Mergly
Sign in
Last updated 18 October 2026

Privacy Policy

Mergly is a dashboard for planning, creating and publishing social media content. This policy explains what we collect, why we need it, and what you can change or delete.

Who we are

This policy explains how Muhammad Hammad, trading as Mergly, handles personal data when you use the service. Muhammad Hammad is the data controller, meaning we decide why and how your personal data is used. You can reach us at support@mergly.app.

We keep this to what the service actually needs: no advertising networks, no marketing trackers, and no selling of your data.

What we collect and why

  • Name, email address and login credentials — to create your account, sign you in, and send service messages such as password resets.
  • Workspace details, posts, drafts, uploads and messages — to run the features you use and show your history back to you.
  • Profile information from social accounts you connect (name, username, profile photo, page details) — to show which account you are posting as and to publish or read messages with your permission.
  • Usage data, device identifiers and IP address — to run plan limits and usage counters, keep the service secure, and prevent abuse.
  • Support messages you send us — to answer you and keep a record of the help given.

We never see or store your payment card details. Your card is handled by our payment provider when you subscribe.

The legal basis we rely on

We process your data to perform our contract with you (providing the account and features you signed up for), on our legitimate interests (security, fraud prevention, improving the product), with your consent where we ask for it (connecting a social account, marketing emails), and where we have a legal obligation (tax and accounting records).

How social connections work

When you press Connect, you sign in directly with the social platform (Instagram, Facebook, LinkedIn or TikTok) on their own website. The platform then grants Mergly a permission key that lets us post or read messages on your behalf. That key is stored on our servers, never in your browser, and is only used for the actions you approve.

Files you upload

Images and videos you upload for a post are stored in private storage that only members of your workspace can reach. They are not shared publicly by us.

AI features

Caption, post and image generation send the text or images you select to our AI provider so it can produce the result. The output is saved with your draft until you delete it.

Who we share data with

  • Service providers that run the platform for us — hosting, database and file storage, email delivery, and the AI provider used for captions and images. They act on our instructions and may not use your data for their own purposes.
  • Our Merchant of Record, Paddle — to sell the subscription, take payments, manage billing and tax, and issue invoices.
  • The social platforms you connect — to publish what you ask and, where permitted, receive messages for your inbox.
  • Professional advisers such as lawyers and accountants, under duties of confidentiality.
  • Authorities, where the law requires it — for example a valid legal order.

Where your data is processed

Our providers run data centres in different countries, so your data may be processed outside the country you live in. We rely on the standard contractual safeguards our providers publish for those transfers.

How long we keep data

We keep your account and content while your account is active. Disconnecting a social account deletes its stored permission key immediately. When you close your account, your posts, uploads and messages are deleted, and copies in routine backups expire on their own schedule. Support records are kept for a short period after the issue is closed.

Your rights

You can ask to access a copy of your data, correct anything wrong, delete it, restrict or pause our processing of it, take it with you in a portable format, object to processing based on legitimate interests, and withdraw consent at any time. If we asked for consent, withdrawing it does not undo processing that already happened. Where these rights apply to you, we will respond within one month, and you can complain to your local data protection authority.

Cookies and similar storage

Mergly uses only the small amount of browser storage the service needs to work: a sign-in session, your day/night theme choice, and whether the sidebar is open. These are essential and are not used for advertising.

You can clear them from your browser at any time; signing out and clearing site data removes them, though you will need to sign in again.

Security

Access is protected by login and per-workspace permissions, traffic is encrypted in transit, and permission keys for social platforms are never sent to your browser. No service is perfectly secure, so tell us promptly if you spot anything that looks wrong.

Changes to this policy

If we change this policy we will update this page and the date above. Material changes will be announced in the app.

Contact

Questions about this policy, or a request to access or delete your data? Email support@mergly.app. You can also read our Terms of Service and Refund Policy.

Back to Mergly