Legal Information

    Privacy Policy

    Effective Date: May 1, 2026
    Last Updated: October 9, 2026

    1. Introduction

    Edgvio Group Limited, the company behind the MerxumOS platform ("MerxumOS," "we," "us," or "our"), is committed to protecting your privacy and ensuring you have a positive experience on our platform. This Privacy Policy outlines our practices regarding the collection, use, processing, and disclosure of your information through our Point of Sale (POS), ERP software, mobile applications, and associated services (collectively, the "Service").

    This Policy is designed to comply with global data protection regulations, including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). By using our Service, you agree to the data practices described in this policy.

    2. Information We Collect

    We collect information to provide, manage, and improve our Service to you:

    • Information you provide to us: This includes account creation data (name, email, phone number, company name), financial data required for processing subscriptions, and business inventory or customer data inputted into the Service.
    • Automatically collected information: When you use the Service, we automatically collect device information, IP addresses, browser type, interaction data, and diagnostic analytics to maintain security and optimize performance.
    • Cookies and Tracking: We use cookies and similar tracking technologies to track activity on our Service and hold certain information, facilitating a smooth user experience.

    3. How We Use Your Information

    MerxumOS uses the collected data for various critical business purposes:

    • To provide, maintain, and monitor the usage of our Service.
    • To manage your account, verify identity, and prevent fraudulent transactions.
    • To execute AI-driven forecasts, analytics, and business intelligence specific to your operations.
    • To contact you with updates, security alerts, and administrative messages.
    • To comply with legal obligations, enforce our Terms of Service, and protect the rights, property, and safety of MerxumOS and our users.

    4. Data Sharing and Subprocessors

    We do not sell your personal data. We may share your information only in the following business-critical scenarios:

    • Service Providers: We share data with trusted third-party cloud hosting providers, payment processors, and analytics services (Subprocessors) strictly bound by data processing agreements.
    • Business Transfers: In the event of a merger, acquisition, reorganization, or sale of assets, your data may be transferred as a business asset. We will provide notice before your personal data is transferred and becomes subject to a different Privacy Policy.
    • Legal Requirements: We may disclose your data if required to do so by law or in response to valid requests by public authorities (e.g., a court or a government agency).

    5. International Data Transfers

    Your information, including personal data, may be transferred to—and maintained on—computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ. MerxumOS ensures that adequate safeguards, such as Standard Contractual Clauses (SCCs), are in place to protect your data during cross-border transfers.

    6. Data Security and Retention

    We implement enterprise-grade technical and organizational security measures to protect your data from unauthorized access, loss, or alteration. However, no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security.

    We will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your data to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our legal agreements.

    7. WhatsApp Business Platform Data

    When a business connects its own WhatsApp number to MerxumOS through Meta's WhatsApp Embedded Signup, we receive the following from Meta Platforms, Inc. ("Meta"):

    • Account details: the business's WhatsApp Business Account ID, phone number ID and display phone number, and the number's status and quality rating.
    • An access token: issued by Meta so that MerxumOS can act for that business. It is stored encrypted.
    • Messages: messages that customers send to the business's WhatsApp number, including attached media, the customer's WhatsApp phone number and the name on their WhatsApp profile, and delivery and read updates for messages the business sends.
    • Message templates: the templates on the business's WhatsApp account and their approval status.

    We use this data only to provide the WhatsApp features of the Service to the business that connected the number: sending its order, payment, delivery and receipt notifications, letting its staff read and reply to customers in the MerxumOS Inbox, managing its message templates, and showing the health of its connection. We do not sell this data, use it for advertising, or share it with any other business on MerxumOS.

    8. Disconnecting WhatsApp and Deleting Your Data

    A business can end MerxumOS's access to its WhatsApp account at any time, in either of two ways:

    • In MerxumOS, open Integrations, then WhatsApp, and choose Disconnect.
    • In Meta Business Suite, remove MerxumOS's access to the WhatsApp Business Account.

    Either way, we immediately and permanently delete the access token, so MerxumOS can no longer send or receive WhatsApp messages for that business. The business's past conversations stay in its MerxumOS account, so that it keeps its own customer records.

    To have that message history, or any other data we hold about you, deleted, email [email protected] from the email address on the account and tell us which business it concerns. We will delete the data within 30 days and confirm by email once it is done.

    If you messaged a business that uses MerxumOS, that business decides how your conversation is used. You can ask the business directly, or email [email protected] and we will help.

    9. Your Data Protection Rights

    Depending on your location (such as under the GDPR or CCPA), you may have the following rights regarding your data:

    • The right to access, update, or delete the information we have on you.
    • The right of rectification if your information is inaccurate or incomplete.
    • The right to object to our processing of your Personal Data.
    • The right of restriction, requesting that we restrict the processing of your personal information.
    • The right to data portability, allowing you to receive a copy of your data in a structured, machine-readable format.

    To exercise any of these rights, please contact our Data Protection Officer at [email protected].

    10. Changes to This Privacy Policy

    We may update our Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Effective Date." You are advised to review this Privacy Policy periodically for any changes.

    11. Contact Us

    If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

    Edgvio Group Limited (operator of MerxumOS)
    Legal Department
    Email: [email protected]