RU Pricing

Privacy Policy

Document Version: 1.0 Date: October 2026

1.1 Overview and Scope

This Privacy Policy explains how Merlin&Partners ("we", "us", "our", registered in the Republic of Kazakhstan, website: merlin-partners.com, contact: office@merlin-partners.com) collects, uses, stores, and discloses information when you use the Mercury Device Commander desktop application for macOS (collectively, the "Service" or "Mercury").

Mercury is a device automation bridge implementing the Model Context Protocol (MCP). It enables third-party AI assistants and developer tools selected by you (tested with ChatGPT and Claude; compatible with any MCP client) to interact with your local macOS operating system (including file system access, terminal command execution, screenshots, and AppleScript automation) strictly under your authorization and configuration.

1.2 Data Categories

We categorize the data processed in connection with Mercury as follows:

  1. Account and Billing Data:
    • Email address and the order or subscription details that the payment provider passes to us when you buy. Mercury has no user accounts.
    • Payment card details, billing address, and transaction identifiers are collected and processed directly by our third-party Payment Processor. Merlin&Partners does not store full credit card numbers or CVV codes on its servers.
  2. Local Operational and System Data (On-Device):
    • Local file paths, file contents, terminal commands and their output, AppleScript commands, screenshots, basic system information, and lists of connected Android and iOS devices.
    • Architecture default: All local files, terminal streams, and screen captures are generated and processed locally on your Mac and are sent only to the AI client or platform that you explicitly connect and configure. Merlin&Partners does not collect, record, or retain your local files, commands, or screenshots: the application makes no network calls to Merlin&Partners servers (no telemetry), and its local server listens only on 127.0.0.1.
    • Cloud AI clients: If you connect a cloud AI client (for example ChatGPT) through a network tunnel that you set up with a tunnel provider, the data the AI requests passes through that provider under its own terms.
  3. Local Operation Log:
    • Mercury records a local operation log on your Mac (JSON Lines) containing client identifier, tool called, allowed/denied status, duration, timestamp, and a fingerprint (hash) of the request, for your personal review. Request and result contents are not stored.
    • Client access tokens are stored locally in files readable only by your macOS user (permissions 0600).

1.3 Purposes of Processing

We process data for the following specific purposes:

  • To provide, authenticate, and maintain the functionality of the Mercury desktop application and local MCP interface on 127.0.0.1;
  • To process subscription orders, billing, and fraud prevention for the $20 USD/month subscription;
  • To enforce access control, key revocation, and security boundaries;
  • To comply with applicable accounting, tax, and legal requirements.

1.4 Legal Bases for Processing

We process personal data under the following legal bases:

  • Contract Performance (GDPR Art. 6(1)(b) / UK GDPR): Delivering the Mercury software, managing your subscription, and providing core automation services.
  • Legitimate Interests (GDPR Art. 6(1)(f) / UK GDPR): Securing the application, detecting unauthorized use, and maintaining software stability.
  • Legal Obligation (GDPR Art. 6(1)(c) / UK GDPR / Law of the Republic of Kazakhstan on Personal Data and Their Protection): Maintaining financial records and complying with mandatory law enforcement requests under applicable statutory procedures.
  • Explicit Consent (GDPR Art. 6(1)(a) / Kazakhstan personal data law): When you voluntarily grant system permissions on macOS (such as Accessibility and Screen Recording) and configure client access profiles.

1.5 Third-Party Disclosures & AI Platforms as Independent Controllers

1. User-Selected AI Platforms: Mercury functions as a client-side bridge. When you connect an external AI model or platform (e.g., Anthropic Claude, OpenAI ChatGPT, or another connected MCP client), your local data (terminal output, files, screenshots) requested by the AI is sent directly to that third party in accordance with your explicit instructions. These third-party platforms act as independent data controllers or processors under their own respective privacy policies and terms. Merlin&Partners does not control and is not responsible for how third-party AI providers process, retain, or train on your data.

2. Infrastructure and Service Providers: We engage vetted infrastructure providers for:

  • Payment processing;
  • Transactional emails and authentication.

3. Legal Requirements: We do not sell your personal data. We disclose information only where strictly required by applicable law, valid court order, or binding government subpoena.

1.6 Data Retention and Deletion

  • Order and Billing Data: Retained for the active lifecycle of your subscription plus statutory tax/accounting retention periods required by Kazakhstan law.
  • Local Application Data: Stored only on your Mac, in ~/.mercury and ~/Library/Application Support/Mercury Device Commander. Uninstalling the application does not remove these files; you can delete them yourself. Some of them are locked against accidental change by a macOS file flag, which must be removed before deletion.

1.7 International Data Transfers

Merlin&Partners operates from the Republic of Kazakhstan. Depending on your location and the location of our payment processors, your information may be transferred across international borders. Where applicable (such as under GDPR / UK GDPR), we ensure appropriate safeguards are implemented (such as Standard Contractual Clauses).

1.8 Your Privacy Rights

Depending on your jurisdiction, you have statutory rights regarding your personal information:

  • GDPR & UK GDPR (EEA & UK Users): Right of access (Art. 15), rectification (Art. 16), erasure / right to be forgotten (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21), and the right to lodge a complaint with your local Data Protection Authority.
  • CCPA / CPRA (California Users): Right to know what personal information is collected, right to delete, right to correct, and right to non-discrimination for exercising privacy rights. We do not sell or share personal information as defined under the CCPA.
  • Law of the Republic of Kazakhstan No. 94-V "On Personal Data and Their Protection": Data subjects have the right to know whether the owner or operator holds their personal data, to request that it be corrected, blocked or destroyed if it is incomplete, outdated or unlawfully obtained, and to withdraw consent to its collection and processing in the cases provided by law.
  • How to Exercise Rights: Send an email request to office@merlin-partners.com. We verify your identity before processing requests.

1.9 Children's Privacy

Mercury Device Commander is a professional developer and device automation tool. It is not directed to, marketed to, or intended for individuals under the age of 18 (or the age of majority in your jurisdiction). We do not knowingly collect personal data from minors.

1.10 Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the date at the top of this document, posting a notice on mrcury.app, or emailing customers at the address used for their purchase before the changes take effect.

1.11 Contact Information

If you have questions, privacy inquiries, or data subject requests, please contact:

  • Entity: Merlin&Partners
  • Country: Republic of Kazakhstan
  • Official Website: merlin-partners.com
  • Product Website: mrcury.app
  • Privacy & Security Email: office@merlin-partners.com