Merlin Privacy Notice

1. About this notice

Merlin is a business platform operated by BookPal LLC, 3002 Dow Ave, Ste 112, Tustin, CA 92780 ("BookPal," "we," "us"). BookPal staff use it to manage customer accounts, orders, quotes, deliveries and marketing. Authors, publishers, customers and partner organizations whom BookPal invites, or whose request for access BookPal approves ("outside users"), use it to see information about their own business with BookPal.

This notice explains what information Merlin handles, why, who helps us process it, and the choices you have. It supplements the BookPal Privacy Policy, which covers bookpal.com and our ordering services. Where the two differ for Merlin, this notice applies.

Merlin is a tool for business relationships. It is not offered to consumers for personal use.

2. Information we collect

About people who use Merlin (staff and outside users)

• Account details: your name, email address, organization, role, and the access BookPal has granted you (for example, which titles, orders or accounts you can see).
• Sign-in information: if you sign in with Google, we receive your Google account email, name and account identifier (and, where Google provides it, your profile picture). If you sign in with a one-time code, we email a 6-digit code to you. We keep a record of failed code attempts that uses a one-way fingerprint of your email address, not the address itself, so we can block guessing.
• Two-step sign-in: if you set up an authenticator app, our authentication provider stores the factor's secret and basic details (such as when it was added and its label). BookPal staff cannot see the secret. If you lose your device, an administrator can reset your factors, and we keep a record of who reset them, when and why.
• Requests for access: if you ask for access, the details you give us (such as your name, email, organization, your relationship with BookPal and your message) and our decision.
• Information you provide: quote and order requests, comments, notes, files and other content you submit.
• Activity and security records: sign-ins, the actions you take that change data or need approval (an audit trail), and technical information such as IP address, browser type and the time of each request, which our hosting and authentication providers log. When a sign-in form shows a security check, Cloudflare Turnstile receives your IP address and browser signals to tell people from bots.
• Error reports: if something breaks, a technical report goes to our error-monitoring provider. These reports are configured not to include personal information by default, and we strip request details before they are sent.

About business customers and contacts (information we receive from our own systems and partners, not from you directly)

• BookPal's business records: customer accounts, business contacts (names, work email addresses, phone numbers, job titles, organizations and addresses), opportunities, quotes, orders, purchase orders, products and shipments, read from Odoo, BookPal's system of record, and from orders placed on bookpal.com through BigCommerce. Merlin also holds an archive of historical records from BookPal's former customer-relationship system.
• Business email: when a BookPal staff member connects their BookPal Google Workspace mailbox, Merlin keeps a copy of the messages exchanged with BookPal's business customers, prospects and suppliers: sender, recipients, subject, date and the full text, with the names, types and sizes of attachments (not their contents). A shared BookPal mailbox, such as the purchasing mailbox, is handled the same way. Messages with no customer, prospect or supplier among the participants, such as internal or personal mail, are not kept, and a staff member can mark a message private with a Gmail label, or remove one that was kept by mistake. The copy belongs to the customer's account record, so colleagues who look after that account can see the history. Merlin also holds email history imported from former staff mailboxes, from BookPal's system of record (Odoo) and from its former customer-relationship and support systems, under the same rule.
• Shipping and tracking: tracking numbers, carrier status and delivery events from carriers such as UPS.
• Contact enrichment: Merlin may look up a business contact's work email address or a company's website domain with People Data Labs, a licensed business-data provider, to add details such as job title, employer, company size and industry. This feature is currently switched off; we will update this notice before it is used.
• Public information: bestseller lists, book catalog data (such as ISBN records), public procurement notices and published speaker and event listings.

Marketing measurement: Merlin reads performance reports from BookPal's Google Ads, Google Analytics, Google Search Console and Google Merchant Center accounts. These reports are about campaigns and web traffic, not about individual Merlin users.

3. How we use information

• To provide Merlin: sign you in, show you the information BookPal has shared with you, and process your requests.
• To run BookPal's business: manage accounts, quotes, orders, purchasing, deliveries, customer service, sales and marketing.
• To keep an account's history and memory: Merlin summarizes email threads, labels each email with what it is about (for example a quote request, an order update or a supplier message) and notes facts a customer has shared (for example preferences, commitments and dates they mentioned), each linked to the email it came from. Merlin does not record health, religious, political or financial details as facts.
• To keep Merlin secure: verify identity, apply two-step sign-in, prevent abuse, investigate incidents and keep an audit trail.
• To measure and improve: understand which marketing works and which features are useful, and fix errors.
• To meet legal obligations and enforce our Terms of Use.

We do not use information in Merlin to make decisions about individuals that have legal or similarly significant effects without a person involved.

4. How Merlin uses AI

Merlin uses Claude, an AI model provided by Anthropic, to summarize, classify and draft (for example, to suggest a follow-up email, classify an inquiry or summarize an account's history). To do that, the relevant business information is sent to Anthropic for processing. This includes the text of customer and supplier emails, with card, bank and tax-identification numbers removed first, to produce the summaries, labels and notes described above.

