same limits as above. We never read message contents. You can disconnect at any time, which removes the suggestions it made that you haven't confirmed and deletes our access to the mailbox. We keep a record of which mailbox address was connected.
• Private Scan (only when you run it, in our Android app): you choose an email export file, such as one from Google Takeout, and the app scans it on your phone without connecting to your mailbox. Before anything is sent, the app shows you exactly what will be: for each company on our list that you have not unticked, its website name, the days it emailed you, a category worked out on your phone from the subject line (such as a security notice, an account email or a receipt), and a count, along with which email provider the export came from. Subject lines, email addresses, message contents and the file itself never leave your phone. The app keeps a short history of past scans on your phone so you can see what was sent.

We keep the suggestions Account Finder makes, why each was suggested (for example, “sent you a receipt”), and the dates it was seen. We do not keep the browsing records, sender addresses or subject lines they were based on. If you say an account isn't yours, we remember that so we don't suggest it again.

We do not sell the information Account Finder or the browser extension collects, use it for advertising, or use it for any purpose other than providing and improving these features. We do not use it to train generalized artificial intelligence or machine learning models, and no person reads it, except with your explicit consent, where we need to investigate abuse or a security problem, or where the law requires it.

When you connect a mailbox we ask your email provider for the narrowest access it offers, and under it the provider does not return the contents of your email to us at all. For Outlook.com and Hotmail this is the Microsoft Graph Mail.ReadBasic permission; for Gmail it is the Google gmail.metadata scope, which returns message headers only. Your messages staying unreadable to us is therefore a property of the permission itself, not a promise about our software. The access we receive is encrypted before we store it.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. You can withdraw our access to a connected mailbox at any time from MERENA, or directly from your Google account permissions or Microsoft account permissions.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain our Services
• Create and manage your account and your household
• Suggest accounts for your profile and match cybersecurity alerts to the accounts and devices you and your household members have confirmed
• Calculate your Safety Score and track how it changes over time
• Send you cybersecurity alerts, reminders, your weekly report, and other emails, texts and notifications described in Section 4
• Process payments and manage your subscription
• Answer your questions in chat and provide customer support
• Improve, personalize, and expand our Services
• Understand how our Services are used, measure our advertising, and show you ads for MERENA on other websites and apps
• Detect, prevent, and address technical issues, fraud, abuse, and security threats
• Comply with legal obligations

Your Safety Score and alert matching are calculated automatically from your profile, the alerts that apply to you and whether you have acted on them, the tools you have used, and the daily challenges you have completed. They are used only to give you security guidance and do not produce legal or similarly significant decisions about you.

4. Emails, Text Messages and Notifications

4.1 Email

When you give us your email address, we send you cybersecurity alerts and related guidance. Depending on your settings, we also send our Weekly Online Safety Report, reminders about alerts you haven't acted on yet, changes to your Safety Score, and product updates and requests for feedback. Most of these are turned on when you sign up. You can turn each one off in your notification settings, and every email includes an unsubscribe link. We also send emails you need for your account, such as receipts and subscription confirmations, even if you unsubscribe from the others.

4.2 Text Messages

If you give us your mobile number and agree to receive texts, we send you security alert texts for the most urgent (“Immediate Action”) alerts, reminders about those alerts, and occasional updates from MERENA. Message frequency varies. Message and data rates may apply. Reply STOP to stop receiving texts, START to resume, or HELP for help. Agreeing to receive texts is not a condition of any purchase. Mobile carriers are not liable for delayed or undelivered messages.

We keep a record of the texts we send you and the replies you send us, so we can honor your choices, answer your questions, and show that we had your consent. We do not sell or rent your mobile number or your consent to receive texts, or share them with third parties for their own marketing.

Marketing texts are separate from security alert texts. We send marketing texts (promotions, product news and security tips) only if you tick the separate, optional marketing-texts box next to the phone field, and you can receive alert texts without it. We do not share text messaging originator opt-in data or consent with any third parties, affiliates or non-affiliates. This applies even where this policy describes sharing other information.

4.3 Push Notifications

If you allow notifications in your browser or on your device, we send alerts to it. You can turn notifications off at any time in your browser or device settings.

5. How We Share Your Information

We do not sell your personal information for money. We share it in the following circumstances:

5.1 Service Providers

We share information with vendors that perform services on our behalf and may use it only to provide those services to us, including:

• Hosting and infrastructure: Vercel, Google Cloud, Supabase and our database providers
• Payments: Stripe
• Email, text messages and customer relationships: Resend, Mandrill, Twilio and HubSpot
• Artificial intelligence: OpenRouter and the AI model providers it connects us to (such as Anthropic and OpenAI), and Langfuse, which we use to monitor the quality of MERENA's answers
• Security checks: Have I Been Pwned (for breach checks), Google Safe Browsing (for link checks), and image analysis providers (for image checks)
• Connected mailboxes: Microsoft or Google, when you connect a mailbox
• Analytics and error monitoring: PostHog, Google BigQuery and Sentry

5.2 Advertising Partners

We use Google Ads, Meta (Facebook and Instagram) and Nextdoor to advertise MERENA and to measure whether our ads work. Their tags on our website collect information about your visit, and when you sign up, subscribe, or give us your phone number, we send Google and Meta your email address and phone number in a scrambled (hashed) form so they can tell whether you came from one of their ads. These partners may use this information to show you ads for MERENA on other websites and apps. Some state laws call this “targeted advertising” or “sharing”; you can opt out as described in Section 11. We never share information from your online life profile, Account Finder, the browser extension, your conversations with MERENA, or your household with advertising partners.

