Merry and Me

Privacy Policy

Last updated: November 11, 2026

This Privacy Policy explains how Dvir Perl, an Israeli sole proprietor (osek, business no. 311351944) trading as Merry and Me ("we", "us"), collects, uses, shares and protects personal information when you use merryandme.com (the "Services"). We are the controller of your personal information. Contact: support@merryandme.com, Ramataim 39-43, Hod Hasharon 4532341, Israel.

Summary

  • You upload a photo of a person and of a pet, plus optional names and a greeting. We use them only to make your preview, video and card.
  • Uploaded photos are deleted as soon as your video is finished, or within 72 hours if you don't order. Everything else for your order is deleted within 72 hours.
  • AI providers (Google Gemini; fal.ai running the Kling video model) process your photos only to create your images and video, and their terms with us forbid training AI models on them.
  • Payments are handled by Lemon Squeezy, our reseller and Merchant of Record. We never see your card details.
  • Advertising pixels (Meta, TikTok) and Google Analytics load only if you accept marketing cookies. We honor Global Privacy Control.
  • We never sell or share your photos, names, greeting or email address.

1. Information we collect

  • Photo of a person (you, or someone who gave you explicit permission) and photo(s) of a pet: required to make the preview and video.
  • Names and greeting text for the card: optional.
  • Email address at checkout: required to deliver your order. Your choice to receive offers by email: optional, unticked by default.
  • Messages you send us when you contact support.
  • Created for you: the AI portrait, preview, video files and card generated from your photos.
  • Collected automatically: IP address, browser and device type and pages requested (server logs, to run and secure the site, kept up to 30 days); small cookies listed in section 5.
  • Only if you accept marketing cookies: Meta, TikTok and Google Analytics cookies and pixels that record your visit (pages viewed, checkout started, purchase and its value).
  • Your acceptance of our Terms and Refund Policy at checkout (order reference, date and terms version).
  • From Lemon Squeezy: confirmation that your payment succeeded (order ID and status).

We do not collect card or bank details (Lemon Squeezy collects them directly), passwords or accounts (there are none), or government IDs.

2. How we use it and our legal bases

  • Creating your free preview and, after payment, your video, portrait and card: performance of our contract with you.
  • Processing, delivering and supporting your order, including re-dos and refunds: contract; legitimate interests.
  • Preventing abuse and fraud (for example a daily limit of free previews per IP address): legitimate interests in keeping the service available and affordable.
  • Offers by email, only if you opted in: consent, which you can withdraw at any time.
  • Analytics and ad measurement: consent (cookie banner).
  • Meeting legal duties (tax, consumer law, lawful requests from authorities): legal obligation.

We do not make automated decisions that have legal or similarly significant effects on you.

3. Face photos: consent, use, retention and destruction

To make your video look like the people in it, AI models analyse the photos, which may include measuring facial features. Some laws (for example the Illinois Biometric Information Privacy Act, Texas Business & Commerce Code § 503.001 and Washington RCW 19.375) treat such facial measurements as biometric identifiers, so we apply these rules to all face photos:

  • Purpose: only to create the images and video you ordered. Never to identify or recognize anyone, never for any other purpose, never for AI training.
  • Consent: before uploading you confirm that you are 18 or older, that everyone in the photos gave you explicit permission and none of them is a public figure (for a child, that you are their parent or legal guardian), and that you consent to this processing. We keep a record of that consent (order reference, date and the version of the consent wording, no photos).
  • Disclosure: only to the AI providers in section 4, under terms that limit them to providing the service.
  • No sale: we never sell, lease, trade or otherwise profit from face photos or facial data, apart from producing the video you ordered.
  • Retention and destruction: uploaded photos are deleted from our server as soon as your video is finished and in all cases within 72 hours of upload. We do not keep face templates or measurements. Provider retention is described in section 6.
  • Security: photos are stored without metadata (we strip location and camera data), on a server only we can access, and transmitted encrypted. The 72-hour deletion runs automatically every hour.
  • Every video and image we create carries a visible "AI-generated" label.

4. Who we share information with

  • Google LLC (Gemini API, USA): photos, to create the AI portrait and frame the photo (names and greeting are added on our own server, not sent to Google). Paid API service under Google's Data Processing Addendum.
  • Features & Labels Inc. (fal.ai, USA): photos and generated images, to run the Kling video model, under fal.ai's Data Processing Addendum (including California "service provider" terms). fal.ai passes the content to the model's provider, Kling AI (Kling AI Pte. Ltd.), which stores data on servers in Singapore, to generate the video.
  • Render Services, Inc.: hosting of our server and its storage in Virginia, USA, under Render's Data Processing Addendum.
  • Lemon Squeezy (Link, LLC (formerly Lemon Squeezy LLC), USA): an order reference and the email address you entered for your order, which we pre-fill at checkout; you give Lemon Squeezy your payment details directly. Lemon Squeezy is our reseller and Merchant of Record and handles payment, invoicing and sales tax, and pays out the refunds we approve (Lemon Squeezy privacy policy).
  • Meta Platforms (Facebook/Instagram pixel), TikTok (pixel) and Google (Google Analytics 4), only with your consent: cookie identifiers, IP address, browser data, pages viewed and checkout/purchase events with value. Never photos, names, greeting or email. They use this under their own privacy policies.
  • Authorities or advisers when the law requires it or to establish, exercise or defend legal claims; and a buyer of the business if it is sold or merged.

