GDPR policy

Our GDPR approach

MergeLoom is built for data minimisation, customer control, clear execution boundaries, and accountable AI coding workflows. We aim to process only the personal data needed to operate the website, controller, accounts, support, billing, security, and customer communications.

Controller and processor roles

• For website visitors, prospects, support contacts, billing contacts, and controller account users, MergeLoom usually acts as an independent controller of ordinary business contact and account information.
• For customer-controlled workflows, the customer decides what ticket data, repository data, context, commands, AI providers, and validation rules are used in its environment.
• If MergeLoom processes personal data on behalf of a customer under a written agreement, the relevant data processing terms or customer agreement control that processing.

Personal data rights

Where GDPR or UK GDPR applies, individuals may have rights to be informed, access personal data, correct inaccurate data, request deletion, restrict processing, object to processing, request portability, and complain to a supervisory authority.

How to make a GDPR request

Email support@mergeloom.ai with enough information for us to identify the account, workspace, or communication involved. We may need to verify your identity before acting on a request.

Customer-hosted worker boundary

The MergeLoom worker performs code checkout, context assembly, AI execution, tests, validation, repair attempts, and branch push inside the customer environment. This design helps keep sensitive customer execution data out of vendor-hosted agent infrastructure.

International transfers and subprocessors

Some service providers may process data outside the UK or EEA. Where transfer safeguards are required, we aim to use appropriate contractual, organizational, and technical safeguards. Customers can request information about relevant subprocessors for commercial or security review.

Security and breach handling

We use reasonable technical and organizational measures to protect personal data. If we become aware of a personal data incident that requires notice, we will assess it and notify affected parties or regulators where legally required.

Contact

For GDPR, UK GDPR, or data protection requests, email support@mergeloom.ai.