# Merra – Confidentiality and Data Privacy Policy

Last updated: 24/02/2026

This policy outlines our commitment to safeguarding user data, including data accessed via Google API Services and Meta Marketing API. It ensures compliance with Google's API Services User Data Policy, Meta's Platform Terms, and establishes guidelines for secure, transparent, and limited data handling.

## 1. Purpose and Scope

This Confidentiality Policy governs the handling of sensitive user data, including but not limited to data obtained via Google API Services and Meta Marketing API. Our approach prioritizes transparency, limited use, and secure handling to protect user data and comply with industry standards.

## 2. Use of Google Data

We utilize Google API Services to improve user experience and provide seamless account functionality:

- **Identification:** Authenticate accounts and identify users.
- **User Profiles:** Create usernames and associate profile pictures.
- **Communication:** Use email addresses for notifications and account recovery.

## 3. Use of Meta Marketing API

We integrate with Meta Marketing API to enable the following functionality:

- **Content Upload:** Allow users to upload generated videos directly to their Meta Business Suite accounts.
- **Ad Account Access:** Access user's ad accounts (with explicit permission) to facilitate content uploads.
- **Campaign Creation:** Enable users to initiate campaign creation with their uploaded content.

All Meta API access is performed with the user's explicit consent and authentication. We do not store Meta access tokens beyond the duration of the specific upload task.

## 4. Transparency in Data Access and Use

- **Accurate Representations:** We clearly disclose the purpose, types of data accessed, and use cases to users during authorization and in our privacy policy.
- **Updates and Consent:** If data usage changes, users will be notified and prompted for explicit consent before new use cases or permissions are implemented.
- **Meta-Specific Disclosures:** When requesting access to Meta accounts, we clearly explain what permissions are being requested and how they will be used.

## 5. Data Use and Limitations

- **Strictly Limited Use:** User data is used only for user-facing features prominently displayed in our application.
- **No Unauthorized Sharing:** We do not sell, transfer, or use data for profiling, advertising, or surveillance purposes.
- **Compliance:** All usage adheres to Google's restrictions on sensitive and restricted API scopes and Meta's Platform Terms.
- **Meta Content:** We do not store copies of content uploaded to Meta platforms beyond what is necessary for the upload process.

## 6. Minimum Permissions

- **Least Privilege Principle:** Permissions requested are limited to those necessary for app functionality.
- **Incremental Authorization:** Data access is requested in context to ensure relevance and user understanding.
- **No Excessive Access:** We avoid "future-proofing" requests or asking for unnecessary data.
- **Meta Permissions:** We request only the minimum required Meta permissions (ads_management and business_management) needed for video uploads.

## 7. Secure Data Handling

- **Encryption and Access Control:** All data is encrypted during transmission and at rest using industry-standard protocols.
- **Restricted Access:** Only authorized personnel can access sensitive data, with all access logged and monitored.
- **Compliance with Security Standards:** For sensitive API scopes, we adhere to security assessments and maintain a secure environment.
- **Token Security:** Meta access tokens are stored securely, used only for the intended operation, and not persisted beyond their necessary lifetime.

## 8. Data Storage and Deletion

- **Retention Period:** Data is retained only as long as necessary to deliver user-facing features or comply with legal requirements.
- **User Control:** Users can request data deletion at any time by sending an email to **[hello@merra.ai](mailto:hello@merra.ai)**. Upon request, data is securely and permanently removed.
- **Meta Data:** We do not store Meta access tokens or ad account information beyond the duration of the user session.

## 9. Human Data Access

- **Limited Human Access:** Access by personnel is allowed only in these cases:

- Explicit user consent (e.g., support requests).
  - Security investigations (e.g., abuse or bugs).
  - Legal obligations or aggregated operations under privacy laws.

## 10. Transparency and User Rights

- **Full Visibility:** Users are informed of how data is collected, used, and stored.
- **Control Options:** Users can manage, download, or delete their data directly within the app or by contacting support.
- **Meta Integration Transparency:** Users are clearly informed when they are being redirected to Meta services or when Meta API calls are being made on their behalf.

## 11. Breach Protocol

- **Rapid Response:** Users are promptly informed of data breaches.
- **Risk Mitigation:** Immediate measures are taken to secure data and minimize impact.
- **Platform Notification:** In case of breaches affecting platform data, we notify both users and the relevant platform (Google or Meta) as required.

## 12. Confidentiality Agreements

- **Employee and Contractor Agreements:** Personnel and partners must sign confidentiality agreements to safeguard user data.
- **Periodic Training:** Regular training reinforces best practices in data privacy and security.

## 13. Compliance with Platform Policies

We fully comply with platform policies by ensuring:

- **Google API Services User Data Policy:**
  - Accurate representations of who we are, what data we access, and why.
  - Minimized permissions and limited use of Google API data.
  - Secure handling of all data and prevention of unauthorized access.

- **Meta Platform Terms:**
  - Proper disclosure of our app's functionality and data usage.
  - Respect for user privacy and control over their Meta content.
  - Compliance with Meta's Developer Policies and Community Standards.
  - Proper attribution of Meta integration where required.

## 14. Third-Party Integrations

Our application integrates with third-party services to enhance functionality:

- **Google Services:** For authentication and user profile information.
- **Meta Marketing API:** For uploading content to Meta Business Suite.
- **AWS S3:** For secure storage of generated content.
- **OpenAI (script generation), Google Gemini (text generation), and ElevenLabs (voice synthesis):** For AI-powered content creation.

Each integration follows the same principles of data minimization, security, and transparency outlined in this policy.

## 15. Contact

For questions or concerns, please contact us at:

📧 **[hello@merra.ai](mailto:hello@merra.ai)**