Privacy Policy

1. Who is responsible for your information

SAKAE PTY LTD is responsible for Merome account, support, security, service-use and applicable subscription information. Our postal address is PO Box 263, Pyrmont NSW 2009, Australia. Contact privacy@merome.io for privacy matters.

Where a business customer instructs us to process personal information on its behalf, we may act as its processor or service provider. Our Data Processing Addendum is available on this website.

2. Information we collect

Account information may include your name, email, Identity Platform identifier, Merome user/workspace identifiers, preferences and account status. Authentication is provided by Google Cloud Identity Platform. Merome does not store your plain-text password in its application database.

When billing is available, we may receive billing name/address/country, Stripe customer/subscription identifiers, plan, status, renewal dates and transaction information. Stripe processes payment card details; Merome does not store full card numbers.

When you authorise an eligible Instagram connection, Meta may provide account identifiers, username/profile/account statistics, posts/Reels/media identifiers, captions, publication dates/types, thumbnails, media needed for authorised analysis, available views/reach/likes/comment counts/shares/saves/engagement/follower statistics, historical metric snapshots, permissions, token status and encrypted access credentials. We do not receive your Instagram password or collect commenters' message text through the metrics refresh.

We may create transcripts, pillars/categories/classifications, calculated metrics, comparisons, content features, statistical analysis, summaries, audit results and related analytical outputs.

Technical information reasonably needed for operation/security may include IP address, browser/device/request metadata, session information, timestamps, errors, logs and authentication/security events. Support records may include contact details, correspondence and account information needed to investigate a request. Marketing preferences are collected only if marketing communications are offered.

3. How we collect information

We collect information directly from you, through use of Merome, from authorised Meta APIs, from Google Cloud Identity Platform, through operational/security systems, and from your authorised organisation administrator where applicable. When subscriptions are introduced, Stripe provides payment/subscription information.

4. Why we use information

We use information reasonably necessary to create/manage accounts and workspaces, authenticate users, connect authorised Instagram accounts, retrieve account/media information, perform requested audits and metrics refreshes, maintain measured history, transcribe/classify/analyse content, provide reports/support, diagnose problems, protect security/prevent abuse, enforce our Terms, communicate service information and comply with legal requirements.

When billing is available, this includes subscription/payment reconciliation and lawful accounting records. Aggregated or de-identified statistics are subject to the limitations below and applicable platform rules.

5. Instagram metric refreshes

Merome currently refreshes metrics when an authorised user requests a metrics refresh or account audit. Merome does not currently schedule daily account refreshes or automatically refresh metrics on login.

A metrics refresh may update available views, reach, likes, comment counts, shares, saves and other performance metrics, and discover new posts for later analysis. It does not run AI analysis, transcription or content-pillar classification.

We store historical snapshots at actual measurement times. These are not a guaranteed daily series, and a later refresh cannot reconstruct every intervening daily observation.

6. Artificial intelligence

Merome uses automated systems, including AI, for content analysis, classification, categorisation and analytical insights. The current analysis integration uses OpenRouter to access Anthropic models. Exact model versions may change; saved outputs retain available model/application provenance.

Production AI activation is subject to dedicated Merome credentials, reviewed provider routes and verified data-handling restrictions. We do not intentionally permit customer content to train general-purpose models where provider controls allow us to prevent that use. We do not claim that every provider offers zero retention; the Subprocessors page describes approved processing actually enabled.

AI can make mistakes. Outputs are informational tools, not guaranteed conclusions or predictions. We do not use this analytics service to make solely automated decisions determining access to employment, credit, housing, healthcare or similarly significant rights/services.

7. Transcription

The current transcription implementation runs the open-source Whisper model locally inside Merome's Google Cloud job infrastructure using faster-whisper. Customer audio is not sent to an OpenAI-hosted transcription API. Temporary downloaded media/audio is held in ephemeral processing storage and removed after processing or when the execution ends.

The model creator is not a recipient of that audio merely because its model is used. Any later external transcription provider must be disclosed before customer content is transmitted to it.

