MerfinUI MerfinUI

Privacy Policy

MerfinUI Privacy Policy

Effective date: July 19, 2026

This Privacy Policy explains how MerfinUI processes personal Data in Connection with its Discord Application, Subscriber Access Pages, Download Pages, Desktop Companion, and related Administration tools. MerfinUI is designed to provide controlled Access to Subscriber Content, verify Access Permissions, manage Content selected by Administrators, maintain service security, and support Users and Administrators.

The controller responsible for the processing described in this Privacy Policy is:

MerfinUI
Privacy contact: privacy@merfinui.com

If MerfinUI appoints a representative in the European Economic Area or the United Kingdom where required by applicable law, the representative details will be made available in this Privacy Policy or in the associated legal notice.

This Privacy Policy applies to:

  • the MerfinUI Discord Application and related Discord interactions,
  • Subscriber Access and Download Pages,
  • the MerfinUI Desktop Companion and related update or collection features,
  • Content Management and Administration tools,
  • operational, security, audit, and support processes connected to MerfinUI.

This Privacy Policy does not replace Discords own privacy policy. Discord processes data independently when users use Discord, Discord Servers, Discord roles, interactions, APIs, and related platform features.

Depending on how a user or administrator interacts with MerfinUI, we may process the following categories of personal data:

Discord and access data

  • Discord user IDs, Usernames, Display Names, Server IDs, Role information, interaction Data, and Access Verification Results.
  • Information needed to determine whether a User is allowed to access Subscriber content.
  • Timestamps connected to Discord interactions, access checks, and access events.

Subscriber and Download Data

  • Requested Content Categories or Items.
  • Access Events, page access events, copied strings, file download events, Companion app download events, timestamps, and related Access History.
  • Data needed to prevent abuse, investigate access issues, and provide support.

Administration Data

  • Administrator Discord Account identifiers, Admin Names, Permissions, Content changes, configuration changes, moderation or support actions, audit log entries, and timestamps.

Managed content and media

  • Content, descriptions, media references, previews, files, metadata, and related presentation information that administrators choose to import, manage, publish, update, or remove through MerfinUI.

Technical and security data

  • Technical events, error logs, security events, abuse prevention records, app version information, device or browser information, network information, and operational information needed to run, protect, debug, and improve the service.
  • Infrastructure and security systems may process technical identifiers such as IP addresses, user agents, request metadata, and comparable data when users access MerfinUI pages, downloads, APIs, or the Desktop Companion.

Special Categories of Data

MerfinUI does not intentionally request or process special categories of personal data, or similar sensitive information. Users and administrators should not submit such data to MerfinUI.

MerfinUI may provide a separate MerfinUI GM Discord Bot that can be invited by guilds to connect a Discord server with a personal MerfinUI Guild Manager workspace. The GM Bot helps guild managers import Discord roles and members for roster administration, connect Discord accounts with in-game characters, and manage future raid event signups through Discord interactions and event posts.

For this purpose, MerfinUI may process Discord user IDs, usernames, display names or server nicknames, avatar or profile image URLs, Discord server IDs and names, role IDs and role names, selected in-game characters, selected class and specialization information, event signup choices, workspace connection data, and technical audit or timestamp data.

The GM Bot does not read private messages, does not monitor general server conversations, does not use the Discord Message Content Intent, and does not process Discord presence, online, or game status data.

The Discord Guild Members Intent is used only where necessary for role and member import, permission checks, and mapping Discord members to the connected Guild Manager workspace. Access to workspace data is limited to authorized guild owners, guild managers, administrators, and service operators who need access for operation, support, security, or abuse prevention.

Server administrators may remove the GM Bot or disconnect the Discord server from the workspace. Guild owners and authorized administrators may manage or delete workspace data through the available Guild Manager controls or by contacting MerfinUI. MerfinUI keeps GM Bot data only as long as needed for workspace operation, event management, support, security, legal obligations, or abuse prevention.

The MerfinUI bot does not monitor general Discord conversations or private messages.

Message content is only processed where necessary for the specific MerfinUI function being used, for example when:

  • a user interacts with MerfinUI commands, forms, buttons, or modals,
  • an administrator intentionally imports or manages selected content for MerfinUI pages,
  • content is needed for support, administration, moderation, or troubleshooting.

Imported or managed content is used only for MerfinUI presentation, access management, administration, support, and service security.

MerfinUI may use strictly necessary cookies, local storage, session storage, device-local app storage, or similar technologies to provide secure access pages, maintain temporary access sessions, prevent abuse, remember local app settings, and operate the requested service.

Where non-essential cookies, analytics, tracking, or similar technologies are used, MerfinUI will rely on consent where required by applicable law.

Where the EU GDPR, UK GDPR, or comparable data protection laws apply, MerfinUI processes personal data on the following legal bases:

Providing the service

MerfinUI processes data to verify subscriber access, provide private subscriber content, operate download pages, process user interactions, and provide requested functionality.

