This policy applies to mevrik.com, the Mevrik console, the Mevrik Business and Mevrik Customer mobile apps, and the Mevrik Messenger widget. It explains how Mevrik Ltd ("Mevrik", "we") uses personal data under the UK GDPR, the Data Protection Act 2018 and PECR, and, for US residents, applicable US state privacy laws.
| You are… | Mevrik's role | Read |
|---|---|---|
| A visitor to mevrik.com | Controller | Part A |
| A user of the Mevrik platform or apps (account owner, team member) | Controller for your account data | Part B |
| A customer of a business that uses Mevrik (you messaged a business via its website, WhatsApp, email, etc.) | Processor — the business is the controller | Part C |
We collect: pages visited, device and browser data, approximate location from IP address, form submissions (name, work email, company, message), and conversations with the Mevrik assistant on our site.
Purpose and basis: run and secure the site (legitimate interests); answer enquiries (steps before a contract); B2B marketing (legitimate interests, with opt-out in every email); analytics cookies (consent — see the Cookie Policy).
Retention: enquiries 24 months from last contact; marketing lists until you opt out or 24 months of inactivity.
We collect: name, work email, phone (optional), company, role, password hash, 2FA secrets, profile image; workspace configuration, agents, knowledge sources, team membership and audit logs; plan, usage counts, invoices and VAT number (card details are held by Stripe, not Mevrik); log-ins, IP address, device identifiers, app version, crash reports; support messages.
Mobile apps additionally use: push-notification tokens (Apple/Google) to deliver notifications; camera and photo access only when you choose to attach an image; device identifiers for security.
Purpose and basis: provide, authenticate and bill the Service (contract); secure the Service, detect abuse, keep audit logs (legitimate interests, legal obligation); service messages such as OTP codes, trial notices, invoices and incident notifications (contract — not optional while you hold an account); product news (legitimate interests, opt-out any time); improve the Service using aggregated, de-identified statistics (legitimate interests).
We do not sell your data or use workspace content or your customers' conversations to train general-purpose AI models.
Retention: account data for the life of the account and 90 days after closure; invoices and billing records 6 years (tax law); security and audit logs 12 months.
If you contacted a business through its Mevrik-powered chat, WhatsApp, SMS, email, Telegram, Messenger or Instagram, that business is the controller of your data. Mevrik processes it as the business's processor under a Data Processing Addendum.
What is processed: your messages and attachments; the channel identifier you used (phone number, email, social handle); your name if given; order or booking data the business has connected (for example Shopify or a calendar); replies from the AI agent and the business's team; satisfaction ratings; conversation metadata.
AI processing: replies are generated with large language models operated by sub-processors listed below. Card numbers, national identifiers and similar data are masked before text is sent to a model, and model providers are contractually prohibited from training on it.
Your rights: exercise them with the business you contacted. If you contact us, we will pass your request to that business and assist.
Retention: set by the business; by default conversations are kept for the life of the business's account and deleted within 90 days of its closure.
Platform and conversation data is hosted in the EU (AWS Ireland, eu-west-1). AI model providers and some messaging platforms process data in the United States or EU. Transfers outside the UK are made under the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or to countries with UK adequacy regulations.
Encryption in transit and at rest, tenant isolation with role-based access, audit logging, PII masking before AI processing, vulnerability scanning, and an incident-response procedure. We notify affected customers of personal data breaches as the law requires.
You may ask to access, correct, delete or receive a copy of your personal data, restrict or object to processing, and withdraw consent. Platform users can export or delete workspace data in the console. Contact privacy@mevrik.com; we respond within one month. You may complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).
US residents (including California): you have the rights to know, delete, correct and to opt out of sale or sharing of personal information. Mevrik does not sell or share personal information for cross-context behavioural advertising and does not discriminate for exercising rights. Requests: privacy@mevrik.com.
The Service is for businesses and is not directed at anyone under 16 (under 13 in the US). We do not knowingly collect their data.
AI agents generate replies and may route or prioritise conversations. They do not make decisions with legal or similarly significant effects on individuals without human involvement; actions such as refunds are subject to the business's approval settings.
We will post changes here and notify platform users of material changes by email or in the console.
Contact:privacy@mevrik.com · Mevrik Ltd, 14 Saville Road, Romford, Essex, RM6 6DT, United Kingdom
Ready to thrive customer experience, increase sales & support?
AI-Powered all-in-one platform to connect, engage, and delight customers across digital channels.
© 2025 Mevrik. All Rights Reserved.