Privacy Notice

For the personal data of the individual users who register and sign in to Merva (“account data”), Merva is the data controller.

For the shipment documents a customer organisation uploads and the information extracted from them (“customer content”), the customer organisation is the controller and Merva acts as a processor on its behalf, under its instructions.

You can reach us about this notice or any privacy request at privacy@merva.sa.

Account data you provide: your name, your work email address, and — only if you choose to verify one — a mobile number.

If you request a trial or contact us through the form on our website: your name, work email address, company, role and approximate shipment volume, and — only if you provide them — a phone number and a note. We use these to reply to your request.

Account data we generate to secure your account: a securely hashed password (we never store your password in readable form); if you enable two-factor authentication, an encrypted authenticator secret and recovery codes; and your organisation, role and membership.

Technical data generated when you use Merva: your IP address, session records, and audit logs of key account and security actions (for example sign-in attempts and changes to two-factor authentication).

Customer content: shipment documents such as commercial invoices, packing lists, transport documents and certificates, and the structured facts extracted from them. These may contain personal data of third parties (for example the names of importers, consignees or contacts). Merva processes this only to provide the service to the customer organisation.

To create and secure your account, to authenticate you, and — where you enable it or your organisation requires it — to provide two-factor authentication.

To send you service emails about your account, your organisation's plan and your requests — for example the welcome email, trial reminders and the acknowledgement of a request. These are not marketing emails.

To deliver the shipment-operations workspace: extracting information from documents, reconciling it across documents, surfacing exceptions, and preparing downstream customs work.

To protect the service: rate limiting, abuse prevention, and audit logging.

To meet our legal and record-keeping obligations.

We process personal data on the legal bases permitted under the PDPL, including performance of the contract with your organisation, our legitimate interests in operating and securing the service, and compliance with legal obligations. Where we rely on consent — for example to verify a mobile number — you may withdraw it at any time.

Directly from you, when you register, request a trial or contact us through our website, complete your profile, or verify a mobile number.

Automatically, as technical and usage data generated while you use the service.

From your organisation, when it invites you to Merva or uploads customer content.

Processing and primary storage take place on cloud infrastructure hosted in the Kingdom of Saudi Arabia (Bluvalt).

Document extraction and reconciliation run within Merva's own systems. Your documents are not sent to any third-party artificial-intelligence service for processing.

We do not sell personal data and we do not share it for advertising.

We use a limited set of service providers: Bluvalt, for cloud hosting and document storage within the Kingdom of Saudi Arabia; Resend, to deliver Merva's service emails (for example the welcome email, trial reminders and the acknowledgement of a request) and Merva's internal notifications of new registrations and requests, including the details entered in the form — which means your name, your email address and the content of those emails are shared with Resend for that purpose; Microsoft 365, which hosts Merva's own mailboxes (for example support@merva.sa and privacy@merva.sa), so the messages you send us and our internal notifications of new registrations and requests are processed there; and Twilio, used only if you choose to verify a mobile number, to deliver the verification message by SMS — which means your mobile number is shared with Twilio for that purpose.

We may disclose personal data where we are required to do so by law, or where necessary to establish, exercise or defend legal claims and to protect the service.

Account data and customer content are stored in the Kingdom of Saudi Arabia.

The exceptions are email and optional mobile-number verification. Service emails are sent through Resend, a United States company that delivers them from the European Union (Ireland) and may keep records of them in the United States; Merva's mailboxes are hosted by Microsoft 365, which may process messages outside the Kingdom; and if you verify a number, that number is transmitted to our SMS provider (Twilio), which may process it outside the Kingdom. Service emails never contain your shipment documents. Any such transfer is carried out in accordance with the PDPL.

We keep personal data only as long as needed for the purposes above. Indicative periods are: shipment records and their linked documents — up to six years by default (a conservative record-keeping figure, configurable by your organisation within limits); account-level audit records — three years; sessions — thirty days after they expire; and security logs such as sign-in and verification attempts — ninety days.

When a retention period ends, the data is deleted, and we keep a minimal record that the deletion took place.

Subject to the PDPL, you may request access to your personal data, ask us to correct it, ask us to delete it, and object to or ask us to restrict certain processing. Where processing is based on your consent, you may withdraw that consent.

To exercise a right, contact privacy@merva.sa. If your request concerns customer content, we will refer it to the customer organisation that controls that data.

You also have the right to lodge a complaint with the competent supervisory authority in the Kingdom of Saudi Arabia.

We protect data in transit with TLS encryption; we enforce strict tenant isolation so one organisation can never access another organisation's data; we store documents in private, access-controlled storage and scan uploads for malware; we store two-factor authentication secrets encrypted at rest; and we rate-limit sign-in and verification attempts and keep audit logs of key actions.

No system can be guaranteed perfectly secure, but we work continuously to protect your data.

Merva is a business tool and is not directed to children.

We may update this notice from time to time. We will update the “last updated” date above, and for material changes we will take reasonable steps to inform you.

For any question about this notice or to exercise a right, contact us at privacy@merva.sa.