5.3 Your Household

If you have a MERENA+ Family plan, you can see the accounts, alerts and verification status of the people you have added to your household. If someone adds you to their household, they can see that information about you.

5.4 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court order or government agency).

5.5 Protection of Rights

We may disclose your information where we believe it is necessary to investigate, prevent, or take action regarding potential violations of our policies, suspected fraud, situations involving potential threats to the safety of any person, or as evidence in litigation in which we are involved.

5.6 Business Transfers

If we are involved in a merger, acquisition, or asset sale, your personal information may be transferred as part of that transaction. We will provide notice before your personal information becomes subject to a different privacy policy.

5.7 With Your Consent

We may share your information for any other purpose with your consent.

6. Cookies and Similar Technologies

We use cookies, browser storage and similar technologies, including:

• Essential: keep you signed in, remember your progress through sign up, and keep our Services secure
• Preferences: remember your settings, such as your theme and daily challenge progress
• Analytics: PostHog, HubSpot and Sentry help us understand how our Services are used and find problems
• Advertising: Google Ads (through Google Tag Manager), the Meta Pixel and the Nextdoor Pixel measure our ads and help show you ads for MERENA. We also store the ad click identifier you arrived with for up to 90 days.

You can set your browser to refuse all or some cookies, or to alert you when cookies are being sent. If you disable or refuse cookies, some parts of our Services may become inaccessible or not function properly.

7. Data Retention

We keep your personal information only for as long as we need it for the purposes described in this policy, including to satisfy legal, accounting, or reporting requirements. In particular:

• Your account, profile, household, Safety Score history and conversations are kept until you delete your account.
• Our own analytics records are kept for up to 25 months.
• Records of payments are kept by us and Stripe for as long as tax and accounting laws require.
• Records of the emails and texts we send, and of your consent and opt-out choices, are kept so we can honor them. If you ask us to delete your information, we keep your opt-out choices in a form that does not directly identify you, so we do not contact you again.
• Records that you authorized adding someone to your household are kept as a record of that authorization.

When your information is no longer needed, we delete it or make it anonymous.

8. Third-Party Links and Services

Our Services may contain links to third-party websites, services, or content that are not operated by us. We have no control over and assume no responsibility for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites you visit.

9. Data Security

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction, including encrypting information in transit and encrypting mailbox access before we store it. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

10. Children's Privacy

MERENA accounts are for adults. Our Services are not directed to children under 13, and we do not knowingly collect personal information directly from children under 13. If we learn that we have collected personal information directly from a child under 13, we will delete it. If you believe we may have, please contact us.

With MERENA+ Family, a parent or legal guardian can add a child to their household and tell us about the child's devices and online accounts so that MERENA can send the parent relevant alerts. This information comes from the parent, not the child, and the parent confirms they are the child's parent or legal guardian before adding it. Children do not get a MERENA login, and we do not email or text children. A parent can review, change or remove a child's information at any time from their household settings, or ask us to delete it.

11. Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information, including:

• Access: Request a copy of the personal information we hold about you
• Correction: Edit your profile at any time, or ask us to correct inaccurate or incomplete information
• Deletion: Delete your account at any time from your account settings. This cancels any subscription and deletes your account, profile, household, alerts, Safety Score history and connected mailboxes. Copies kept by our messaging, analytics and advertising partners, and our customer relationship records, are not removed automatically; ask us and we will remove them too, subject to the exceptions in Section 7.
• Data portability: Request a copy of your data in a structured, commonly used format
• Emails, texts and notifications: Change what we send you in your notification settings, use the unsubscribe link in any email, or reply STOP to any text
• Targeted advertising: Ask us to stop sharing your information with advertising partners for targeted advertising by contacting us. You can also limit ads through Google and Meta ad settings.
• Account Finder: Turn off any Account Finder source in the browser extension, disconnect a connected mailbox, or remove the extension. Turning off a source also clears the information the extension was holding for it on your device.

To exercise any of these rights, please contact us using the information provided below. We may need to verify your identity before acting on your request. We will respond within 45 days.

12. Colorado and Other State Privacy Rights

If you are a Colorado resident, the Colorado Privacy Act (CPA) provides you with the right to access, correct, delete, and obtain a portable copy of your personal data, and to opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects. Residents of other states may have similar rights under their state's laws. To exercise these rights, please contact us at the address below.

Some information you give us, such as information about your children or about your health care providers, may be “sensitive data” under state law. We use it only to provide the Services you ask for, and you can remove it at any time.

If we decline to take action on your request, you may appeal by replying to our response with “Appeal” in the subject line. We will respond to your appeal within 45 days. If you are not satisfied with the result, you may contact the Colorado Attorney General or your state's attorney general.

13. Where We Operate

MERENA is based in the United States, and our Services are intended for people in the United States. Your information is stored and processed in the United States.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be indicated by the “Last Updated” date at the top of this page. If we make material changes, we will notify you by email or through our Services before they take effect. Your continued use of our Services after any changes take effect constitutes your acceptance of the updated Privacy Policy.

15. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at: