Version of 30.10.2026 · Kyiv
This is an English translation for information. The Ukrainian text at https://merit.legal/mcp/privacy is the binding text. If the two texts differ, the Ukrainian text applies.
1. Who processes the data
1.1. The controller of the personal data is Serhii Ihorovych Kushniruk, individual entrepreneur (FOP) (ФОП Кушнірук Сергій Ігорович), record in the Unified State Register (ЄДР) No. 2011600000000151425 of 29.10.2026, email: support@merit.legal (the Provider, "we").
1.2. This policy explains how we process personal data when you visit the website https://merit.legal (the Site), including the pages at https://merit.legal/mcp, sign in to the Account Area, connect an MCP client, pay for the services, invite colleagues to the team, leave a demo request, and send requests to the Merit MCP service (the Service). The terms "Key", "Call", "Customer", "Account Area", "Member" and "Auto-renewal" have the same meaning as in the Public Offer Agreement at https://merit.legal/mcp/offer.
1.3. We process data in accordance with the Law of Ukraine "On Personal Data Protection". This policy is the notice of data processing in the meaning of Article 12 of that Law.
1.4. The Service only returns data from open state registers and databases. This data can contain personal data of third persons (company directors, advocates, notaries, debtors). Clause 2.4 describes how we process it.
2. What data we process
2.1. Data that you give us yourself when you sign in to the Account Area, pay for the services, leave a demo request or write to us:
- surname, first name and patronymic, or the name of the organization;
- email address (you sign in to the Account Area with it) and, if you gave it, phone number;
- details for invoices and acts of services rendered: EDRPOU code or individual taxpayer registration number (РНОКПП), address, IBAN;
- the content of your letters to technical support and of your claims;
- data of a demo request: name, email address, name of the organization, message, and the IP address from which the request was sent;
- email addresses of colleagues whom you invite to the team. When you invite a colleague, you confirm that you may give us the colleague's address. We send to it only the invitation and letters about membership in the team.
2.2. Payment data. When you pay by invoice, we receive a bank statement from the bank with the name of the payer, the account, the amount and the payment reference. When you pay by card through plata by mono, you enter the card data on the page of the bank. We do not receive or store the card number, its expiry date or the CVV. The bank sends us the payment status and the amount, the masked card number and the payment system. If you agreed to Auto-renewal, the bank also sends us the card token. With the token, we can debit a fee only through the bank. We store the token in encrypted form, and only while the card is active in the Account Area. When you delete the card, we ask the bank to delete the token, and we delete it on our side. We keep the masked number and the payment system so that the trial "Start" (Старт) plan is used only once per card.
2.3. Data on the use of the Service. For each Call, we record in a log the Key, the time of the Call, the name of the tool and the IP address. The log does not store the content of the requests (search words, case numbers, EDRPOU codes) or the answers of the Service. The Service keeps no sessions: it processes each request separately. For each connection of an MCP client, we keep the name of the client (for example, Claude or ChatGPT), the address at which the client receives the sign-in response, the time of connection and of revocation, and the hash of the Key. We do not store the Key itself. If you are a Member of a team, the owner of the account sees your email address, your name and the number of your Calls. We do not see your conversations with the AI assistant: the provider of the MCP client that you chose processes them.
2.4. Data of third persons in the answers of the Service. The Service returns information from open sources that the law makes public (the Unified State Register (ЄДР), the Unified Register of Advocates of Ukraine, the Unified State Register of Court Decisions, the register of debtors and others). We show this information to the extent that the holder of the source published it, and we do not add other data to it. If you think that information about you in the Service is inaccurate or out of date, write to us (section 8). We will check it against the source. We will update or hide the record if the source has already changed or deleted it.
2.5. We do not collect special categories of personal data (Article 7 of the Law), and we make no automated decisions about you. The Service is intended for adults.
2.6. Data on visits to the Site. The counters counter.dev and Google Analytics receive data on visits to the pages of the Site (clause 6.2). We see only aggregate visit statistics. We do not link them to your Key, email address or payments.
2.7. Sign-in and consent data. The sign-in code and the sign-in link are valid for 15 minutes. We store them only as a hash, and we delete them after use or no later than 5 minutes after they expire. We record the version of the Agreement and of this Policy that you accepted, the time of the consent, the time of the last sign-in, and, if you agreed to Auto-renewal, the time of that consent.
3. Purpose and grounds of processing
3.1. We process data only for these purposes and on these grounds (Article 11 of the Law):
- to conclude and perform the Agreement: open the Account Area, connect an MCP client, provide the services, keep records of Calls, debit fees under Auto-renewal, send invitations to the team, issue invoices and acts of services rendered, answer letters. Ground: conclusion and performance of a transaction (item 3 of part one of Article 11);
- to keep tax records, store primary documents and issue settlement documents (receipts). Ground: an obligation that the law puts on us (item 5 of part one of Article 11);
- to protect the Service from abuse, overload and unauthorized access, to examine claims, to answer demo requests, to measure visits to the Site (clause 2.6), and to improve the Service on the basis of anonymized statistics. Ground: our legitimate interest (item 6 of part one of Article 11).
3.2. We do not send advertising mailings, and we do not use data for profiling. The letters that we send concern only sign-in, connections, payment, Auto-renewal, the team and changes to the Agreement.
