Privacy Policy

This Privacy Policy explains how Disrupt Digital Pty Ltd ("Disrupt Digital", "we", "us") collects, uses, stores and discloses personal information in connection with Merlin, our client platform for CRM, lead capture, marketing reporting, review management and related services (the "Platform").

Merlin is offered by Disrupt Digital directly and under our trading brands (for example, brand-specific portals operating on their own domains). This single policy applies to the Platform however you access it, regardless of which of our brands provides your services. It should be read together with the Merlin Terms of Service and any services agreement you have with us or one of our brands.

We handle personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and — for our New Zealand customers — the New Zealand Privacy Act 2020.

Information we collect

Information you provide

• Account details — name, business email address, phone number, role, and the business you represent, collected when an account or team login is created for you.
• Business records you add to the Platform — contacts, companies, leads, tasks, notes, bookings and custom fields your business chooses to store in Merlin.
• Communications — support requests and correspondence with us.

Information collected through your integrations

• Lead and form submissions — details submitted by your customers through lead-capture connectors you enable (for example website forms, Wix, Squarespace or WordPress integrations), typically names, contact details and enquiry content.
• Connected-platform data — when you connect third-party accounts (see section 3), data those platforms return to us, such as advertising and analytics reporting metrics, business profile details, customer reviews and, if you connect a Google Calendar, the times you are busy.
• Connection credentials — OAuth tokens and account identifiers required to maintain the connections you authorise. Tokens are encrypted at rest (see section 7).

Information collected automatically

• Usage and device data — log data, IP address, browser type, pages viewed and actions taken, collected via cookies and our product analytics tooling to secure and improve the Platform.
• Billing records — subscription and invoice data processed by our billing provider. We do not store full payment card numbers on the Platform.

How we use information

• To provide, operate and support the Platform and the services you have subscribed to;
• To display reporting and dashboards for your connected marketing platforms;
• To set up and maintain the account connections and access grants you initiate;
• To capture, route and manage leads and customer records on your behalf;
• To monitor and respond to reviews of your business where you enable review management;
• To keep your bookings and a Google Calendar you connect in step, where you turn on calendar sync;
• To administer billing, detect and prevent misuse, meet legal obligations, and improve the Platform;
• To communicate service, security and account notices to you.

We do not sell personal information, and we do not use the content of your business records or connected-platform data for advertising.

Data from connected platforms

Merlin lets authorised users connect third-party accounts — including Google services (Google Ads, Google Analytics, Google Business Profile, Google Search Console and Google Calendar), Meta platforms, and website/CRM platforms such as Wix and Squarespace — so that we can provide reporting, account linking, review management and booking calendar sync. We only access these platforms with your explicit authorisation, request the minimum scopes needed for the features you use, and access only the accounts and assets you select.

Specifically, for data obtained via Google APIs, we:

• use it only to provide and improve the user-facing features you have requested (reporting dashboards, account linking you initiate, review monitoring/response, booking calendar sync, and AI answers you ask for — see section 5), and for no other purpose;
• do not transfer it to third parties except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with prior notice to you;
• do not use it for advertising purposes, and do not sell it;
• do not allow humans to read it except with your explicit consent, where necessary for security or abuse investigation, to comply with applicable law, or where it has been aggregated and anonymised;
• do not use any Google user data to develop, improve or train generalised artificial-intelligence or machine-learning models.

Google user data we access, and why

Each Google connection asks only for the permissions (scopes) its feature needs. Each scope is named below by its technical identifier, without Google's https://www.googleapis.com/auth/ prefix. Google's consent screen describes the same permissions in plain words when you connect, and our connections page explains what we use each one for.

• Your Google account (openid, email) — every Google connection receives the email address and account ID of the Google account you sign in with. We store them with the connection so you can see which account is connected and so we use the right credential.
• Google Ads (adwords) — we list the Ads accounts your Google login can reach so you can choose one, then create the link you ask for between that account and our manager account, accepting it for you where your login allows. We keep the account ID you chose and the state of the link. Campaign performance for your dashboards is then read through that manager link.
• Google Analytics (analytics.readonly, analytics.manage.users) — we list your Analytics accounts and properties (their names and IDs) so you can choose one, give our reporting account viewer access to that property, and later check that the access is still in place. We keep the property ID and the state of the grant. Reporting then reads through that access.
• Google Search Console (webmasters.readonly, siteverification) — we list the Search Console properties you can reach and your permission level on each so you can choose one and, where you are a verified owner, add our reporting email as a delegated owner of that property. This only ever adds an owner; it never removes one. We keep the property address and the state of the grant.
• Google Business Profile (business.manage) — we list the Business Profile accounts and locations you manage (name, address, Place ID and verification status); bring in the reviews of the locations you choose to sync, including the reviewer's name and photo as Google displays them, the rating, the review text, dates and any reply; and post or remove the replies that you or the team you authorise write in Merlin. We keep your location choices and the reviews and replies of synced locations, refreshed from Google on a schedule.
• Google Calendar (calendar.freebusy, calendar.calendarlist.readonly, calendar.events) — connected by an individual team member for their own calendar. We list your calendars (names and IDs) so you can choose one; read only the times you are busy — never the titles, attendees or contents of your events — so those times are not offered for booking; and, if you turn it on, add each booking to the chosen calendar as an event with the service, time, and the customer's name, email, phone and booking notes, updating it when the booking changes and removing it when the booking is cancelled. We only change events Merlin created. We keep the chosen calendar's ID and the IDs of the events we created.

