Merlin Service Hub — Privacy policy
Version 2026-10-04-8d6216219c81
The company’s identification and contact details still need to be completed. This document is a draft for testing. Acceptance will become available once those details are complete; you can continue the chat to clarify what you need.
Responsible business and contact
Merlin Service Hub is the brand used for the intermediation described in this document. Draft for acceptance testing: the business identity and contact details await completion in the administrative settings. This site’s chat remains available for requests. This draft does not represent legal certification or validation of business details.
Data, purposes and legal bases
We process names, contact details, location, requests, messages, proposals, financial, service and delivery records to prepare and perform contracts. Necessary records also support legal obligations and the lawful exercise of rights. Sessions and access logs protect security and prevent fraud, with necessity and legitimate interest assessed. Optional uses require specific, revocable consent separate from acceptance of the terms. Do not send sensitive or third-party data that is unnecessary.
Sharing and support services
We share the minimum necessary with those supplying the product, making the delivery, performing the service and processing payment. Depending on the integrations enabled, we use AWS for infrastructure, files and email (SES), OpenRouter and the model provider for AI, Asaas or Stripe for payments and Google for sign-in when chosen and Meta/WhatsApp or Telegram for messages through the linked channel. These services may involve processing outside Brazil. Countries, providers and safeguards must match the actual configuration; this information can be requested through the privacy channel. International transfers require an applicable legal mechanism, not blanket authorization under these terms.
Protection and retention
Access is restricted by role and request; documents are kept in private storage. Document data for building access is encrypted and deleted when the service is completed or within 30 days of collection, whichever comes first. Other records are retained only as long as necessary for the contract, legal obligations and the defence of rights, according to the applicable basis and period. Deletion does not cover records whose retention is legally required.
Your rights and contact channels
Through this site’s chat or the privacy email identified in this document, request confirmation of processing, access, correction, information about sharing, portability where applicable, and anonymization, blocking or deletion in the cases provided by law. You may withdraw consent, object in the cases provided by law and request review of automated decisions that affect your interests. We may verify your identity proportionately to protect your data. Assistance is free; any restriction on deletion will be explained, including financial obligations. Your right to contact the data protection authority is preserved.
AI, cookies and choices
AI assists with initial assessment and conversation. Request a person for clarification or review of the support provided. We use cookies necessary for sessions and security; we do not use audience analytics or marketing cookies. Acknowledging this policy is not blanket consent for new purposes.