Privacy Policy

Windward Limited (merlynai.co) (“we,” “our,” or “us”), a company incorporated in the Hong Kong Special Administrative Region with its registered office at Suite 4002A, 40/F., Tower 1, Lippo Centre, 89 Queensway, Admiralty, Hong Kong, is committed to protecting the privacy of your personal data. We comply with the requirements of the Personal Data (Privacy) Ordinance (Cap. 486) of the Hong Kong Special Administrative Region. This policy explains how we collect, use, and protect your information when you visit our website merlynai.co and/or app.merlynai.co.

We may collect and hold personally identifiable information about you when you interact with our website. This may include:

• Account data. We collect your email address and password when you create an account.
• Payment data. When you make a purchase, you provide payment details (such as credit card numbers). This data is collected directly by our third-party payment processors, Stripe and/or Airwallex. We do not store or copy your full credit card information on our own systems.
• Technical data. We automatically collect your IP address and browser type to ensure your login session is secure.

We collect and use your personal data for the following purposes:

• To provide, maintain, and improve our services.
• To process transactions, orders, and requests you make on our website.
• To communicate with you and respond to your inquiries.
• To send you marketing materials — only if you have provided consent or indicated no objection.

We treat your personal data as confidential. We will never sell or rent your data. However, to run our website and process your orders, we must share your data with:

• Payment gateways. Stripe and Airwallex to securely process your credit card payments.
• Data transferred outside Hong Kong. Your email and payment data may be transferred to and processed on secure servers located outside of Hong Kong by our payment processors. These transfers are done safely and legally in line with the PDPO.
• Law enforcement. Regulatory bodies or police, only if required by Hong Kong law.

If you choose to connect your YouTube channel to Merlyn, we access certain Google user data through Google APIs (including the YouTube Data API) strictly to provide the publishing and analytics features you request. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Data we access. Your basic channel information (channel name, channel ID, and profile image), the OAuth tokens that authorise the connection, and the metadata and performance statistics (such as views, likes, and comment counts) of the content you publish through Merlyn. We do not access any other Google services or data.
• How we use it. Solely to provide user facing features inside Merlyn: showing which channel is connected, publishing the videos you create to your channel when you ask us to, and displaying the performance of those posts in your analytics dashboard. We never use Google user data for advertising, profiling, or credit assessment.
• No AI or machine learning training. We do not use Google user data to develop, improve, or train generalised artificial intelligence or machine learning models, and we do not transfer it to any third party service that would use it to train such models.
• Sharing and transfer. We do not sell Google user data, and we do not transfer it to third parties except to the secure cloud infrastructure providers that host our service and act on our instructions, or where disclosure is required by law. It is never shared with data brokers or advertisers.
• Protection. OAuth tokens are stored encrypted at rest, transmitted only over encrypted (TLS) connections, and accessible only to the systems that need them to perform the features described above.
• Retention and deletion. We keep Google user data only while your channel remains connected. You can disconnect at any time from the Integrations page in Merlyn, or revoke our access from your Google account security settings. After disconnection or account deletion, we delete the stored tokens and associated Google user data from our systems within 30 days. You may also request deletion at any time by contacting us at the address below.

We will not keep your personal data longer than is necessary for the fulfillment of the purposes for which it was collected. Once it is no longer required, the data will be securely deleted or destroyed.

Our website uses cookies to enhance your browsing experience. Cookies collect statistical data about user preferences but do not identify you personally. You can choose to accept or reject cookies via your browser settings, though rejecting them may affect your ability to use certain website functions.

We implement strict physical, electronic, and managerial measures to safeguard your personal data from unauthorised access, loss, or disclosure. While we strive to protect your data, no transmission over the internet can be guaranteed to be 100% secure.

Under the PDPO, you have the right to:

• Check whether we hold personal data about you.
• Access and request a copy of your personal data.
• Correct any inaccurate personal data.
• Opt-out of receiving direct marketing materials at any time.

To exercise your rights or make inquiries about your personal data, please contact our Data Protection Officer at hi@merlynai.co.

We may update or modify this Privacy Policy from time to time. The latest version will always be posted on this page. Your continued use of our website after changes are posted constitutes your acceptance of the updated policy.