Privacy Policy

1. About this policy

This policy explains what personal data Merra collects, why, what we do with it, and what your rights are. It’s written in plain English. If anything’s unclear, email privacy@trymerra.ai.

This policy covers Merra Practice at trymerra.ai, whether you signed up yourself or an agency or organisation invited you. Section 3 is for you if you were invited — it explains who is responsible for your data and what the organisation that invited you can see. Organisations buying Merra for their students or staff do so under separate business terms; contact legal@trymerra.ai.

2. Who we are

Merra Ai Ltd is the data controller for your personal data when you use Merra Practice. We’re a UK company (Co. No. 16470710), registered office 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.

3. If an agency or organisation invited you

If you got here through an invitation from an education agency, a university, an employer or another organisation, this section explains how that works. Everything else in this policy still applies to you as well.

Who is responsible for what

The organisation that invited you is the data controller for your practice on its programme. It decides who to invite, what you practise, and what it does with the results. It has to give you its own privacy information, and any decision it makes about you — about your application, your placement, or anything else — is its decision and its responsibility to explain.

Merra is the processor. We run the platform and handle your data on that organisation’s instructions, under a written contract. We don’t decide what your organisation does with your results.

Merra remains the controller for a few things of its own: keeping the service secure, preventing fraud and abuse, and our own business and accounting records.

What your organisation can see

Sessions you ran before joining stay private. When you accept an invitation, the organisation’s view starts from the date you joined. Practice you did before that — on your own account, or with a different organisation — is not visible to them, and joining doesn’t make it visible.

If you already have a personal Merra account and accept an invitation with it, that rule still holds. Your earlier practice remains yours alone.

Training

We do not use practice content from organisation-sponsored students to train or fine-tune Merra’s AI models, or anyone else’s. This applies to your answers, recordings, transcripts, reports and uploads. Removing names or identifiers doesn’t change it — that content is excluded from training altogether.

This is different from the position for individual users in Section 6, and it applies whatever your account settings say.

Your content is still processed to run your interview and produce your report. That’s the service your organisation is paying for, and it’s not training.

How long it’s kept

Your organisation sets its own retention period under its contract with us, and we delete accordingly. Our default is 365 days from each session. Recordings are removed automatically once that period passes.

If your organisation exports a copy of your report, that copy is then held by them under their own retention rules. Deleting your Merra account doesn’t remove copies they’ve already downloaded.

When a programme ends, we handle the data on the organisation’s instructions and under the agreed retention rules. It doesn’t become training data or marketing data.

Your rights

You keep every right in Section 10. Where your organisation is the controller, the request usually goes to them and we help them answer it — email privacy@trymerra.ai if you’re not sure who to ask and we’ll route it.

If you think something in a report about you is wrong, tell both your organisation and support@trymerra.ai. Our scores and feedback are generated automatically and can be wrong, and your organisation is required under our business terms to apply human judgement rather than treat a Merra score as an automatic decision.

4. What data we collect

Account data

• Display name (taken from your email address, or from your Google account)
• Email address
• Password hash (we never see your actual password) or Google sign-in ID
• Account creation date

Practice content

• Audio and video of your practice interviews
• Transcripts generated from those recordings
• Scores, evaluations, and feedback
• Facial expression signals detected during interviews when your camera is on — an expression label (e.g. “smiling”, “neutral”), a timestamp, and a confidence score. The analysis runs on your own device and we store only these results, not the video frames used to produce them — see Section 6
• Uploaded content (CVs, job descriptions) — when you use a mode that takes a CV or job description

Payment data

Handled by our payment provider. We see: last 4 digits of your card, card type, billing country, transaction ID. We never see or store your full card number or CVC.

Device and technical data

• Browser type, operating system
• IP address (used to estimate approximate location for fraud prevention; retained for up to 30 days)

Usage data, session replay and ad measurement

Only collected if you accept optional cookies:

• Pages visited, features used, errors encountered
• A replay of your interactions with the site (clicks, scrolls, navigation); passwords are always masked
• Which ad brought you to Merra and whether you signed up or paid

5. Why we use it and our legal basis

Every non-essential email includes an unsubscribe option, and you can opt out at any time by emailing support@trymerra.ai. You can withdraw consent for any consent-based processing at any time — see Section 10.

6. AI — how we use your data

Merra is an AI product. Two things happen with your content, and they’re separate:

1. Real-time feedback (third-party AI providers)

We use third-party AI providers for reasoning and for voice. They process your interview content in real time to generate your feedback. Our contracts with these providers prohibit them from training their own models on your content.

2. Improving Merra’s own models

This applies to individual accounts only. If an organisation invited you, none of this applies to you — your practice content is excluded from training entirely, and Section 3 explains that.

For individual accounts, we use your practice content — interview audio, transcripts, scores, evaluations, and CV/JD uploads — to train and fine-tune Merra’s own AI models. The goal is better feedback, smarter interview simulations, and a product that learns what actually helps people prepare well.

You can opt out at any time in your account settings — one toggle, takes effect immediately for any future use of your content. Content that’s already been used in a completed training cycle can’t always be removed from a finished model, but we won’t include you in anything new going forward.

When we use your content for training:

• We use it inside Merra only. We don’t sell it, share it, or use it to train anyone else’s models.
• We remove direct identifiers (name, email, account ID) before training where technically possible.
• We use it only to improve Merra Practice — not for advertising, not for any kind of decision-making about you as an individual.
• You can also request deletion of your past contributions by emailing privacy@trymerra.ai.

