Skip to content
Merryhive
Log inSign up free

Legal

Privacy Policy

What Merryhive collects, why it collects it, who else sees it and how to get rid of it — written from the database schema rather than from a template.

Last updated

Plain language, on purpose. This document describes what Merryhive actually does — the data it stores, the services it shares that data with, and how money moves through it. If anything here is unclear, or seems to differ from what the product does, tell us and we will fix whichever one is wrong.

Merryhive is early software, and both documents will change as it does. The date above tells you which version you are reading.

Who this covers

Merryhive is a booking page. Two different kinds of people appear in it, and they have different relationships with us:

  • Hosts — people with a Merryhive account, who publish a booking link. For a host’s own data we are the controller: we decide what we store and why.
  • Guests — people who book a meeting through a host’s page. Guests never have a Merryhive account. We process a guest’s details on the host’s behalf, as a processor, so a guest’s first stop for a question about their booking is the host who owns the page. We will still act on a direct request — see your rights.

What we collect, and why

From a host, when you sign up

  • Your name, email address and a chosen username — the username is the public part of your booking link.
  • A password, stored only as a hash, if you did not sign in with Google.
  • Your timezone and an optional title, so your page shows the right hours and describes you.

From a host, as you use it

  • Your meeting types: names, descriptions, durations, locations, buffers, notice periods and prices.
  • Your availability: weekly hours, and date-by-date overrides including any reason you type into one.
  • Your booking-page settings: welcome message, whether phone is required, whether bookings need your approval, and your chosen brand colour and logo URL.
  • Your notification preferences.
  • Contacts you keep — a name, email, phone and any notes you write about that person, plus how many times you have met and when you last did.
  • Meetings you log manually, including who they were with.
  • Webhook endpoints and their signing secrets, if you set any up.
  • Your GST identity, if you enter one: GSTIN, legal name, address and state code.

From a guest, when they book

  • Name and email address. Phone number, if the host requires it.
  • Anything typed into the meeting notes field, and any answers to the host’s own custom questions — which means whatever the host chose to ask. Hosts: do not ask for health details, ID numbers or payment details in a custom question. Merryhive is not built to hold them.
  • The chosen time and the guest’s timezone.
  • Additional guests’ names and email addresses, if any are added.
  • Votes and names on a meeting poll, if the host sent one.

From your calendar and meeting tools, only if you connect them

  • OAuth access and refresh tokens for Google, Microsoft (Outlook/Teams) and Zoom, stored so we can keep acting on your behalf without asking you to sign in again.
  • Busy times from your connected calendars, so a guest is not offered a slot you are not free for. Google’s free/busy data tells us when you are busy, not what you are doing. Outlook events are read to draw Busy blocks on your page.
  • Events we create on your behalf, and the identifiers we need to update or delete them later.

How we use Google user data

When you connect Google Calendar, Merryhive asks for two permissions: to create, change and delete the events it makes for your bookings on your main calendar, and to see when that calendar is busy. We use them only to show guests the times you are free, and to put, move and remove booked meetings (with their Google Meet links) on your calendar.

Merryhive’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not sell Google user data, use it for advertising, or use it to train artificial intelligence or machine learning models, and nobody at Merryhive reads it unless you ask us to for support, it is needed for security, or the law requires it.

When money changes hands

  • A payment record per booking: the gross amount, the gateway fee, your earning, the currency and the provider’s payment reference. Refunds, disputes and the invoices and tax records generated from them.
  • We never see or store card numbers, UPI IDs, bank account numbers or CVVs. Payment details are entered into Razorpay’s or Stripe’s own checkout and stay with them. If you connect Razorpay, your API key and secret are stored — the secret encrypted — so we can create orders, check payments and send the refunds you confirm on your own account.

Operational records

  • A log of every email we attempted to send about a booking: the template, the recipient, the subject, the sender and whether the provider accepted it. Outside production, or when a sandbox sender is in use, the rendered email body is stored too so it can be previewed.
  • Daily page-view counts for your booking page — a number per day, not a visitor record.
  • Rate-limiting records: an opaque key (an IP address, or an email address being attempted) and a timestamp, so one client cannot hammer sign-in or payment endpoints. These are swept away as the window passes.

We do not run advertising, we do not sell or share data with data brokers, we do not profile you, and we do not make automated decisions with legal effects about anyone.

  • To perform the contract. Your account, your meeting types, your availability, and every booking made through your link — without these the product does not exist.
  • Your consent. Calendar and meeting-tool connections. Nothing is read from Google, Microsoft or Zoom until you complete their consent screen, and disconnecting it stops the access.
  • Legal obligation. Invoices, GST records and payment records, which tax law requires to be retained.
  • Legitimate interests. Email delivery logs, rate limiting and security records, so the service can be debugged and defended against abuse.