The music in videos comes from a library made in advance; no music service receives your data.

5. Cookies, pixels, and "selling" or "sharing"

  • Necessary (always on): your cookie choice; mam_previews (free-preview counter, 30 days); mam_customer (returning-customer price, 60 days); mam_credit (re-do credit for your order, 72 hours).
  • Stored only in your browser, never sent to us: the optional "To" name you type when creating a greeting, kept in this browser tab's session storage to show in your order summary and cleared when you close the tab.
  • Only after you click "Accept": Meta pixel, TikTok pixel and Google Analytics 4.

Under some US state laws, such as California's, letting advertising pixels collect visit data can count as "selling" or "sharing" personal information for cross-context behavioral (targeted) advertising, even though no money changes hands. We treat it that way. We have never sold or shared photos, names, greetings or email addresses.

To opt out, use "Do Not Sell or Share My Personal Information" or "Cookie settings" in the footer and decline, or browse with Global Privacy Control (GPC) turned on: we then treat you as opted out and never load the pixels. We do not respond to "Do Not Track" signals, as there is no common standard for them.

6. AI processing and provider retention

We do not use your photos, names or outputs to train AI models. Our providers' terms forbid it too: fal.ai will not use our content to create, train or develop its products, including for partner models (fal API Services Terms § 2.4), and Google does not use paid Gemini API prompts or responses to improve its products (Gemini API Additional Terms).

Google keeps Gemini API prompts and responses for a limited period, only to detect abuse. We instruct fal.ai not to store request data, and the generated video files on fal.ai's servers expire within one hour.

7. How long we keep information

  • Uploaded photos: deleted when your video is finished, at most 72 hours after upload.
  • Previews, portrait, video files, card, names, greeting and order email on our server: 72 hours, then deleted automatically.
  • Consent record (order reference, date, version of the consent wording; no photos): as long as needed to show we obtained consent.
  • Checkout acceptance record (order reference, date, terms version; no email): as long as needed to show you accepted the Terms and Refund Policy, for example in a payment dispute.
  • Opt-in marketing list (email, date, order reference): until you unsubscribe or ask us to delete it.
  • Server logs: up to 30 days. IP counter for the free-preview limit: in memory, reset daily.
  • Payment and invoice records: kept by Lemon Squeezy as Merchant of Record under its own policy.

8. Security

We use encrypted connections (HTTPS), store uploads without metadata, keep data only briefly and restrict server access to us. No system is completely secure. If a breach is likely to put your rights at risk, we will notify you and the authorities as the law requires.

9. International transfers

We are based in Israel; our server and main providers are in the USA, and Kling AI is based in Singapore. The European Commission recognizes Israel as providing adequate protection. For EU/UK personal data sent to providers outside those countries, fal.ai's Data Processing Addendum includes the EU Standard Contractual Clauses (and the UK addendum), and Google processes paid Gemini API data under its Data Processing Addendum.

10. Children

The Services are for adults only: you must be 18 or older to use them, and they are not directed to children. We do not knowingly collect personal information from anyone under 18. A photo of a person under 18 may be uploaded only by that child's parent or legal guardian, and is used only for that order under the rules in section 3. If you believe a child gave us information, or a child's photo was uploaded without a parent's permission, email support@merryandme.com and we will delete it.

11. Your rights

Everyone: you can ask us to access, correct or delete your personal information, or to stop sending you offers, by emailing support@merryandme.com. We reply within 30 days at most and may ask you to confirm your identity, for example by replying from the email used for the order. Note that most data is deleted automatically after 72 hours.

US residents (including California, Colorado, Connecticut, Virginia, Texas and other states with privacy laws), depending on your state: the right to know or access, correct, delete and get a copy of your personal information; the right to opt out of "sale", "sharing" and targeted advertising (section 5); and the right not to be discriminated against for using these rights. An authorized agent may make a request with your signed permission. If we refuse a request, you can appeal by replying to our decision or emailing us with "Appeal" in the subject; we answer within the time your state's law sets, and you may then contact your state Attorney General. California "Shine the Light": we do not disclose personal information to third parties for their own direct marketing.

California categories collected in the last 12 months: identifiers (email, IP address, cookie IDs); commercial information (order, price, status); internet activity (pages, events); visual information (photos, generated video); personal records (names on the card, email); and biometric information (facial features analysed transiently from photos, section 3). Sources: you, your device and Lemon Squeezy. Disclosed for business purposes to the providers in section 4. Sold/shared (with consent, for advertising): only cookie IDs, IP address, internet activity and purchase events, to Meta, TikTok and Google Analytics. We use sensitive personal information only to make your video, never to infer characteristics about you.

EU/UK/Swiss residents: you also have the right to restrict or object to processing (including processing based on legitimate interests), to withdraw consent at any time, and to complain to your local data protection authority.

Israel: our database is managed in Israel under the Protection of Privacy Law, 5741-1981. You may ask to review the information about you and ask us to correct or delete it. You are not legally required to give us information, but without photos and an email address we cannot make or deliver an order. You may also complain to the Privacy Protection Authority.

12. Changes

We will post changes on this page and update the date at the top. We will tell you about material changes before they apply to information we already hold.

13. Contact

Dvir Perl (Merry and Me), Ramataim 39-43, Hod Hasharon 4532341, Israel. Email: support@merryandme.com.