Merlin advises and drafts. A BookPal staff member reviews and approves anything that is sent to a customer or other outside party; Merlin does not send client-facing messages on its own. AI output can be wrong, so we treat it as a suggestion, not a fact.

Under Anthropic's commercial terms, information sent through its API is not used to train its models, and Anthropic deletes it within 30 days. Anthropic may keep content longer only if it is flagged for a policy violation (up to 2 years) or where the law requires.

5. How we share information

Service providers. We use the providers below to run Merlin. They process information on our behalf, under contract, and only for the purposes described.

Ads measurement. When BookPal's ads-measurement feature is switched on, Merlin tells Google Ads which ad clicks led to orders, so BookPal can see which ads work. For each order this can include the Google click identifier and, where consent rules allow, a one-way hashed (SHA-256) version of the customer's email address, never the address itself. We use this upload only to learn which of BookPal's own ads led to orders. Google processes it for us as a service provider, with ad personalization turned off. We do not sell or share personal information for cross-context behavioral advertising.

Outside users see only their own business. Merlin shows an outside user only the information BookPal has chosen to share with them: for example, an author sees sales of their own titles, and a customer sees their own organization's orders and quotes.

Other sharing. We may disclose information if the law requires it, to protect the rights, safety and property of BookPal, our users or others, or as part of a merger, acquisition or sale of assets, in which case this notice continues to apply to the information transferred.

We do not sell or share personal information.

6. Cookies and similar technologies

Merlin uses only cookies and browser storage that it needs to work. It has no advertising cookies and no third-party analytics cookies.

• Sign-in cookies keep you signed in and refresh your session securely.
• Security cookies protect sign-in and account-connection steps from forgery, and sign outside users out after a period of inactivity.
• Preference storage remembers settings such as light or dark theme and, for staff, layout and filter choices.

If you block these cookies, you will not be able to sign in. This page and the Terms of Use set no cookies.

7. How long we keep information

We keep information for as long as we need it for the purposes above, then delete or anonymize it. In particular:

• Your Merlin account: while you have access. When access ends, we remove or deactivate your sign-in. Records of what you did in Merlin (the audit trail) are kept for security and accountability for 7 years.
• Requests for access that we decline: deleted 12 months after our decision.
• Business email copies, summaries and notes: kept while the customer relationship is active and for 7 years after the account's last order or message. A person can ask us to delete the email content they are party to, and the summaries and notes drawn from it.
• Short text extracts used for purchase-order and shipping notices: deleted automatically after 90 days by default (BookPal can shorten this).
• Failed sign-in code records: kept only long enough to enforce sign-in limits: deleted within 2 days, and as soon as you sign in successfully.
• Business records (accounts, orders, quotes and related contacts): kept as long as BookPal keeps the matching records in its system of record, and as required for tax, accounting and legal purposes.

8. How we protect information

Access to data is enforced in the database itself, so each person can see only what their role or invitation allows. Connections are encrypted in transit. Sign-in supports two-step verification with an authenticator app. Service credentials are kept in protected server-side storage and never sent to browsers. Actions that change data or reach customers are logged, and anything sent to a customer needs a person's approval.

No system is perfectly secure. If you believe your account has been compromised, contact us right away.

9. Your choices and rights

You can ask us to tell you what personal information we hold about you, give you a copy, correct it, or delete it. You can also ask us to close your Merlin access at any time. We will verify your request (usually by confirming control of your email address) and respond within the time the law requires. We will not treat you differently for exercising your rights.

California residents. Under the California Consumer Privacy Act, as amended, you have the right to know what personal information we collect, use and disclose; to delete it; to correct it; and to opt out of its sale or sharing. The categories we collect are listed above (identifiers, professional or employment-related information, internet or network activity, and commercial information); we collect them from you, from BookPal's systems and from the sources described; and we use and disclose them for the business purposes above. We do not use sensitive personal information to infer characteristics about you. You may use an authorized agent to make a request.

Visitors from the European Economic Area, United Kingdom or Switzerland. We process your information to perform our agreement with you or your organization, for our legitimate interests in running and securing BookPal's business, to comply with law, and, where required, with your consent. Merlin's data is stored and processed in the United States. You may also have the right to object to or restrict processing and to complain to your local data-protection authority. Merlin is not directed to the EEA, UK or Switzerland. Where we do process information about people there, we transfer it to the United States under the European Commission's Standard Contractual Clauses (and the UK Addendum) in our service providers' agreements.

Other U.S. states give their residents similar rights; we honor them as the law requires.

10. Children

Merlin is for business use by adults. It is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has given us information, contact us and we will delete it.

11. Changes to this notice

We may update this notice as Merlin changes. We will change the date at the top and, for significant changes, tell signed-in users in Merlin or by email before the change takes effect.

12. Contact us

To make a privacy request or ask a question, email support@bookpal.com, call 866-522-6657 (Monday–Friday, 8:30 am–5 pm Pacific) or use our contact page.