Your privacy, in plain words

Who is responsible

Merge is run from Helsinki, Finland by its founder, who is the data controller for the service. A Finnish limited company is being established; once it is registered, it will take over as controller and this page will be updated to name it. You can reach us any time at hello@m3rg3.lol.

What makes Merge different

You are interviewed by your own AI assistant, for example Claude or ChatGPT. That conversation happens inside your AI provider's product, under their terms, and it never reaches us. Our server receives only the finished profile: fixed-choice answers, your weekly availability, and four texts in your own words, three short ones of at most 500 characters each and one longer self-portrait of at most 3,000 characters. There is no feed, no swiping, and no in-app chat, so there is far less data to collect in the first place.

Why we use your data, and on what legal ground

Every use has a purpose and a legal basis under the GDPR:

• Matching and date scheduling: your explicit consent, Articles 9(2)(a) and 6(1)(a).
• Checking your photo: your consent, given on its own line on the consent page, Article 6(1)(a). The check confirms a clear, natural photo of one adult. It is not a face match, and it cannot tell that the person in it is you. The same line covers the attractiveness estimate made from an approved photo, described under how matching decides.
• Your account and sign in: the contract between us, Article 6(1)(b).
• The reliability rating: also the contract. Showing up is the heart of the service, and you are always warned before anything counts against you.
• Safety and abuse prevention: our legitimate interest in keeping members safe, Article 6(1)(f).
• Technical logs and security: the same legitimate interest, Article 6(1)(f).

The most personal details

A dating profile inherently reveals sexual orientation: your gender and who you hope to meet. Ours can also include how often you practice a religion and, optionally, a broad political stance, with prefer not to say always available. The law calls these special categories of data, and we treat them that way: they are processed only with your explicit consent, given on its own page before anything is stored, and you can take that consent back at any time. Without it Merge simply cannot match you, and we say so plainly instead of burying it.

How matching decides

Matching is fully automated: no person at Merge reads through profiles and plays judge. Your answers decide who you can be matched with. On top of that we keep a reliability rating, and today exactly one thing changes it: backing out of a confirmed date lowers it, always after a clear warning you have to confirm. Nothing else moves it, in either direction. The rating is used only to separate two people the matching already rates equally, and it fades back over the following months. There is no appeal process today, and no automated decision can close your account on its own.

Your verified photo is also looked at once by xAI (model grok-4.6, United States, no training use, store off) to estimate roughly how attractive it reads, and Merge prefers introducing people whose estimates are close; the number is never shown in matching, never affects the reliability rating, and you can see your own on the photo page.

What your match sees

Never your whole profile. First a few facts written by our server, then your own-words answers on the match page, and last your photo and the first name you chose, from 15 minutes before the date until three hours after it starts, after which that page closes and Merge stops serving the photo. Someone who can see a photo can still save it or take a screenshot while it is visible; closing the page cannot erase a copy they already made. The name on your Google account, your email address, and other contact details are never shared with a match, and your data is never sold or shared with advertisers.

Who helps us run Merge

Six companies are involved. Five process data on our behalf under data processing terms. The sixth is Google, which is not our subcontractor but the account you sign in with, so it necessarily learns that you use Merge:

When data leaves the EU

Your database and the site itself stay in Frankfurt. Four things leave. Two of them are OpenAI, which currently serves our requests from the United States while our application for their EU data residency is pending: scoring, where the requests omit structured account identity and contact fields but carry all four own-words texts verbatim, including any identifier you typed there, and the photo check, which carries your photo itself and so does identify you. Both run under a signed data processing agreement and the EU standard contractual clauses, and nothing sent is used to train models. Once the EU residency application is approved, both move inside the EU. The third is xAI, also in the United States, which sees your approved photo once for the attractiveness estimate: the request is sent with storage switched off, nothing it sees is used to train its models, and it learns nothing else about you. The fourth is signing in, which happens at Google in the United States, and that one is inherent in using a Google account rather than something we could move.

How long we keep things

• Your profile and availability: for as long as your account exists.
• Your photo: one at a time. A photo that does not pass the check is deleted straight away, and when a new photo is approved the previous one is deleted with it.
• Your sign-in records, with their IP addresses and device descriptions: until you withdraw. We do not currently delete them on a timer, and we would rather tell you that than imply a limit we do not enforce.
• If you withdraw: matching stops immediately, and seven days later everything that identifies you is destroyed. That means your profile and the words you wrote in it, your photo and the image file itself and the attractiveness estimate stored with it, your availability, the emails we sent you, your sign-in account with its name, email address and picture, every sign-in record with its IP address, your phone number if we ever held one, and the internal notes our scoring model wrote about how you might fit someone. The job that does it runs once a day, so allow up to a day beyond the seven.
• There is no cancel. Those seven days are a margin so that a misfiring AI cannot destroy your account the instant it is asked to. They are not an undo button, and we would rather say that plainly than let you count on a rescue that does not exist.
• What survives, deliberately: one row with your name, email, phone and picture stripped out of it, and your consent record. We keep them together because deleting that row would delete the consent record with it, and that record is the evidence that you agreed in the first place. The law lets us keep exactly that much, for exactly that reason, and we keep nothing else.
• Your match and rating history: kept, attached to that stripped row. It has to survive so the people you matched with keep their own records whole, and there is nothing in it that names you.
• Consent records: kept afterwards as proof that your consent existed, which the law expects of us. The exact period will be fixed when our legal review completes, and it will never exceed five years after withdrawal.
• Technical logs: they never contain content.
• Backups: encrypted and stored in the EU.

Your rights

The GDPR gives you all of these, and we honor every one:

• See the data we hold about you (Article 15).
• Correct any answer, or redo any part of the interview (Article 16).
• Have your data erased (Article 17). Telling your AI to withdraw you from Merge starts exactly this, and the section above sets out precisely what is destroyed and the one record we keep.
• Restrict or object to how we use your data (Articles 18 and 21).
• Take your profile with you as a file (Article 20). It is stored as structured data, so it is easy for us to assemble, but there is no button for it yet: ask us and a person will put it together for you.
• Withdraw your consent at any time, as easily as you gave it (Article 7(3)).

Two of these you can do straight from your AI: correcting your answers, and withdrawing. For the rest, email hello@m3rg3.lol and we will do it by hand. We answer within 30 days, usually much faster.

If you feel we handled something badly, you can complain to the Finnish Data Protection Ombudsman (tietosuojavaltuutettu), Lintulahdenkuja 4, 00530 Helsinki, tietosuoja.fi. We would rather you tell us too, so we can fix it.

How we protect it

Encrypted connections everywhere, strict access rules on every database table, servers pinned to the EU, tightly limited service keys, and logs that never contain what anyone wrote. Backups are encrypted. And the biggest protection of all stays architectural: your interview never reaches our servers in the first place.

If this policy changes

Small clarifications are simply published here with a new date. Material changes are different: we will ask for your consent again before they apply to you. Your consent is always recorded against the exact version you saw. This is policy version 2026-09-03.