Privacy Policy

Merlin is run by Magic Merlin Ltd., a company registered in Israel (company number 517164828), at [Registered office address — to confirm]. We decide how and why your information is used, so we are responsible for it (the “database owner” under Israeli law, and the “controller” under the GDPR).

Privacy contact: [Privacy contact or DPO name — to confirm], [Privacy contact email — to confirm].

Merlin is invite-only. It is used by creators who work with us, by our agency managers, and by the person who makes payments on our behalf.

Information you give us

• Account details: your name, email address, phone number, password (stored only as a one-way hash) and, if you choose, your profile photo. If you sign in with Google, Google tells us your email address, your name and a Google account identifier.
• Social accounts: the Instagram, TikTok or Facebook handles you add.
• Payment details: how you want to be paid. For a bank transfer: the account holder name, account number or IBAN, bank name, SWIFT code and your address. For PayPal: the payment links you send us with your invoices. The account number and your address are encrypted in our database.
• Contract details: when you sign a contract: your name as you typed it, your email, your tax or national identification number (for example an SSN or ITIN), your address and the signature you draw. The identification number is encrypted in our database. It appears on the signed contract itself, and nowhere else in Merlin.
• Your work: the videos, photos and files you upload, your notes and changes to briefs, and the invoices you send.
• Messages: what you write to us in Merlin's chat, the files you attach, and meetings we arrange there.
• Requests: anything you send us through “Your data” on your profile.

Information Merlin records as you use it

• Activity: what happens on your campaigns — for example when a contract was sent and signed, when a video was sent, approved or returned, and when you were paid.
• Security records: when you sign in, and a log of important actions and who took them. When you sign a contract or accept these terms, we record the date and time, your IP address and your browser type, so that the signature or acceptance can be shown to be yours.
• Notifications: which notices and emails we sent you, and whether they were delivered.

Information from the agency

Before you join, a manager enters your name and email address to invite you, and sets the terms of each campaign: what you will make, the deadlines and the fee. Managers also write feedback on your videos and briefs.

We do not use third-party analytics, advertising trackers or tracking pixels in Merlin.

We do not sell your information, we do not use it for advertising, and we do not make decisions about you by automated means alone. Our managers can use an AI assistant inside Merlin to look up campaign information and draft messages (see section 5). The assistant does not decide anything: a person reviews and approves every action.

No law requires you to give us any of this information. But we need some of it to work with you:

• Required: your name, email and phone number, a way to be paid, and — when you sign a contract — your identification number and address. Without them we can't open your account, sign a contract with you, pay you or meet our tax duties.
• Optional: your profile photo, and social handles unless the agency asks for them for your campaign. Leaving them out changes nothing else.

Inside the agency, managers can see everything about the creators they work with. The person who makes payments sees only what is needed to pay you: your name, the amount, the payment method and details, and the invoice. Our staff are bound by a confidentiality notice.

These companies process information for us, on our instructions:

If you choose “Sign in with Google”, Google handles that sign-in under its own privacy policy.

Some organisations receive information as independent organisations, not on our behalf: PayPal and banks when we pay you; Zoom or Google Meet when you join a meeting link; and Merlin's marketing channels, where the videos you deliver are published as your creator agreement allows. We may also disclose information when the law requires it, to tax authorities for example, or to protect our legal rights.

Merlin runs in Google Cloud's Tel Aviv region, in Israel. The European Commission and the UK recognise Israel as giving personal data an adequate level of protection.

Some providers in section 5 process information outside Israel, including in the United States. Where they do, we rely on the safeguards in our agreements with them, such as the European Commission's standard contractual clauses where they apply.

When we close an account, the person can no longer sign in, and we keep only what we must keep for the periods above.

• Encryption: all traffic is encrypted (HTTPS). Account numbers, addresses and identification numbers are also encrypted inside the database, with a key kept separately.
• Access: each person sees only what their role needs. Every request checks who is asking. Files are never public; each download checks permission first.
• Accounts: passwords are stored only as one-way hashes. Sign-in codes expire, and repeated failed attempts are slowed down.
• Records: important actions are logged, so we can see who did what and when.

No system is perfectly secure. If a security incident affects your information, we will act as the law requires, including telling the Privacy Protection Authority and you when that applies.

You can ask us to:

• See your information: we'll send you a copy of what Merlin holds about you.
• Correct it: if something is wrong, incomplete or out of date. You can change many details yourself on your profile.
• Delete it: we'll delete what we don't need to keep. We can't delete records we must keep by law, such as signed contracts and payment records, and we'll tell you what we keep and why.
• Object or restrict: you can object to a use of your information based on our legitimate interests, or ask us to limit how we use it.
• Take it with you: where the GDPR applies, you can ask for the information you gave us in a common electronic format.

To ask, use “Your data” on your profile in Merlin, or email [Privacy contact email — to confirm]. We'll reply within 30 days. We may ask you to confirm who you are first.

If you are not happy with our answer, you can complain to Israel's Privacy Protection Authority (gov.il). If you live in the European Union or the United Kingdom, you can also complain to your local data protection authority. [EU/UK representative, if appointed — to confirm]

Merlin uses only cookies it needs to work. There are no analytics or advertising cookies, so we don't ask for cookie consent.

Merlin also saves two small settings in your browser's storage: whether you opened chat full screen, and, for managers, which assistant conversation was open. They never leave your device.

We send emails about your account and your work: sign-in codes, invitations, contracts to sign, feedback, approvals, payments and messages waiting for you. These are service messages, not advertising. If you'd rather not get campaign update emails, tell us and we'll turn them off. Sign-in codes and contracts to sign are always sent, because the service can't work without them.

We will not send you advertising unless you have agreed to receive it, and every such email would let you unsubscribe.

If we change this policy in a way that matters, we'll show you the new version in Merlin the next time you sign in. The date and version at the top of this page show which one you are reading.

Magic Merlin Ltd., [Registered office address — to confirm]. Privacy questions: [Privacy contact email — to confirm].