How we store and share Google user data

• Storage. Connection records — tokens, the accounts, properties, locations and calendar you chose, reviews and replies, and the IDs of calendar events we created — are stored in our application database. The advertising, analytics and search performance metrics that reporting shows are stored in a dedicated analytics database. Both are hosted by the providers listed in section 6. OAuth tokens are encrypted at rest with AES-256-GCM, each customer's data is separated from every other customer's, and staff access is logged (section 7).
• Who can see it. The people your business has given access to its Merlin account and, where you have engaged us to manage that account for you, our team.
• Sharing. We share Google user data only with the service providers in section 6 that host and process it on our behalf, with our AI provider when you use an AI feature that needs it (section 5), or where the law requires it. We never sell it or pass it to advertising platforms, data brokers or other information resellers.
• Retention. Tokens are kept until you disconnect, when we revoke them at Google and delete our copy. Identifiers, reviews and calendar records are kept while the connection and your services are active, and are deleted as section 8 describes. A grant you asked us to make on Google's side — a Google Ads manager link, Google Analytics access or a Search Console owner — stays on that platform until it is removed there or through our off-boarding process.

Meta platform data

Where you authorise a Meta connection, the data we receive is advertising performance information for the ad accounts you select — for example spend, impressions, reach, clicks, conversions and campaign-level breakdowns — together with the account and campaign identifiers needed to attribute those metrics correctly. We use it only to populate your reporting dashboards alongside your other connected platforms. We do not use Meta data for advertising, do not sell it, and do not use it to train generalised AI or machine-learning models. You can review and remove Merlin's access in your Meta Business settings at any time.

You can revoke Merlin's access to your Google account at any time at myaccount.google.com/permissions, and to your Meta assets via your Meta Business settings. You can also disconnect any connection from the Platform's Connections page; on disconnection we make reasonable efforts to revoke tokens at the provider and delete our stored copies.

Note that where you have asked us to establish a durable access grant on a platform (for example linking your Google Ads account to our manager account, or granting our reporting email access to your Google Analytics property), that grant lives on the platform itself and remains until removed there or through our off-boarding process.

Step-by-step instructions for disconnecting a platform, revoking access at the provider and deleting your data are on our data deletion page.

Information we process on behalf of our customers

Records that your business stores in or captures through Merlin — for example your customers' contact details and enquiries — are processed by us on your behalf and on your instructions as a service provider. Your business is responsible for ensuring it has the right to collect that information and for responding to privacy requests from its own customers; we will assist with access, correction and deletion of such records on your instruction. If you believe an organisation using Merlin holds your personal information, we recommend contacting that organisation directly; you may also contact us and we will refer your request appropriately.

AI features

Some Platform features use large-language-model providers to generate summaries, suggestions or assistant responses. Content processed for these features is submitted to our AI provider via business API channels that are not used by the provider to train their generalised models.

When you use an AI feature on data that came from Google — for example, asking Merlin AI about your Google Analytics or Google Ads results — the data needed for that request is sent to our AI provider so it can produce the response you asked for, and is used for nothing else. Google user data is never used to develop, improve or train generalised AI or machine-learning models (see section 3). We do not currently send Google Business Profile reviews or Google Calendar data to AI features; we will update this policy, and tell you, before that changes.

Disclosure of information

We disclose personal information only as needed to operate the Platform:

We may also disclose information where required by law, to our professional advisers under confidentiality, or as part of a corporate transaction with prior notice. We may update this list of providers from time to time; material changes will be reflected in this policy.

Security

• All traffic to the Platform is encrypted in transit (TLS).
• OAuth tokens and connection credentials are encrypted at rest using AES-256-GCM with server-held keys.
• Data access is segregated per customer account with row-level security and role-based access levels.
• Administrative access is limited, logged and audited; staff access to customer accounts is recorded.

No system is perfectly secure; we will notify affected customers and the relevant regulator of any eligible data breach in accordance with the Notifiable Data Breaches scheme (AU) and the NZ Privacy Act.

Data retention and deletion

• We retain information while your account or your business's services remain active, and afterwards only as required for legal, accounting or dispute-resolution purposes.
• On termination of services, business data is available for export for 30 days and then scheduled for deletion.
• Disconnecting a platform connection revokes and deletes our stored tokens for it (section 3).
• You may request deletion of personal information at any time using the contact details below; we process deletion requests manually and will action them within 30 days unless we are legally required to retain specific records (in which case we will tell you).

Our data deletion page sets out exactly how to disconnect a platform, revoke access at Google or Meta, and request deletion of an account and its data, along with what happens after you ask.

Access, correction and complaints

You may request access to, or correction of, personal information we hold about you by contacting privacy@disruptdigital.com.au. We will respond within a reasonable period (usually 30 days). If you have a privacy complaint, contact us first and we will investigate and respond. If you are not satisfied, you may complain to the Office of the Australian Information Commissioner (oaic.gov.au) or, in New Zealand, the Office of the Privacy Commissioner (privacy.org.nz).

Cookies

The Platform uses strictly-necessary cookies for authentication and session management, and product analytics cookies to understand feature usage. We do not use third-party advertising cookies on the Platform. You can control cookies through your browser, though disabling essential cookies will prevent sign-in.

Overseas disclosure and international users

Some of the service providers listed in section 6 store or process data outside Australia and New Zealand (including in the United States). We take reasonable steps, including contractual measures, to ensure overseas recipients handle personal information consistently with the APPs. Merlin is operated from Australia; if you access it from elsewhere, you consent to your information being processed in Australia and by the providers described above. As we expand into other regions we will adopt any additional region-specific terms required.

Children

Merlin is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 16 except incidentally as part of records our customers store.

Changes to this policy

We may update this policy from time to time. Material changes will be notified through the Platform or by email. The "Last updated" date above reflects the current version.

Contact