Privacy notice

Human Consultation contact requests

If you explicitly use the Human Consultation request form, MERENVAY stores the identity and contact details, client type, organisation (if supplied), residence/registration location, matter classification, jurisdiction, stage, urgency, parties entered for conflict screening, factual summary, desired outcome, important dates, document-availability indicator, referral source and limited non-identifying visit context that you submit. Personal/contact data and sensitive matter details have separate explicit consent gates. Access is limited to the authenticated authorised owner for screening and potential reply; the form does not send these details to Notion, Hermes, public chat, mailing lists, advertising systems or third-party analytics. Network region and VPN/proxy status remain UNKNOWN unless a verified infrastructure signal becomes available; MERENVAY does not infer them from identity. Documents are not uploaded through this public form. Submission does not create a lawyer-client relationship, accept a matter, produce legal advice, request payment or guarantee a response time. The owner can permanently delete the stored enquiry.

What the app handles

The public beta does not require account identity and does not persist guest questions as legal matters. For public Quick Chat, MERENVAY stores minimised anonymous operational metrics for submitted questions and separately stores raw anonymous question text only when the visitor explicitly opts in. The public-chat analytics record is not a client matter and does not contain an account identity. If a user separately enters the protected private workspace, that authenticated workflow may handle account identity supplied by the sign-in provider, organisation/workspace information, matter descriptions, permitted documents, extracted text, research material, evidence records, adversarial-review findings, human-review statements and audit events needed to operate that private legal workflow.

Why it is handled

Data is used to provide matter intake, document processing, legal research support, evidence tracing, analysis, adversarial review, Human Legal Review, release control, auditability and reliability/security diagnostics. MERENVAY does not treat telemetry as a substitute for legal evidence.

Cookies and analytics

The public beta uses no third-party marketing analytics, advertising pixels or newsletter tooling. The main interactive MERENVAY page records first-party page views, estimated 30-minute tab sessions, browser-day appearances and Quick Chat openings. Recent event records may also include server time, an ephemeral tab-session reference, page path, referrer host, UTM source/medium/campaign, browser language, time zone and broad device class. MERENVAY does not store IP address, GPS location, a persistent browser fingerprint, visitor name, submitted legal enquiry text or account identity in this traffic dataset. Global Privacy Control and Do Not Track opt out of these site-traffic events, and automated user agents are filtered where recognisable. The figures remain approximate and do not identify a verified person or cover pre-activation traffic, standalone non-SPA pages, blocked scripts or all bots. Quick Chat question metrics remain distinct, and raw question/reply text is retained only with explicit consent as stated above. Hosting and authentication providers may separately process technical access records under their own retention terms.

Notion and office intelligence

The public/runtime Office Brain uses only records explicitly marked for runtime-safe reusable use. Private client, matter, personal and project-specific Notion content is not designed to be synchronized into the public runtime. Matter data is not sent to Notion by the Concierge flow.

External orchestration and AI services

AI and optional orchestration services may process bounded matter context only through configured application controls. Optional orchestration is fail-closed and is not legal authority, evidence or a human reviewer. This notice does not claim that every underlying provider, subprocessor, hosting region or retention mechanism has been independently audited by MERENVAY. Enterprise use requires a completed deployment-specific data-processing and subprocessor schedule.

Retention and deletion

The public guest flow does not create a saved MERENVAY matter. Protected authenticated users can permanently delete a saved private matter from its Audit/Data Lifecycle area. The app attempts to remove that matter's app-held records together with stored documents, extracted text and stored research artifacts, and reports success only when the application deletion completes. Deletion cannot erase copies already downloaded by a user or third party, and underlying provider logs, backups or caches may be subject to separate provider retention rules.

Security

Application controls include authenticated matter routes, per-user matter ownership checks, signed document links, file-type/signature validation, bounded document extraction, evidence/source state tracking, stale-analysis invalidation, adversarial review and human release gates. No SOC 2, ISO certification, penetration-test result, guaranteed data residency or independent security accreditation is claimed on this page.

International transfers and legal basis

Hosting location, cross-border transfer mechanisms, controller/processor roles, retention schedules and contractual legal bases must be fixed in the applicable deployment or engagement documents before regulated production use. This public notice describes the application's current operating boundary; it is not a deployment-specific DPA.

Jordan privacy framework

This notice is designed with reference to Jordan Personal Data Protection Law No. 24 of 2023 and the applicable regulations, instructions and official privacy-policy guidance. It does not itself establish that every deployment-specific legal obligation has been satisfied.

Questions and rights

Use the contact and data-protection channel identified in the applicable MERENVAY engagement or deployment agreement. Do not send privileged material through a public contact channel.