Privacy Policy

1. Applicability

This Privacy Policy applies to the website located at https://www.merrydiv.com, our mobile application, and all related services. This policy is incorporated into and subject to our Terms of Use.

For more detail about read-only account access, credential handling, and encryption, see our Security page. You can also review the full Terms of Use.

2. Information We Collect

We collect information you provide directly and information collected automatically to provide, secure, and improve our Services.

2.1 Personal Information: Includes your name, email address, username, device identifiers, and information you send when contacting support. If you choose Apple or Google sign-in, we receive the account information and authentication details provided through that sign-in flow, such as your email address and, when supplied, your name.

2.2 Financial Information: We collect balances, transactions, and holdings from financial accounts you link, as well as portfolio information you enter manually, such as holdings, dividend payments, and investment goals.

• Credential Security: You enter credentials directly with our third-party provider (e.g., Plaid). MerryDiv does not receive or store your bank or brokerage passwords.
• Authorization: We receive access tokens to display your data solely to provide the Services.

2.3 Automatically Collected Data: We automatically collect IP addresses, browser settings, device info, and usage data via cookies and similar technologies. We use this data for security, analytics, advertising measurement, and to maintain the performance of the Platform. This can include pages visited, feature interactions, referring sites, campaign parameters, and subscription-plan information. Where analytics is configured, activity may be associated with your MerryDiv account identifier.

2.4 Chrome Extension (MerryDiv Dividend Toolkit): Our optional browser extension sends search text and ticker symbols to MerryDiv's API to retrieve public stock and dividend results. These requests also involve ordinary network information, such as an IP address, and may appear in application, hosting, proxy, or monitoring logs. The extension does not require a MerryDiv account. It saves your last-searched ticker and last-active tab locally using Chrome's storage.local; those saved preferences remain on your device. The extension does not read your browsing history, other tabs, or bookmarks.

2.5 Subscription Information: We process subscription status, product and transaction identifiers, purchase and renewal events, and related billing records to provide paid features, reconcile payments, and handle support. Apple and Stripe process payments through their respective checkout systems.

3. Eligibility and Age Restrictions

The Services are intended only for individuals 18 years of age or older. We do not knowingly collect personal information from individuals under 18. If we discover that we have inadvertently collected information from a minor, we will delete such information from our systems immediately.

4. California Notice at Collection (CPRA)

Pursuant to the California Privacy Rights Act, this serves as our Notice at Collection for California residents:

• Categories Collected: Identifiers, commercial information (transaction history), and sensitive personal information (financial account access).
• Purposes of Use: To provide investment tracking, maintain account security, improve functionality, and measure advertising performance where you have granted tracking permission.
• Retention: We retain personal information only for as long as necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements.

5. Service Providers and Advertising Measurement

We share information with service providers that help operate MerryDiv, including account connectivity, subscription management, hosting, and analytics.

• Plaid: Connects financial accounts and supplies authorized account, balance, holdings, and transaction information.
• Apple and Stripe: Process purchases and subscriptions through their respective payment systems.
• RevenueCat: Manages iOS purchase records and subscription entitlements associated with an app-user identifier, and supplies subscription events for the advertising measurement described below.
• Apple and Google sign-in: Authenticate you when you choose those sign-in methods.
• Google Analytics: Measures website visits and campaign-related interactions through Google tags after you accept optional analytics. Any advertising-platform linkage or additional recipient depends on the integrations actually enabled; this policy does not imply that a planned advertising partner is already receiving data.
• Amplitude: Measures website and product interactions, referral and campaign information, and account-related properties such as plan level, signup method, and number of linked accounts when configured.
• Mandrill (Mailchimp Transactional): Delivers service emails and enabled notifications using your email address and message content, which can include portfolio or dividend information relevant to the notification.