3.3. We do not sell personal data, and we do not give it for the training of artificial intelligence models.
4. Retention periods
4.1. We keep data no longer than the purpose of processing needs or the law requires:
| Log of Calls | 12 months from the day of the Call |
|---|---|
| Data of the account, consents, connections and team | the term of the Agreement and 3 years after it ends |
| Sign-in code and sign-in link | until use, but no longer than 20 minutes |
| Card token | while the card is active in the Account Area |
| Masked card number and payment system | the term of the Agreement and 3 years after it ends |
| Demo requests | 12 months from the day of the request |
| Web server logs of the Site | 30 days |
| Data for invoices and acts of services rendered, bank statements, settlement documents | at least 1095 days from the day of filing the tax reports for the relevant period (clause 44.3 of Article 44 of the Tax Code of Ukraine) |
| Correspondence, claims, contact data of the Customer | the term of the Agreement and 3 years after it ends (general limitation period, Article 257 of the Civil Code of Ukraine) |
| Letters of persons who did not become Customers | 12 months from the day of the last letter |
Technical cookie __Host-sid | 30 days in your browser |
Google Analytics analytics cookies _ga and _ga_EVQZ0EE3R2 | up to 2 years in your browser |
| Visit data in Google Analytics | 14 months (data retention setting of Google Analytics) |
Marker _swa of the counter.dev counter | until you close the browser tab |
4.2. When the period ends, we delete the data or anonymize it so that it no longer identifies a person. Backup copies are overwritten in rotation, so deleted data disappears from them no later than 30 days later.
5. Who we give data to
5.1. We give data only to these recipients, and only to the extent that their work needs:
- JSC "Universal Bank" (АТ «Універсал Банк», monobank, plata by mono): to credit payments and to accept card payments;
- the hosting, email and messaging providers on whose equipment the Service, the mail of the domain merit.legal and the delivery of demo requests to our team run. They act as processors on our instructions and do not use the data for their own purposes;
- the electronic document exchange service, if the Customer signs acts of services rendered through it;
- Google LLC (Google Analytics) and the counter.dev service: to count visits to the Site, to the extent of clause 2.6;
- state authorities and courts: only on a request that comes in the procedure set by law, and only to the extent of that request.
5.2. Data can be stored on servers outside Ukraine. In that case, we choose providers in member states of the European Economic Area or in states that signed the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, that is, states that give adequate protection of data (Article 29 of the Law). This rule does not apply to fonts and visit counters (clause 6.2) or to the messaging service through which our team receives demo requests: they can process data in other states, including the USA.
5.3. The provider of your MCP client and AI model is not our recipient. It receives the answers of the Service because you yourself connected the Service to it, and it processes them under its own policy.
6. Cookies and third-party requests
6.1. The Site sets the technical cookie __Host-sid. It contains a random session identifier that the Site needs to work and to stay secure, and it is valid for 30 days. On the pages of the Site, except the Customer's Account Area and the sign-in pages, Google Analytics sets the analytics cookies _ga and _ga_EVQZ0EE3R2, which are valid for up to 2 years. The counter.dev counter sets no cookies: it keeps the marker _swa in the memory of the browser tab until you close the tab. The Site uses no advertising cookies. The Service for MCP clients uses no cookies: it identifies a request only by the Key.
6.2. The pages of the Site send requests to these third-party services:
- Google Fonts (fonts.googleapis.com, fonts.gstatic.com): fonts;
- counter.dev (cdn.counter.dev, t.counter.dev): visit counting: the page address without query parameters, the page that you came from, the screen size;
- Google Analytics (www.googletagmanager.com, google-analytics.com): visit counting: the full page address together with the words that you typed into the search of the Site, the page that you came from, browser and device data.
Each of these services receives the IP address and browser data and processes them under its own policy. In Google Analytics, we turned off Google signals and ad personalization. The counters do not run on the pages of the Customer's Account Area and on the sign-in pages. The pages make no other requests to third-party services.
6.3. You can block cookies in the settings of your browser, and block Google Analytics data collection with the Google Analytics Opt-out add-on (https://tools.google.com/dlpage/gaoptout). The text of the pages and the offer agreement stay available when you do this.
7. Data protection
7.1. The Site and the Service work only over a secure HTTPS connection. Only the Provider and, within the scope of their work, the recipients in section 5 have access to the data.
7.2. Each connection has its own Key and is revoked separately. In the Account Area, on the "Connections" (Підключення) page, you can revoke a Key yourself, and it stops working immediately. If another person has learned your Key, revoke it or write to support@merit.legal, and we will revoke it no later than 1 business day later.
7.3. If a security breach affects your data, we will tell you by email without undue delay. In the notice, we will say which data the breach affects and what you can do.
8. Your rights
8.1. Under Article 8 of the Law, you have the right:
- to know which of your data we process, for what purpose, where it is stored and to whom it is given;
- to get access to your data;
- to require us to correct inaccurate or out-of-date data;
- to require us to delete data if we process it unlawfully or if we no longer need to keep it;
- to object to processing on the ground of legitimate interest (item 3 of clause 3.1);
- to file a complaint with the Ukrainian Parliament Commissioner for Human Rights or with a court.
8.2. In the Account Area, you can yourself change your name and details, revoke connections, turn off Auto-renewal, delete the card and leave the team. To use another right, in particular to delete the account, write to support@merit.legal from the address with which you sign in to the Account Area. If the letter comes from another address, we can ask you to confirm that the data is yours. We answer within 30 calendar days.
8.3. Data that the law obliges us to keep (primary documents, section 4) we will delete only when the retention period ends.
8.4. We cannot change data of state registers (clause 2.4) in the register itself. To correct a record at the source, contact the holder of the source. After that, the Service updates the record at the next synchronization.
9. Changes to the policy and contacts
9.1. We publish each new version of the policy at https://merit.legal/mcp/privacy with the date of the version. We tell Customers by email about changes that extend data processing no later than 14 days in advance.
9.2. Send all questions about personal data to support@merit.legal.