Privacy Policy

1. About this policy

This policy explains what personal data Merra collects, why, what we do with it, and what your rights are. It’s written in plain English. If anything’s unclear, email privacy@trymerra.ai.

This policy covers Merra Practice — the consumer interview-practice product at trymerra.ai. Separate terms apply to our business product when it relaunches.

2. Who we are

Merra Ai Ltd is the data controller for your personal data when you use Merra Practice. We’re a UK company (Co. No. 16470710), registered office 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.

3. What data we collect

Account data

• Display name (taken from your email address, or from your Google account)
• Email address
• Password hash (we never see your actual password) or Google sign-in ID
• Account creation date

Practice content

• Audio and video of your practice interviews
• Transcripts generated from those recordings
• Scores, evaluations, and feedback
• Facial expression signals detected during interviews when your camera is on — an expression label (e.g. “smiling”, “neutral”), a timestamp, and a confidence score. The analysis runs on your own device and we store only these results, not the video frames used to produce them — see Section 5
• Uploaded content (CVs, job descriptions) — when you use a mode that takes a CV or job description

Payment data

Handled by our payment provider. We see: last 4 digits of your card, card type, billing country, transaction ID. We never see or store your full card number or CVC.

Device and technical data

• Browser type, operating system
• IP address (used to estimate approximate location for fraud prevention; retained for up to 30 days)

Usage data, session replay and ad measurement

Only collected if you accept optional cookies:

• Pages visited, features used, errors encountered
• A replay of your interactions with the site (clicks, scrolls, navigation); passwords are always masked
• Which ad brought you to Merra and whether you signed up or paid

4. Why we use it and our legal basis

Every non-essential email includes an unsubscribe option, and you can opt out at any time by emailing support@trymerra.ai. You can withdraw consent for any consent-based processing at any time — see Section 9.

5. AI — how we use your data

Merra is an AI product. Two things happen with your content, and they’re separate:

1. Real-time feedback (third-party AI providers)

We use third-party AI providers for reasoning and for voice. They process your interview content in real time to generate your feedback. Our contracts with these providers prohibit them from training their own models on your content.

2. Improving Merra’s own models

We use your practice content — interview audio, transcripts, scores, evaluations, and CV/JD uploads — to train and fine-tune Merra’s own AI models. The goal is better feedback, smarter interview simulations, and a product that learns what actually helps people prepare well.

You can opt out at any time in your account settings — one toggle, takes effect immediately for any future use of your content. Content that’s already been used in a completed training cycle can’t always be removed from a finished model, but we won’t include you in anything new going forward.

When we use your content for training:

• We use it inside Merra only. We don’t sell it, share it, or use it to train anyone else’s models.
• We remove direct identifiers (name, email, account ID) before training where technically possible.
• We use it only to improve Merra Practice — not for advertising, not for any kind of decision-making about you as an individual.
• You can also request deletion of your past contributions by emailing privacy@trymerra.ai.

Legal basis: Legitimate interest (UK GDPR Art. 6(1)(f)). We have a legitimate interest in improving our service, and we’ve assessed that this doesn’t override your rights given the safeguards above and your ability to opt out at any time. You can object via the settings toggle, or by emailing privacy@trymerra.ai.

Facial expression analysis (on your device)

When your camera is on during a practice interview, Merra analyses your camera feed to detect facial expressions (for example smiling, neutral, or surprised). We use this to make your coaching feedback richer — covering how you present yourself, not just what you say.

• The analysis runs in your browser, on your own device. The video frames it looks at are not sent to us or to anyone else for this purpose.
• We store only the results — an expression label, a timestamp, and a confidence score, linked to that interview — and use them in your evaluation and coaching feedback.
• We don’t use these signals to identify you, and we don’t use them for any decision about you outside your own practice feedback.
• If you practise with your camera off, no expression analysis happens.

Expression signals are part of your practice content: they’re deleted with your account (Section 6) and covered by the same training opt-out above.

Anonymised metrics (always on)

We also use anonymised, aggregated metrics (e.g. “X% of users finish their first interview”, “average score by interview type”) to track how the product is performing. This data can’t be traced back to you.

