Back to Legal

Privacy Policy

Last updated: July 20, 2026

This policy describes the personal data MerginIT processes on merginit.com and when delivering, licensing, and supporting its products. Product-specific notices may add details for a particular app or service.

1. Controller

MerginIT e.U., owner Jonas Fröller, Nußböckstraße 92, 4060 Leonding, Austria, is the controller for the processing described here. Contact jonas@merginit.com or use the data-request page. Company details are in the imprint.

2. Website delivery and security

When you visit merginit.com, the hosting, content-delivery, and security systems process technical request data such as IP address, date and time, requested URL, referrer, response status, browser or device information, and security signals. This is required to deliver the website, prevent abuse, investigate errors, and maintain security. This site is deployed using Cloudflare infrastructure. The legal basis is performance of the requested website service and MerginIT's legitimate interest in reliable and secure operation.

3. Consent preferences and analytics

The site stores a necessary first-party consent preference so it can remember whether you accepted analytics. Microsoft Clarity is loaded only after analytics consent. Clarity may then process pseudonymous identifiers, page URLs, clicks, scrolls, pointer movements, session recordings, approximate location derived from IP address, and browser and device information. MerginIT uses this to understand usability and improve the site. Sensitive form fields are not intentionally captured and should not be entered into public website fields unless needed.

The legal basis for Clarity is consent. You can change or withdraw that consent as described in the Cookie Policy. Microsoft processes Clarity data under its own privacy terms and may process it outside the EEA using its applicable transfer safeguards.

4. Contact and support

When you contact MerginIT, it processes the contact details, message, product, order references, technical details, and attachments you provide. The purposes are to answer the request, deliver support, verify an entitlement where needed, and keep an appropriate support history. Do not send passwords, full payment-card details, licence keys, or personal files unless support specifically requests a limited item through an appropriate channel.

5. Purchases through checkout providers

MerginIT uses Lemon Squeezy for direct Dupe Zappa purchases, Polar for Brand Peel and Markdownblog, and Paddle for OCRMD. Dupe Zappa may also be purchased through Microsoft Store. The provider shown before payment is an independent controller for its checkout, payment, fraud prevention, tax, invoicing, refund, and dispute services.

The provider normally sends MerginIT the customer name and email, billing country, product and variant, order and customer identifiers, amount, currency, tax status, licence or subscription status, purchase time, and refund or dispute status. MerginIT uses this information to deliver the product, create or validate entitlements, provide support, reconcile orders, prevent abuse, and meet legal duties. MerginIT does not receive or store full payment-card details.

6. Product delivery, accounts, and licensing

Depending on the product, MerginIT may process an account or customer identifier, email address, licence or entitlement reference, plan or product variant, activation status, device or installation identifier, app version, validation timestamps, and limited security log data such as IP address. The product-specific privacy notice describes the exact data used. The purposes are delivery, authentication, entitlement validation, legitimate device moves, updates, security, abuse prevention, and support.

7. Legal bases

  • Contract and pre-contract steps: orders, delivery, licensing, accounts, and support.
  • Consent: Microsoft Clarity and any optional processing clearly presented as consent-based.
  • Legal obligations: accounting, tax, consumer, and regulatory duties.
  • Legitimate interests: site and product security, fraud prevention, diagnostics, legal claims, and service improvement where those interests are not overridden by your rights.

8. Recipients and international transfers

Data is shared only as needed with hosting, content-delivery, security, email, analytics, checkout, accounting, professional-adviser, and product infrastructure providers, as well as public authorities where legally required. Some providers are outside the EEA. Where the GDPR requires it, transfers rely on an adequacy decision, the EU Standard Contractual Clauses, or another lawful safeguard. Checkout providers also disclose their own transfer arrangements in the notices linked above.

9. Retention

  • Consent preferences are normally retained for up to 365 days.
  • Operational and security logs are retained only as long as reasonably needed for reliability, security, and incident investigation.
  • Support communications are retained while the request is active and afterward as reasonably needed for support history and legal claims.
  • Order, invoice, tax, and accounting records are generally retained for seven years where Austrian law requires it.
  • Account and licence data is retained for the contract and entitlement period, then limited or deleted subject to legal obligations and claims.

10. Your rights

Depending on the applicable law, you may request access, correction, deletion, restriction, objection, or portability and may withdraw consent for future processing. Legal retention and other statutory exceptions can limit these rights. Use the data-request page or email jonas@merginit.com. MerginIT may need information to verify your identity before disclosing or changing personal data.

You may lodge a complaint with the Austrian Data Protection Authority at dsb.gv.at or with the competent authority in your EEA country.

11. Children and policy changes

MerginIT's company website and general software products are not directed to children. This policy may be updated when products, providers, or legal requirements change. The current version and its update date remain available on this page.