8. Aggregated and de-identified data

We may create aggregated or de-identified statistics for permitted benchmarking, product development, research and improving analytical methods. Cross-customer benchmark publication is not currently enabled.

We will not intentionally expose one customer's identifiable private analytics to another customer. These uses remain subject to applicable law, Meta's platform restrictions and our service commitments. Data is not considered anonymous merely because an identifier has been removed; only genuinely anonymised information that cannot reasonably identify customers or individuals may be used independently of original account information.

9. We do not sell personal information

Merome does not sell personal information or connected Instagram data to advertisers or data brokers, and does not use connected information for third-party behavioural advertising. Material changes require updated notice and any legally required consent/opt-out before processing begins.

10. Service providers

Selected providers support hosting, databases, objects, authentication, AI, operational logging/monitoring/security and, when activated, payments. See the Subprocessors page for processing currently enabled and planned integrations identified separately.

11. Meta and Instagram

Meta and Instagram operate independently of Merome. Information is exchanged through authorised APIs under granted permissions. Merome is not Meta, Instagram or an affiliate of Meta Platforms, Inc. Meta's terms/privacy practices continue to apply to its products.

12. Storage and international processing

Merome is operated from Australia. Primary application infrastructure, PostgreSQL and private object storage are configured in Google Cloud's Sydney region. This does not mean all provider processing remains in Australia.

Providers may process information in the United States or other jurisdictions where they operate. Where required, we use reasonable contractual/technical safeguards. See Subprocessors for provider purposes and location qualifications.

13. Security

We use administrative, technical and organisational measures appropriate to the service, including secure sessions, least-privilege access, managed secrets, encrypted storage, KMS-backed OAuth credential encryption, environment separation and protected database backups. The Security page describes verified controls and deployment-stage limitations. No system guarantees absolute security.

14. Data retention

Information is retained only as reasonably needed for its purposes and legitimate legal/accounting/security/operational requirements. Account and analytical history may remain while the corresponding account/workspace is active; disconnecting stops access but does not itself delete stored analytics.

Temporary media/audio is ephemeral. Persistent thumbnails/exports have database-owned object metadata; account/workspace deletion records durable object-deletion work. Export expiry and cleanup are independent of backups. Failed object deletion is retried rather than silently discarded.

Operational logs have limited configured retention. Required billing/accounting information may survive analytical-data deletion. Normal database backups and point-in-time recovery retain seven days; a protected final backup on database decommissioning may be retained for 30 days. Valid deletion requests remove active-system information without undue delay, subject to lawful retention.

15. Access, correction and deletion

Depending on applicable law, you may request access, correction, deletion, restriction, objection, portability, withdrawal of consent or objection to direct marketing. We provide reasonable correction/deletion mechanisms generally.

Contact privacy@merome.io or write to Privacy, Merome / SAKAE PTY LTD, PO Box 263, Pyrmont NSW 2009, Australia. We may verify identity/authority. We aim to respond reasonably and generally within 30 days. See Data Deletion for actual self-service controls and email fallback.

16. Privacy complaints

Contact privacy@merome.io with sufficient information to investigate. We aim to acknowledge/investigate legitimate complaints promptly. Applicable rights to complain to a privacy regulator are unaffected.

17. Children

Merome is intended for users aged 18 or older. We do not knowingly allow children under 18 to create Merome accounts. Contact privacy@merome.io if a child has supplied personal information.

18. Marketing communications

Necessary transactional messages may be sent regardless of marketing preferences where permitted. Marketing, if offered, requires an appropriate lawful basis, separate consent where requested and a working unsubscribe mechanism. Terms acceptance is not marketing consent. Optional marketing subscription is not currently offered.

19. Changes to this policy

We may update this policy as the service, providers or law change. Version/effective date remain displayed. Material changes to use of personal information receive appropriate notice where required.

20. Contact

Privacy: privacy@merome.io. Support: support@merome.io. Operator: SAKAE PTY LTD trading as Merome, ABN 14 692 541 772, ACN 692 541 772, PO Box 263, Pyrmont NSW 2009, Australia.