Automated decisions

Merra’s scores and feedback are generated automatically, but they are for practice only and have no legal or similarly significant effect on you. We don’t use solely automated decision-making of the kind covered by Article 22 UK GDPR, and your results are not used to make decisions about you as an individual outside the product.

6. How long we keep your data

Training contributions: if your content has been used in a completed AI training cycle, that contribution may persist in trained models even after you delete the source content or opt out. We won’t include you in new training runs going forward.

7. Who we share your data with

We use third-party providers who handle data on our instructions and under contract, in the following categories:

• Hosting, database and file storage — UK, Singapore and Australia
• AI reasoning and voice generation — United States
• Payment processing — UK, EU and United States
• Email delivery — EU
• Analytics, session replay and ad measurement (consent-only) — United States

We’ll tell you in advance before adding a provider that handles a new category of data, and we can name our current providers on request — email privacy@trymerra.ai.

Our engineering team works from outside the United Kingdom and accesses production systems under contractual confidentiality and data-protection obligations, on a least-privilege basis.

We don’t sell your data. We don’t share it with advertisers.

We may share data if required by law (e.g. court order), to investigate fraud or abuse, or as part of a business sale or merger (you’d be told before this happens).

8. International transfers

Some of our providers, and our own engineering team, operate outside the UK. When your data is transferred outside the UK, we use UK GDPR-approved transfer mechanisms:

• Standard Contractual Clauses (SCCs) combined with the UK International Data Transfer Addendum, or, where a provider is certified, the UK Extension to the EU-US Data Privacy Framework
• Transfer impact assessments where required

9. Your rights (UK GDPR)

You have the right to:

• Access — get a copy of your personal data
• Rectification — correct anything that’s wrong
• Erasure — delete your data (“right to be forgotten”)
• Restriction — pause processing
• Portability — get your data in machine-readable form
• Object — object to processing based on legitimate interest
• Withdraw consent — for analytics, session replay, ad measurement, marketing, and any other consent-based processing
• Complain to the ICO at any time (see Section 13)

To exercise any of these: email privacy@trymerra.ai. We’ll respond within 30 days. There’s no charge.

Some of these you can do yourself:

• Opt out of AI training (account settings)
• Delete your account (account settings)
• Manage cookie preferences (Cookie Policy page)

For everything else — including a copy or export of your data, or deleting individual recordings — email us and we’ll do it within 30 days.

10. Users under 18

Minimum age to use Merra: 18. When you sign up, you confirm you are 18 or over. Merra is not intended for under-18s, and we don’t knowingly collect data from anyone under 18.

If you’re a parent or guardian and believe someone under 18 has signed up, email privacy@trymerra.ai and we’ll delete the account.

11. Cookies

We use a small number of cookies. See our Cookie Policy for details and to manage your preferences.

Analytics, session replay and ad measurement only run if you’ve accepted optional cookies. If you’ve selected “Essential Only”, none of them are collected.

12. Security

• Encryption: TLS in transit, AES-256 at rest
• Access: role-based access for staff, on a least-privilege basis
• Recordings: stored in private storage that is not publicly accessible
• Monitoring: we use our platform providers’ security monitoring and alerts
• Backups: encrypted, managed by our database provider
• Vendor security: all providers must meet our security standards

If we discover a personal-data breach that’s likely to affect you, we’ll notify you and the ICO within 72 hours, as required by UK GDPR.

Security concerns: security@trymerra.ai.

13. Complaints

If you’re unhappy with how we’ve handled your data, please email privacy@trymerra.ai first — we’ll try to resolve it.

You also have the right to complain to the Information Commissioner’s Office (ICO) at any time, without contacting us first:

• Website: ico.org.uk
• Phone: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF

14. Changes to this policy

We may update this policy. For material changes (e.g. a new category of data, a new category of provider, changes to retention), we’ll email you in advance. For minor changes (e.g. clarifying wording), we’ll update the “Last updated” date at the top.

15. Contact

Merra Ai Ltd 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom

• privacy@trymerra.ai — privacy questions, rights requests
• security@trymerra.ai — security issues
• support@trymerra.ai — general support