Privacy notice

What the app handles

After authentication, the app may handle account identity supplied by the sign-in provider, organisation/workspace information, matter descriptions, uploaded documents, extracted document text, research material, evidence records, adversarial-review findings, human-review statements and audit events needed to operate the legal workflow.

Why it is handled

Data is used to provide matter intake, document processing, legal research support, evidence tracing, analysis, adversarial review, Human Legal Review, release control, auditability and reliability/security diagnostics. MERENVAY does not treat telemetry as a substitute for legal evidence.

Cookies and analytics

The current public live-beta source does not intentionally load marketing analytics, advertising pixels or newsletter tooling. Authentication and hosting providers may use strictly necessary technical cookies or equivalent storage when their services are invoked. Any future analytics or marketing technology must be disclosed here before it is enabled.

Notion and office intelligence

The public/runtime Office Brain uses only records explicitly marked for runtime-safe reusable use. Private client, matter, personal and project-specific Notion content is not designed to be synchronized into the public runtime. Matter data is not sent to Notion by the Concierge flow.

External orchestration and AI services

AI and optional orchestration services may process bounded matter context only through configured application controls. Optional orchestration is fail-closed and is not legal authority, evidence or a human reviewer. This notice does not claim that every underlying provider, subprocessor, hosting region or retention mechanism has been independently audited by MERENVAY. Enterprise use requires a completed deployment-specific data-processing and subprocessor schedule.

Retention and deletion

Authenticated users can permanently delete a matter from its Audit/Data Lifecycle area. The app attempts to remove that matter's app-held records together with stored documents, extracted text and stored research artifacts, and reports success only when the application deletion completes. Deletion cannot erase copies already downloaded by a user or third party, and underlying provider backups or caches may be subject to separate provider retention rules.

Security

Application controls include authenticated matter routes, per-user matter ownership checks, signed document links, file-type/signature validation, bounded document extraction, evidence/source state tracking, stale-analysis invalidation, adversarial review and human release gates. No SOC 2, ISO certification, penetration-test result, guaranteed data residency or independent security accreditation is claimed on this page.

International transfers and legal basis

Hosting location, cross-border transfer mechanisms, controller/processor roles, retention schedules and contractual legal bases must be fixed in the applicable deployment or engagement documents before regulated production use. This public notice describes the application's current operating boundary; it is not a deployment-specific DPA.

Jordan privacy framework

This notice is designed with reference to Jordan Personal Data Protection Law No. 24 of 2023 and the applicable regulations, instructions and official privacy-policy guidance. It does not itself establish that every deployment-specific legal obligation has been satisfied.

Questions and rights

Use the contact and data-protection channel identified in the applicable MERENVAY engagement or deployment agreement. Do not send privileged material through a public contact channel.