Legal basis: Legitimate interest (UK GDPR Art. 6(1)(f)). We have a legitimate interest in improving our service, and we’ve assessed that this doesn’t override your rights given the safeguards above and your ability to opt out at any time. You can object via the settings toggle, or by emailing privacy@trymerra.ai.

Facial expression analysis (on your device)

When your camera is on during a practice interview, Merra analyses your camera feed to detect facial expressions (for example smiling, neutral, or surprised). We use this to make your coaching feedback richer — covering how you present yourself, not just what you say.

• The analysis runs in your browser, on your own device. The video frames it looks at are not sent to us or to anyone else for this purpose.
• We store only the results — an expression label, a timestamp, and a confidence score, linked to that interview — and use them in your evaluation and coaching feedback.
• We don’t use these signals to identify you, and we don’t use them for any decision about you outside your own practice feedback.
• If you practise with your camera off, no expression analysis happens.

Expression signals are part of your practice content: they’re deleted with your account (Section 7) and covered by the same training opt-out above.

Anonymised metrics (always on)

We also use anonymised, aggregated metrics (e.g. “X% of users finish their first interview”, “average score by interview type”) to track how the product is performing. This data can’t be traced back to you.

Automated decisions

Merra’s scores and feedback are generated automatically, but they are for practice only and have no legal or similarly significant effect on you. We don’t use solely automated decision-making of the kind covered by Article 22 UK GDPR, and your results are not used to make decisions about you as an individual outside the product.

7. How long we keep your data

Training contributions: if your content has been used in a completed AI training cycle, that contribution may persist in trained models even after you delete the source content or opt out. We won’t include you in new training runs going forward.

8. Who we share your data with

We use third-party providers who handle data on our instructions and under contract, in the following categories:

• Hosting, database and file storage — UK, Singapore and Australia
• AI reasoning and voice generation — United States
• Payment processing — UK, EU and United States
• Email delivery — EU
• Analytics, session replay and ad measurement (consent-only) — United States

We’ll tell you in advance before adding a provider that handles a new category of data, and we can name our current providers on request — email privacy@trymerra.ai.

Our engineering team works from outside the United Kingdom and accesses production systems under contractual confidentiality and data-protection obligations, on a least-privilege basis.

We don’t sell your data. We don’t share it with advertisers.

We may share data if required by law (e.g. court order), to investigate fraud or abuse, or as part of a business sale or merger (you’d be told before this happens).

9. International transfers

Some of our providers, and our own engineering team, operate outside the UK. When your data is transferred outside the UK, we use UK GDPR-approved transfer mechanisms:

• Standard Contractual Clauses (SCCs) combined with the UK International Data Transfer Addendum, or, where a provider is certified, the UK Extension to the EU-US Data Privacy Framework
• Transfer impact assessments where required

10. Your rights (UK GDPR)

You have the right to:

• Access — get a copy of your personal data
• Rectification — correct anything that’s wrong
• Erasure — delete your data (“right to be forgotten”)
• Restriction — pause processing
• Portability — get your data in machine-readable form
• Object — object to processing based on legitimate interest
• Withdraw consent — for analytics, session replay, ad measurement, marketing, and any other consent-based processing
• Complain to the ICO at any time (see Section 14)

To exercise any of these: email privacy@trymerra.ai. We’ll respond within 30 days. There’s no charge.

Some of these you can do yourself:

• Opt out of AI training (account settings)
• Delete your account (account settings)
• Manage cookie preferences (Cookie Policy page)

For everything else — including a copy or export of your data, or deleting individual recordings — email us and we’ll do it within 30 days.

11. Users under 18

Minimum age to use Merra: 18. When you sign up, you confirm you are 18 or over. Merra is not intended for under-18s, and we don’t knowingly collect data from anyone under 18.

If you’re a parent or guardian and believe someone under 18 has signed up, email privacy@trymerra.ai and we’ll delete the account.

12. Cookies

We use a small number of cookies. See our Cookie Policy for details and to manage your preferences.

Analytics, session replay and ad measurement only run if you’ve accepted optional cookies. If you’ve selected “Essential Only”, none of them are collected.

13. Security

• Encryption: TLS in transit, AES-256 at rest
• Access: role-based access for staff, on a least-privilege basis
• Recordings: stored in private storage that is not publicly accessible
• Monitoring: we use our platform providers’ security monitoring and alerts
• Backups: encrypted, managed by our database provider
• Vendor security: all providers must meet our security standards

If we discover a personal-data breach that’s likely to affect you, we’ll notify you and the ICO within 72 hours, as required by UK GDPR.

Security concerns: security@trymerra.ai.

14. Complaints

If you’re unhappy with how we’ve handled your data, please email privacy@trymerra.ai first — we’ll try to resolve it.

You also have the right to complain to the Information Commissioner’s Office (ICO) at any time, without contacting us first:

• Website: ico.org.uk
• Phone: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF

15. Changes to this policy

We may update this policy. For material changes (e.g. a new category of data, a new category of provider, changes to retention), we’ll email you in advance. For minor changes (e.g. clarifying wording), we’ll update the “Last updated” date at the top.

16. Contact

Merra Ai Ltd 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom

• privacy@trymerra.ai — privacy questions, rights requests
• security@trymerra.ai — security issues
• support@trymerra.ai — general support