In our iOS app, after you acknowledge the updated notice, separately allow advertising measurement, and grant iOS tracking permission, we use Tenjin to measure which advertisements lead to app installs and subscriptions. When the corresponding integrations are enabled, this may involve sharing advertising and app-installation identifiers, device information, IP addresses, and subscription events with Tenjin and the advertising partners connected to it. RevenueCat supplies subscription events for this measurement. We do not include portfolio holdings, brokerage balances, or brokerage credentials in these advertising measurement events.

You can decline advertising measurement or change that choice in MerryDiv’s Privacy controls, and change tracking permission in iOS Settings. MerryDiv does not start Tenjin attribution while permission is undetermined, denied, or restricted, and stops SDK reporting when it detects that permission has been withdrawn. These choices do not affect your access to MerryDiv's features. To request deletion of previously collected information, contact [email protected].

Website storage and choices: We use cookies and browser storage for sign-in, preferences, and consent choices. Optional Google Analytics and Amplitude reporting remains off until you accept through the cookie banner. Acceptance enables analytics identifiers and activity reporting; rejection blocks initialization. You can reopen the banner using Privacy Choices in the footer. Withdrawing acceptance stops optional reporting in open tabs, with a consent recheck when a tab regains focus. We offer a reload to unload previously authorized analytics code after you save unfinished edits; it does not erase data already received by providers. Global Privacy Control overrides an acceptance. Browser controls can also restrict cookies and storage, but may affect sign-in and saved preferences. Contact us about analytics associated with your account.

Public portfolio sharing: If you create a shared portfolio link, the display name and portfolio information selected in your sharing settings become publicly accessible to people with the link. Depending on your selections, this can include holdings, allocation, returns, dividend income, share counts, and dollar values. You can change the shared information or delete the link in sharing settings. Removing a link cannot recall copies others have already saved.

6. Data Security and Breach Notification

We use administrative and technical safeguards to protect your data. In the event of a security breach affecting your personal information, we will notify you as required by applicable law.

7. Your Rights and Request Handling

You may request to access, delete, or correct your personal information by emailing [email protected].

Depending on your location and applicable law, you may also have rights to receive a portable copy of your information, object to or restrict certain processing, withdraw consent, and complain to your local data protection authority. Withdrawing consent does not affect processing lawfully carried out before withdrawal.

• Verification: To protect your security, we will verify your identity (typically via your registered email) before processing requests.
• Timeline: We respond within the deadlines required by applicable law. Depending on your location and request, this is generally one calendar month under EU/UK data protection law or 45 days under applicable US state privacy laws, subject to permitted extensions and verification requirements.
• Limiting Use: Where applicable law provides this right, you may request limits on the use or disclosure of sensitive personal information beyond what is necessary to provide the Services.

Account deletion and retention: You can request account deletion through the Delete Account control in your profile settings or contact support. The deletion flow removes portfolio accounts, holdings, investment transactions, and associated records from active databases and attempts to disconnect linked Plaid items. It retains a deleted-account record, including an account identifier, deletion details, and the original email address in that record. Deleting your MerryDiv account does not automatically erase information held separately by payment, analytics, or other providers, or every record in backups and logs. Contact us to request deletion of remaining personal information; applicable legal obligations and exceptions may affect what can be removed.

Account deletion is separate from subscription cancellation. Manage Apple subscriptions in your Apple Account subscription settings; contact support for help with other billing arrangements. Do not rely on account deletion alone to stop recurring charges.

8. International Data Transfers

Data is primarily processed in the United States. Our providers may also process information in other countries, where data protection laws can differ from those in your country. Contact [email protected] for information about the locations and safeguards applicable to your information.

9. Changes to This Policy

We may update this policy as our Services and practices change. The Last Updated date identifies the latest revision. We will communicate material changes through an in-app notice, email, or another appropriate notice, and obtain any consent required by applicable law before beginning the relevant processing. Acknowledging an updated policy does not itself grant iOS tracking permission.

10. Contact Us

For any questions regarding this policy or to exercise your rights, please contact us at [email protected].