Legal basis: performance of a contract or steps prior to a contract, Art. 6(1)(b) GDPR, and legitimate interests, Art. 6(1)(f) GDPR.

Security, abuse prevention, and operational reliability

MerfinUI processes data to prevent unauthorized access, protect subscriber content, detect abuse, maintain audit logs, investigate errors, and keep the service reliable.

Legal basis: legitimate interests, Art. 6(1)(f) GDPR.

Administration and content management

MerfinUI processes administrator activity, content changes, configuration changes, and audit data to manage the service and maintain accountability.

Legal basis: legitimate interests, Art. 6(1)(f) GDPR.

Legal compliance

MerfinUI may process and retain data where required to comply with legal obligations, lawful requests, dispute handling, or regulatory requirements.

Legal basis: legal obligation, Art. 6(1)(c) GDPR, and legitimate interests, Art. 6(1)(f) GDPR.

Consent-based processing

Where MerfinUI asks for consent, for example for optional analytics or non-essential storage technologies, the legal basis is consent.

Legal basis: consent, Art. 6(1)(a) GDPR. Consent may be withdrawn at any time without affecting the lawfulness of processing before withdrawal.

MerfinUI does not sell personal data.

MerfinUI may share personal data with service providers and processors only as necessary to operate, protect, maintain, or improve the service. These may include providers for:

  • Discord platform functionality,
  • hosting and server infrastructure,
  • storage and backups,
  • database services,
  • security and abuse prevention,
  • logging and error monitoring,
  • email and support communication,
  • administrative tooling.

These providers may process personal data only as necessary for the relevant service and subject to applicable legal, contractual, and security requirements.

MerfinUI may also disclose data if required by law, legal process, enforcement of rights, security investigations, or protection of users, administrators, MerfinUI, or third parties.

MerfinUI may be operated, administered, hosted, or supported from different countries. Personal data may therefore be processed in or accessed from countries outside the users country of residence, including countries outside the European Economic Area or the United Kingdom.

Where applicable data protection law requires safeguards for international transfers, MerfinUI relies on appropriate mechanisms such as:

  • adequacy decisions where available,
  • standard contractual clauses or comparable transfer safeguards,
  • additional technical and organizational safeguards where appropriate,
  • statutory derogations only where legally permitted and necessary.

Users may contact privacy@merfinui.com for more information about applicable transfer safeguards where required by law.

MerfinUI keeps personal data only for as long as necessary for the purposes described in this Privacy Policy.

Retention periods or criteria include:

  • Temporary access links and access sessions expire automatically.
  • Access, download, Companion, and app activity history is retained as long as reasonably necessary for access management, support, analytics, troubleshooting, fraud prevention, abuse prevention, and dispute handling.
  • Admin audit logs and configuration history are retained as long as reasonably necessary for accountability, security, support, and operational integrity.
  • Managed content and media references are retained until they are updated, replaced, removed by an administrator, or no longer needed.
  • Technical logs and backups are retained according to operational, security, and backup cycles unless longer retention is required for abuse prevention, disputes, legal obligations, or security investigations.

If a user requests deletion, MerfinUI will delete or anonymize the relevant data where applicable and where no overriding retention obligation or legitimate reason applies.

MerfinUI uses technical and organizational measures designed to protect personal data and subscriber content, including access controls, authentication, private access mechanisms, permission checks, administrative controls, and operational logging.

No online service can guarantee absolute security. MerfinUI cannot prevent an authorized user from manually copying, saving, recording, or sharing content after access has been granted.

MerfinUI may automatically verify Discord roles or permissions to decide whether access to subscriber content should be granted or denied.

This automated verification is used only for access control and does not produce legal or similarly significant effects within the meaning of Art. 22 GDPR. If a user believes access was denied incorrectly, they may contact MerfinUI support or privacy@merfinui.com.

Depending on applicable law and the user's location, users may have the right to:

  • request access to personal data,
  • request correction of inaccurate personal data,
  • request deletion of personal data,
  • request restriction of processing,
  • object to processing based on legitimate interests,
  • request data portability,
  • withdraw consent where processing is based on consent,
  • lodge a complaint with a competent data protection authority.

To make a privacy request, contact: privacy@merfinui.com

To help locate the relevant records, users should include their Discord user ID and a short description of the request. MerfinUI may need to verify the requesters identity before responding to a privacy request.

MerfinUI is intended for users who are allowed to use Discord under Discords own terms and applicable law. MerfinUI does not knowingly provide services directly to children below the applicable minimum age.

MerfinUI may update this Privacy Policy when the service, legal requirements, providers, or processing activities change.

The effective date at the top of this page shows when the current version took effect.

This Privacy Policy is public so Discord reviewers, MerfinUI users, subscribers, and administrators can understand how MerfinUI handles personal data.