Who else touches it

These are the only third parties Merryhive sends data to. Each one is used for one job.

  • Vercel — hosting. Every page and API request passes through them.
  • Supabase — the Postgres database where everything above is stored. The database is hosted in Singapore (ap-southeast-1), so if you are in India or the EU, your data is stored outside your country.
  • Resend — sends the confirmation, reminder, cancellation, reschedule and refund emails. They receive the recipient address and the contents of those emails.
  • Razorpay — payments, refunds and payment-linked records for hosts taking money in INR.
  • Stripe — payments through Stripe Checkout, where that is used instead.
  • Google — Calendar free/busy, calendar events and Google Meet links. Only after you grant consent.
  • Microsoft — Outlook calendar events and Microsoft Teams meetings. Only after you grant consent.
  • Zoom — creates a Zoom meeting for a booking. Only after you grant consent.

If you point a webhook at your own endpoint, booking details are sent there too. That endpoint is yours, and what happens to the data once it arrives is your responsibility.

How long we keep it

  • Your account and everything hanging off it — for as long as the account exists.
  • Bookings, guests, custom-question answers and contacts — kept as history for as long as your account exists, because “when did I last meet this person” is a feature. Delete a contact and its notes go; bookings linked to it stay, with the link removed.
  • Payment records, invoices and GST records — retained after a booking is deleted where tax or accounting law requires it. These are financial records and cannot simply be erased on request.
  • Email delivery logs — kept so a “they never got the confirmation” question can be answered.
  • Rate-limiting records — minutes to hours; swept as the window expires.
  • OAuth tokens — until you disconnect the integration or delete your account, whichever is first.

We do not currently run an automatic deletion schedule for old bookings. If you want historical bookings removed, ask and we will do it.

Cookies

Merryhive sets one cookie: the NextAuth session cookie that keeps you signed in. It is strictly necessary — without it you cannot stay logged in — which is why there is no cookie banner on this site. There is no advertising cookie, no analytics cookie and no third-party tracker.

Two things are stored in your browser rather than in a cookie, and never leave your device: your light/dark theme choice, and the timezone a guest last picked on a booking page. Clearing your browser storage clears both.

Your rights

Depending on where you live — India’s DPDP Act, the GDPR, or similar law elsewhere — you can ask us to:

  • tell you what we hold about you, and give you a copy;
  • correct anything wrong (most of it you can edit yourself in the dashboard);
  • delete it, subject to the financial records noted above;
  • stop a particular kind of processing, or withdraw a consent you gave — disconnecting a calendar does this immediately and without asking us;
  • complain to your data protection authority if we handle this badly.

Hosts can download a copy of everything they hold here themselves, at any time, from Settings → Profile → Download my data. For anything else, write to hello@merryhive.com. We aim to answer within 30 days. If you are a guest rather than a host, tell us which host’s page you booked through so we can find you — and know that we may need to tell that host, since the record is theirs.

Deleting your account

There is no self-serve delete button yet. Email hello@merryhive.com from the address on the account and we will delete it.

When a host account is deleted:

  • your booking page stops working immediately, and any link you have sent out 404s;
  • your meeting types, availability, overrides, contacts, polls, one-off links, webhooks and integration tokens are deleted;
  • your bookings are deleted, including the guest names, emails and notes on them. Guests are not notified, and a guest who booked a future meeting will have nothing to cancel or reschedule — so cancel your upcoming bookings before you ask us to delete, or your guests will simply be stood up;
  • calendar events already created on your own Google or Outlook calendar are not removed, because they live in your calendar, not in ours;
  • invoices, tax records and payment records may be retained where the law requires it, detached from the deleted booking.

Security, honestly

Everything travels over HTTPS. Passwords are stored as hashes, never in plain text. Card details never reach our servers. Sign-in and payment endpoints are rate limited. Refunds require a signed-in host to confirm one explicitly and cannot be triggered by any automated path.

What we will not claim: Merryhive is early software run by a small team and holds no security certification. OAuth tokens and connected payment keys are stored in the database so the service can act on your behalf. If that is not an acceptable risk for the data you would be putting in, do not put it in.

If you find a security problem, email hello@merryhive.com before telling anyone else, and we will fix it and credit you.

Children

Merryhive is not for children. Do not create an account if you are under 18, and do not use it to collect information from children.

Changes and contact

We will change this policy as the product changes, and the “last updated” date at the top will move. For a change that materially affects how we handle your data, we will email hosts rather than quietly editing the page.

Questions: hello@merryhive.com. Anything else: hello@merryhive.com. The companion document is our Terms of Service.

See also our Terms of Service and our pricing.