Privacy Policy

Merula ("we", "us") is a marketplace based in the Grand Duchy of Luxembourg. We take your privacy seriously and process personal data in accordance with Regulation (EU) 2016/679 (the "GDPR"), the Luxembourg Data Protection Act of 1 August 2018, and applicable e-Privacy rules.

1. Data controller

The data controller is Merula, based in Luxembourg. Merula operates as an unincorporated undertaking pending formal incorporation. Contact: contact@merula.lu.

2. Categories of personal data we collect

• Identity & account: first name, last name, date of birth, email, password hash, account role (job seeker, company, admin), authentication provider (email / Google).
• Job-seeker profile: CV file, profile picture, phone number (optional), languages, skills, availability, work history, self-provided descriptions.
• Company profile: company name, logo, RCSL number, VAT number, industry, size, city / country, description, verification documents.
• Marketplace activity: applications, statuses, reviews, ratings, messages exchanged with other Users, notifications, event interests, partner interactions, digital member code.
• Subscription & billing: Stripe customer ID, subscription status, plan, billing period, invoices. Card numbers and CVCs are handled directly by Stripe and are not stored on our servers.
• Technical & log data: IP address, user agent, device information, coarse location derived from IP, timestamps of key actions, error logs.
• Cookies & similar technologies: see our Cookies Policy.

3. Purposes & legal bases

• Providing the marketplace (accounts, matching, messaging, applications, reviews) — performance of a contract (Art. 6(1)(b) GDPR).
• Payments & Merula+ subscriptions — performance of a contract; Stripe as processor.
• Verification of companies — legitimate interest (Art. 6(1)(f) GDPR) in maintaining a trustworthy marketplace, and legal obligation where applicable.
• Security, fraud prevention & moderation including storage and admin review of chat history — legitimate interest in protecting Users and the Platform, and, where applicable, compliance with legal obligations.
• Transactional emails (confirmation, password reset, receipts, notifications) — contractual necessity.
• Analytics & product improvement — legitimate interest or consent, as detailed in the Cookies Policy.
• Compliance with legal obligations (accounting, tax, response to lawful requests from authorities) — legal obligation.

4. Recipients & sub-processors

We share personal data strictly on a need-to-know basis with the following categories of recipients:

• Other Users, only to the extent needed to run the marketplace (e.g. a company sees the profile and CV of a candidate who applied to its job).
• Authorised Merula administrators, for support, moderation and safety.
• Sub-processors: hosting (edge / EU-region infrastructure), Supabase (database, authentication, storage — EU region), Stripe (payments), email delivery providers, error-monitoring providers.
• Competent authorities, when required by a lawful and duly motivated request.

We do not sell your personal data. We do not use it for automated decision-making with legal effects on you.

5. International transfers

Data is primarily hosted in the European Union. Where a sub-processor is established outside the EEA (for example certain Stripe services), transfers rely on the European Commission's Standard Contractual Clauses and, where appropriate, on additional technical and organisational safeguards.

6. Storage of chats & admin review

For safety, moderation, fraud prevention, evidence and dispute resolution, all messages exchanged through the Platform are stored on our infrastructure and may be reviewed by authorised Merula administrators. By using the messaging feature, you expressly consent to this storage and access, which is limited to what is strictly necessary for the purposes above.

7. Retention

• Active accounts: for as long as the account is open.
• Deleted accounts: soft-deleted for 60 days (recoverable via support), then permanently erased or anonymised.
• Applications, reviews, messages: retained for the account lifetime plus a reasonable evidentiary period (typically up to 5 years) to defend or exercise legal claims.
• Invoices & accounting records: retained for 10 years, as required by Luxembourg law.
• Server & security logs: typically 12 months.

8. Your rights

Subject to the conditions of the GDPR you have the right to:

• access your personal data (Art. 15);
• rectify inaccurate or incomplete data (Art. 16);
• erase your data ("right to be forgotten", Art. 17);
• restrict processing (Art. 18);
• port your data to another controller (Art. 20);
• object to processing based on legitimate interest (Art. 21);
• withdraw consent at any time, without affecting the lawfulness of prior processing.

To exercise these rights, email contact@merula.lu. We may need to verify your identity. If you are unhappy with our response, you may lodge a complaint with the Luxembourg supervisory authority: Commission nationale pour la protection des données (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux — cnpd.public.lu.

9. Security

We implement appropriate technical and organisational measures, including encryption in transit (HTTPS), password hashing, role-based access control, row-level security on our database, private storage buckets with signed URLs, secret rotation and logging. No system is 100% secure — please report any suspected vulnerability to contact@merula.lu.

10. Children

Merula is not intended for children under 15. Minors between 15 and 18 must have parental authorisation and must comply with Luxembourg rules on the work of minors.

11. Changes

We may update this Privacy Policy from time to time. Material changes will be notified by email or in-app notice. Continued use of the Platform after the effective date constitutes acceptance.

© 2026 Merula · Luxembourg.