Privacy Policy

Effective Date: April 14, 2026 · Last Updated: June 6, 2026

Merlix, LLC
500 Westover Dr #16900
Sanford, NC 27330 USA
hello@merlix.com

1. Introduction

Welcome to Merlix ("the Service"), operated by Merlix, LLC ("we," "us," or "our"). This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our platform at merlix.com.

By creating an account or using the Service, you agree to the collection and use of information described in this policy. If you do not agree, please do not use the Service.

2. Information We Collect

a. Account Information

When you register, we collect your name, email address, and password (stored as a bcrypt hash — we never store plaintext passwords).

b. YouTube Account Data

The Service uses YouTube API Services. If you connect a YouTube channel, we request OAuth 2.0 authorization from Google. We store your OAuth access and refresh tokens in encrypted form. We use these tokens solely to perform actions you explicitly request — such as reading channel analytics, uploading videos, or fetching keyword data — and never for any other purpose.

Your use of YouTube data obtained through the Service is also subject to the YouTube Terms of Service and the Google Privacy Policy (https://policies.google.com/privacy).

We retain your OAuth tokens only as long as your YouTube channel remains connected and only for the purposes you have authorized. When you disconnect a channel — or delete your account — we delete the associated OAuth access and refresh tokens from our systems.

You can revoke the Service's access to your YouTube and Google account at any time via the Google security settings page.

c. Content You Upload

Videos, images, thumbnails, scripts, and other media files you upload are stored in private cloud storage (Cloudflare R2). These files are accessible only to you and any collaborators you invite to your workspace.

d. AI-Generated Content

When you use AI features, the content you submit (titles, descriptions, scripts, prompts) is sent to third-party AI providers (Anthropic, OpenAI, Google, Perplexity, xAI) to generate a response. We log your usage for billing and credit tracking purposes. Please do not submit sensitive personal information in AI prompts.

e. Viral Score Predictions

The Viral Score feature sends your video's thumbnail image, title, and a summary of your script to one or more third-party AI providers listed above, along with metadata about your channel's recent published videos (titles, thumbnail URLs, public view counts, and AI-generated summaries of previously-published scripts). Predictions, rationale text, and the baseline snapshot used for each prediction are stored so that we can compare predictions against actual YouTube performance and display model accuracy over time. You can disable Viral Score grading per channel in the channel settings; disabling removes your channel's graded data from the aggregate accuracy statistics.

f. Idea Inbox Emails

If you use the Idea Inbox feature, you configure an email address to forward newsletters and content sources to our inbound email server. The content of those emails is stored and processed by AI to extract video ideas. We do not read these emails for any purpose other than generating ideas for you.

g. Usage Data

We collect standard technical data including IP address, browser type, pages visited, feature usage, and timestamps. This is used to improve the Service, diagnose issues, and understand how creators use the platform.

h. Billing Data

Payment processing is handled by third-party payment processors. We do not store full credit card numbers. We store transaction records, credit balances, and subscription status in our database.

3. How We Use Your Information

We use your information to:

• Provide, operate, and improve the Service
• Authenticate your identity and maintain your account
• Execute YouTube API actions on your behalf
• Generate AI-assisted content using your prompts
• Process credit purchases and track AI usage
• Send transactional emails (workflow notifications, review requests, billing receipts)
• Analyze aggregate usage patterns to improve features
• Comply with legal obligations

We do not sell your personal information to third parties. We do not use your content to train AI models.

4. Third-Party Services

The Service integrates with the following third parties, each governed by their own privacy policies:

We share only the minimum data necessary with each provider to perform the requested function.

5. Data Storage and Security

• Our primary application server is located in Germany (Hetzner data center, EU)
• Your media files are stored on Cloudflare R2 (globally distributed CDN)
• OAuth tokens are encrypted at rest
• Passwords are hashed with bcrypt and never stored in plaintext
• All connections to the Service are encrypted via HTTPS (TLS)
• Pre-signed URLs for media access expire after 24 hours
• We implement access controls so that your data is accessible only to your workspace members

Despite these measures, no system is perfectly secure. We encourage you to use a strong, unique password and to notify us immediately at hello@merlix.com if you suspect unauthorized access.

6. Cookies and Similar Technologies

We and our service providers store, access, and collect information on your device using cookies and similar technologies (such as local storage and session tokens). We use:

• Essential cookies — required for authentication, session management, and security (including CSRF protection). These cannot be disabled.
• Preference cookies — remember your settings and UI choices.
• Analytics cookies — help us understand aggregate feature usage to improve the Service.

You can manage non-essential cookie preferences at any time via the cookie banner or in your account Settings. Disabling essential cookies may prevent the Service from functioning. We do not use cookies to sell your personal information.

7. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal data and media files — including any stored OAuth access and refresh tokens — within 30 days, except where retention is required by law or for legitimate business purposes (such as billing records).

AI generation logs and API usage logs are retained for 12 months for billing audit purposes.

8. Your Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your account and associated data
• Portability: Request an export of your data in a machine-readable format
• Objection: Object to certain processing activities
• Withdrawal of Consent: Disconnect your YouTube account or revoke AI processing at any time from your account settings. You can also revoke the Service's access via the Google security settings page.

To exercise any of these rights, contact us at hello@merlix.com. We will respond within 30 days.

If you are located in the European Economic Area, you may also lodge a complaint with your local data protection authority.

9. Children's Privacy

The Service is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If we learn that we have collected such information, we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by a notice within the Service. Your continued use of the Service after any update constitutes acceptance of the revised policy.

11. Contact Us

Merlix, LLC
500 Westover Dr #16900
Sanford, NC 27330 USA
hello@merlix.com