1. Who this policy covers
Meruit ("Meruit," "we," "us" or "our") provides marketing intelligence tools for law firms and the agencies supporting them. This policy covers our public website at meruit.legal, our application at app.meruit.legal, and communications about those services.
We decide how account, service administration and website information is used to operate Meruit. When a firm or agency provides information about others through its workspace, we handle that information to deliver the service for that customer. The customer is responsible for its own collection practices, permissions and privacy notices. If your information was provided by a firm or agency, contact it first about its records; you may also contact us for assistance.
2. Information we collect
- Account information: your email address, account identifier, authentication records, and information you provide when registering or requesting support. Google sign-in may also provide your name, profile image and verified email status. Our authentication provider handles password authentication; Google sign-in does not give Meruit your Google password.
- Workspace information: firm or agency names, websites, practice areas, markets, memberships, account selections and settings. Records you enter can include reporting dates, ad spend, lead and signed-case totals, aggregate case values, and AI search observations such as prompts, public evidence links and notes.
- Connected platform information: when a connector is available and you authorize it, we receive access credentials, account identifiers, account names, permission details and connection status. Google Ads checks can access campaign identifiers, names and performance metrics. Microsoft Ads currently supports account discovery and access checks. HubSpot checks request deal identifiers, pipeline and stage information, amounts and relevant dates. These checks are not an automatic import of all your advertising or CRM records.
- Technical and service information: hosting and authentication systems process information such as IP addresses, browser or device information, request times, visited URLs, session events and errors to deliver and protect the service.
- Communications and transactions: messages you send us and related support records. If you purchase a paid service, we may receive business billing details, invoices and payment status. Any payment provider and payment-data collection will be identified in the purchase flow.
The current service is designed for aggregate marketing information and public search evidence. The HubSpot connector does not request contact names, client email addresses, legal narratives or case documents. Please do not place confidential case files, privileged communications or sensitive client details in free-text fields.
A feature marked "coming soon" does not collect connected-account data until it is available and you authorize it.
3. How we use information
We use information to create and authenticate accounts; maintain workspaces and permissions; establish and check authorized connections; display reports and user-entered observations; respond to requests; administer any purchased services; diagnose problems; prevent abuse; and meet legal obligations.
We may use service diagnostics to improve reliability and usability. We do not sell personal information, share it for cross-context behavioral advertising, or use connected advertising, CRM or Google account data to train general-purpose AI models. The current AI visibility feature stores observations you enter; it does not automatically send your workspace records to an AI model provider.
4. Google sign-in and Google Ads data
Google sign-in requests basic identity information to create or authenticate your Meruit account. It does not request access to Gmail, Google Drive or Google Ads. Connecting Google Ads is a separate authorization used for account access and advertising performance checks.
Google and Microsoft advertising permissions can include management capabilities required by their platform authorization scopes. Meruit's current connectors perform reads and access checks. Accepting those scopes does not mean Meruit is changing your campaigns or has established a new agency manager relationship.
We handle Google API data under the Google API Services User Data Policy, including applicable Limited Use requirements. We use that data for the features you authorize, not advertising, data resale, credit decisions or general-purpose AI training. Transfers are limited to delivering those features with your consent, security needs, legal obligations, or a business transfer with any consent Google requires. Human access is limited to your affirmative permission, necessary security or legal purposes, or permitted aggregated internal operations.
You can review or revoke Meruit's Google access through your Google Account connections. Revoking Google sign-in access may affect your ability to use that sign-in method. Revocation does not automatically delete your Meruit account or previously stored workspace records.
7. Retention and security
We retain account and workspace information while it is needed to provide the service and fulfill the purposes described here. Retention depends on the type of record, account activity, customer instructions, legal requirements and legitimate security or dispute-resolution needs. When information is no longer needed, we delete or de-identify it. Backup copies may remain until the applicable backup retention cycle expires and are not used for ordinary product access.
Disconnecting an integration in Meruit deletes its stored connection credentials and related account connections. It does not automatically remove records you entered, revoke permissions inside the provider's settings, or remove an agency manager relationship. Use the provider's own settings for those actions, and contact us to request deletion of retained Meruit information.
We use safeguards including encrypted connections, access controls, session protections and encryption of stored integration tokens. No service can guarantee complete security. Contact us promptly if you suspect unauthorized access.
8. Your choices and privacy rights
You can choose whether to connect external accounts and can disconnect them from Meruit. To request access, correction, a copy of your information, or account and associated personal-data deletion, email mike@twotreesppc.com with the subject "Meruit privacy request." Account deletion is currently handled by request. We may need to verify your identity and authority before acting. Requests involving a customer's workspace may need to be coordinated with that customer.
Depending on your location and the laws that apply, you may have additional rights to restrict or object to processing, withdraw consent, receive portable data, appeal a request decision, use an authorized agent, or complain to a privacy regulator. California residents may have rights to know, access, correct and delete personal information and to exercise applicable opt-out rights. We respond within applicable legal deadlines and do not discriminate for exercising protected privacy rights. Legal, security and other permitted exceptions may limit a request; we will explain any relevant limitation.
Where a legal basis is required, we rely on providing the service you request, legitimate interests such as security and service administration, legal obligations, or consent where required. Withdrawing consent does not affect processing that was lawful before withdrawal.
9. Children
Meruit is a business service intended for adults aged 18 or older. We do not knowingly collect children's personal information. Contact us if you believe a child has provided information so we can investigate and take appropriate action.
10. Changes and contact
We will post changes on this page and update the date above. For material changes, we will provide an appropriate notice, such as an in-app notice or email. We will obtain additional consent before new uses of data where required, including under applicable Google policies.
For questions or privacy requests, contact Meruit, attention: Michael Wisby, at mike@twotreesppc.com. Our Terms of Service explain the rules for using Meruit.