Privacy Policy

1. Who controls your information

When a MergeCast customer uploads their contacts and sends messages, that customer is the controller of the personal information involved, and MergeCast acts as their service provider/processor. For the MergeCast marketing site and our own account records, MergeCast is the controller. If you received a message or video link from a business using MergeCast and want your information changed or removed, please contact that business; you may also contact us at privacy@merge-cast.com.

2. Information we collect

• Account and contact details — names, business email addresses, and phone numbers that our customers or their team members provide to create accounts and send messages.
• Message and video content — the video clips our customers record and the recipient details they send them to.
• Consent records — where a recipient opts in to text messages, we record the opt-in timestamp, method, source, and IP address to document consent.
• Engagement data — when a branded video link is opened, watched, or a call-to-action is clicked, we record that event (and a first-touch attribution tag) so the sending business can see engagement.
• Waitlist information — if you request early access on our marketing site, we collect the email address you submit.
• Web push subscription data — if a MergeCast user (a customer's team member) enables browser push notifications, we collect the push subscription endpoint issued by their browser's push service and use it to deliver notifications.
• Technical data — standard device, browser, and usage information generated when you interact with our sites and links.

3. How we use information

We use information to provide and operate the service — delivering video messages, recording consent, honoring opt-outs, showing engagement to the sending business, securing our systems, and communicating with customers about their accounts. We do not use recipient contact information for our own marketing.

4. Text messaging (SMS)

SMS is consent-gated: a recipient gives express opt-in consent to the sending business. Your opt-in is confirmed by replying YES to a single confirmation text, and no other message is sent until you do. Replying STOP opts them out, and replying HELP returns help information. Message frequency varies and message and data rates may apply. See our SMS & TCPA disclosure for the full messaging terms.

5. How we share information — and what we never do

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share information only with the service providers that make MergeCast work:

• Amazon Web Services (AWS) — cloud hosting, storage, and video processing.
• Twilio — delivery of SMS/text messages and related carrier compliance (10DLC registration).
• Browser/OS push notification services (e.g., Apple, Google, Mozilla) — if a user enables web push, we share the push subscription endpoint with that browser's push service so it can deliver the notification.

We may also disclose information where required by law or to protect our rights and the safety of others.

6. Mobile information and messaging consent

We do not share, sell, or provide your mobile phone number or messaging consent data to third parties or affiliates for marketing or promotional purposes. Text-messaging originator opt-in data and consent are never sold or rented, and are never shared with third parties or affiliates for marketing or promotional purposes.

We use mobile information only to deliver the messages you consented to receive, to honor STOP and HELP requests, and to keep the consent and opt-out records the law requires.

7. Data isolation and security

Every customer’s data is tenant-isolated — records are scoped per tenant so one customer cannot access another’s data — and is protected with industry-standard safeguards on our AWS-native infrastructure. No method of transmission or storage is perfectly secure, but we work to protect information in transit and at rest.

8. Data retention

We retain information for as long as needed to provide the service and to meet legal, accounting, and compliance obligations (including consent and opt-out records). Specifically: we keep account and message data for as long as your account is active and as needed to provide the service; we keep SMS consent records (the opt-in timestamp, method, source, and IP address) and opt-out records for at least four years after the last message sent to that number, to document compliance; and we keep engagement data for the life of the account plus a reasonable wind-down period. After that, information is deleted or anonymized unless the law requires us to keep it longer.

9. Your rights

Depending on where you live, you may have rights to access, correct, delete, or restrict the use of your personal information, and to opt out of certain processing. To exercise a right, contact us at privacy@merge-cast.com. The specific rights available to you are governed by applicable U.S. federal and state privacy laws, including the TCPA and, where applicable, state consumer-privacy statutes.

10. Children

MergeCast is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, provide additional notice.

12. Contact us

Questions about this policy or your information? Contact CHARLOTTE X CUSTOM SOFTWARE SOLUTIONS LLC at privacy@merge-cast.com.