This policy explains what information Merro collects, how we use and protect it, and the choices you have when you use our U.S. job-search service at trymerro.com. Merro is operated from India. Questions: privacy@trymerro.com.

Information we collect

Information you give us: your name, contact details, resume, work history, skills, job preferences, work authorization, and answers to standard application questions. Information created while we work for you: job matches, the applications your recruiter submits, tailored resumes and cover letters, and messages with our team. Basic account and usage information: sign-in records, device and browser details needed to keep your account secure, and how you use our pages.

How we use your information

We use it to match you with roles, prepare and submit applications you have authorized, tailor application materials, track the progress of your applications, support you, keep your account secure, process payments, and improve our service. Merro’s AI Recruiter Agent prepares work, and a human recruiter reviews and approves it before an application is submitted.

Signing in with Google

You can create your Merro account or sign in with “Continue with Google”. Google then shares only your name, email address and profile photo (openid, email, profile). We use them to create and identify your account and to show your name and photo in Merro. Signing in with Google gives Merro no access to your Gmail or Google Calendar — that is the separate, optional connection described below, with its own consent screen.

Google account access (Gmail and Google Calendar)

Connecting your Google account is optional. Merro works without it; connecting it lets us notice employer replies and interview invitations quickly so your recruiter can act on them. You connect through Google’s own sign-in and consent screen (OAuth 2.0). Merro never sees your Google password.

What we ask Google for

Your email address (openid, email), to link the Google account to your Merro account.
Read-only Gmail access (gmail.readonly), to find emails about your job applications. Merro cannot send, delete, label or change your emails.
Google Calendar events (calendar.events), to see interviews already on your calendar, and to add an interview to your calendar only when you click “Add to calendar” in Merro.

How Merro reads Gmail

Every 10 minutes, Merro checks for new messages in your inbox that arrived since the last check (the first time, the last 3 days). Mail in Promotions, Social and Forums, chats, and mail you sent are skipped.
An automatic filter looks at each new message’s sender, subject and opening text to decide whether it is about a job application — for example, from a hiring system, from a company you applied to, or using hiring words such as “interview” or “application”. A message that is not job-related is dropped at that point: it is not stored, not shown to anyone and not sent to any AI service.
A message that looks job-related is classified (for example: interview request, assessment, rejection, offer, application received) by an AI service — Anthropic’s Claude — so we can update your application and tell you or your recruiter what needs a reply.
For job-related messages we keep: sender name and address, subject, a short preview, the date received, the category, the company and role it refers to, a one-line summary, whether it needs a reply, and any interview time. We do not keep the full message body, and we never open or download attachments or read drafts.
To close a follow-up you already handled, Merro checks whether you replied in that conversation; it does not read your reply.

How Merro uses Google Calendar

Merro reads events from yesterday through the next 30 days and keeps each event’s title, start and end time, location and meeting link, so it can show your upcoming interviews and spot interviews with companies you applied to. This copy is replaced on every check and deleted when you disconnect.
Merro creates a calendar event only when you click “Add to calendar” for an interview, and never edits or deletes your events.

Who can see it

You, your assigned Merro recruiter and authorized Merro staff can see the stored summaries of job-related emails and interviews, only to manage your applications and support you. No one at Merro reads your non-job email, because it is never stored. We do not allow humans to read your Google data except where you have asked for it, it is needed for security purposes (such as investigating abuse), to comply with the law, or for internal operations on data that has been aggregated and anonymized.

Limited Use

Merro’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

We use Google data only to provide and improve the job-search features you see in Merro (tracking replies and interviews for your applications).
We transfer Google data to others only as needed to provide those features (our hosting, database and AI service providers, under contracts that limit their use to providing the service), to comply with the law, for security, or as part of a merger or acquisition with notice to you.
We never use Google data for advertising, never sell it, and never use it to decide credit, insurance, employment eligibility or similar matters.
We never use Google data to develop, improve or train generalized or non-personalized AI or machine-learning models. Anthropic processes messages only to classify them for us and does not use data sent through its commercial API to train its models.

Security, retention and deletion

Google access tokens are encrypted at rest with AES-256-GCM, and all data is encrypted in transit (TLS). Only Merro’s servers can use them.
You can disconnect Google at any time from the Gmail page of your Merro dashboard or from your Google Account permissions. When you disconnect in Merro, we revoke our access with Google and immediately delete your tokens and the copy of your calendar events.
Summaries of job-related emails stay in your application history after you disconnect, because they record what happened to your applications. Ask us at privacy@trymerro.com and we will delete them within 30 days; if you ask us to delete your Merro account, they are deleted with it.

Sharing and service providers

We share your profile and application materials with employers only when you have authorized us to apply on your behalf. We use trusted providers for hosting (Vercel), database and file storage (Supabase), email delivery (Resend), AI processing (Anthropic), error monitoring (Sentry) and analytics, each bound to use your information only to provide their service to Merro. Sentry receives technical reports when something on the site breaks (the error, the page and the browser or device type) so we can fix it; before a report leaves our servers or your browser we remove email addresses, phone numbers, sign-in codes, cookies and form contents, and we don’t record your screen or sessions. We do not sell personal information.

Security and retention

We use access controls, encryption in transit and at rest for sensitive data, sign-in codes for new devices, and logs of staff access to candidate data. We keep information only as long as needed for the purposes in this policy or as required by law, and delete it when you ask unless we must keep it by law.

Your 2-week search review reports, your recruiter’s call notes and the changes you agreed are kept for your membership plus 12 months, so your recruiter can compare reviews if you come back. After that the notes, agreed changes and company names are deleted and only the numbers (for example, how many applications were sent) are kept, without anything written about you.

Your choices

You can view and update your profile, disconnect Google, and ask us to access, correct, export or delete your information by emailing privacy@trymerro.com. We respond within 30 days.

Changes

If we change how we use Google data, we will update this policy and ask for your consent before using it in a new way.

Privacy policy