Privacy Policy

Last updated: August 27, 2026

1. Who we are

Merlyn Portal (“Merlyn Portal”, “we”, “us”, “our”) is a web application operated by Gideon Trajman, an individual, located in New York, United States. This Privacy Policy explains how we collect, use, and share information when you use merlynportal.com and the Merlyn Portal application (the “Service”).

Contact: privacy@merlynportal.com

2. Information we collect

Account information. When you create an account we collect your email address and a password, which is stored only as a secure one-way hash and never in plain text. If you sign in with Google, we receive your email address, name, and Google account identifier from Google; we never receive your Google password.

Content you add. The Service lets you create digital “job bags.” We store the information you enter or that is extracted from photos you upload, which may include customer and company names, phone numbers, email addresses, order dates, jewelry specifications and descriptions, model numbers, and free-form notes. You may also upload photographs of physical job bags and 3D model files (for example, .3dm and .stl files). You control what you put into the Service.

Automatically collected information. Our hosting and infrastructure providers automatically log technical information such as IP address, browser and device type, pages requested, and timestamps, for security, debugging, and abuse prevention.

Cookies. We use a single essential cookie to keep you signed in. We do not use advertising or third-party tracking cookies.

3. How we use information

• To provide, operate, and maintain the Service — authentication, and storing and displaying your job bags and files.
• To analyze job bag photos you upload using an automated image-recognition service, in order to pre-fill job bag details for you to review (see “Google Gemini” below).
• To secure the Service, prevent abuse, enforce our Terms, and comply with law.
• To communicate with you about the Service (for example, account confirmation, password reset, and service notices).

We do not sell your personal information. We do not use your content or files to train machine-learning models.

4. How information is shared

We share information only with service providers that help us operate the Service, and only as needed:

Google Gemini. When you use the scan feature, the photo you upload is transmitted to Google’s Gemini API for automated text and image analysis and is returned to us as structured data. Google states that data submitted through the paid Gemini API is not used to train Google’s models and is handled under the applicable Google Cloud / Gemini API terms and privacy commitments. We send only the photo you choose to scan.

We may also disclose information if required by law or legal process, to protect our rights or the safety of others, or in connection with a sale, merger, or transfer of the Service (in which case this Policy will continue to apply, or you will be notified).

5. Data retention

We keep your account and content for as long as your account is active. You can delete individual job bags and files at any time within the Service; deletion removes the associated records and stored files. If you ask us to delete your account, we will delete your content within 30 days, except where we must retain limited information to comply with law, resolve disputes, or enforce our agreements. Backups and provider logs may persist for a limited additional period before being overwritten in the ordinary course.

6. Security

We use measures including encryption in transit (HTTPS), database-level access controls that restrict each account’s data to that account, hashed passwords, and access-scoped file storage. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your own backups of anything important.

7. Your choices and rights

• Access and correction: you can view and edit your job bag data within the Service.
• Deletion: you can delete job bags and files in the Service, and request deletion of your account by email.
• Google data: you can disconnect Google Sign-In and manage Google’s sharing at myaccount.google.com/permissions.

Depending on where you live, you may have additional rights, such as to request a copy of your data or to object to certain processing. To exercise any right, email privacy@merlynportal.com. We will respond within the time required by applicable law.

We do not knowingly collect information from anyone under 18. The Service is intended for business use by adults.

8. International users

The Service is operated from the United States, and information is processed and stored in the United States. If you access the Service from outside the U.S., you consent to that transfer and processing.

9. Personal information about other people

If you enter personal information about other people (such as your customers) into the Service, you are responsible for having a lawful basis to do so and for handling that information in accordance with applicable law. With respect to that information, you are the controller and we act as your processor, processing it only to provide the Service to you.

10. Changes to this Policy

We may update this Policy from time to time. If we make material changes we will update the “Last updated” date and, where appropriate, notify you in the Service. Your continued use after an update means you accept the revised Policy.

11. Contact

Questions about this Policy or your information: privacy@merlynportal.com