Mercury Social Media Copilot

Privacy Notice

Last updated: 3 August 2026

This notice explains how Mercury International GmbH processes personal data in Mercury Social Media Copilot (the “Copilot”), an access-controlled workspace for product data, content creation, review, publishing and performance analysis. It supplements, but does not replace, privacy information supplied by connected platforms.

1. Controller and contact

Mercury International GmbH
Sinserstrasse 65
6330 Cham
Switzerland
UID: CHE-277.689.874
Commercial register number: CH-170.4.024.585-6

Submit a privacy request through Mercury’s contact form and select “Privacy request”, or write to the postal address above. Do not send passwords, access tokens or sensitive documents through the form. The form is a separate website service covered by the Mercury website Privacy Notice.

2. Scope and sources

This notice covers data relating to authorized users and other identifiable people whose information is included in products, media, rights records, connected business accounts, finance documents or published content. We receive data directly from authorized users, Mercury’s business systems and files, connected Shopify, Meta, TikTok, Google, Google Ads and Bexio accounts, the relevant platforms’ APIs, and service-generated security, backup and audit records.

3. Data we process

• Account and security data: username, display name, internal role, a random session identifier, login-attempt IP address, authentication time and audit records of successful changes.
• Editorial and business data: product and brand information, campaign briefs, prompts, drafts, comments, approvals, schedules, claims and supporting sources, accessibility inputs and export records.
• Media and rights data: uploaded originals, browser-ready and channel-sized versions, generated images and videos, file metadata, tags, source details, rights owner, rights status, restrictions and expiry.
• Commerce and performance data: Shopify product identifiers, titles, descriptions, status, URLs, images, prices and inventory, plus imported or platform-synced post metrics and CSV fields such as conversions, spend and revenue.
• Connected-account data: platform and account identifiers, names, usernames, granted permissions, access and refresh tokens, Meta Page and Instagram professional-account details, diagnostics, publication identifiers and statuses.
• AI data: prompts, selected product and brand context, editable campaign or performance context, reference media and generated text, image or video outputs.
• Finance and document data: invoices, receipts, expense and payment-preparation records, mailbox and Drive document identifiers, supplier or counterparty details, accounting classifications, synchronization status and review decisions. Payment execution remains subject to a separate authorized Copilot workflow.
• Infrastructure and backup data: service health, deployment and cost-monitoring events, database records included in encrypted operational backups, backup timestamps, integrity evidence and restoration logs.

The current Shopify synchronization does not request customer, order or payment data.

Login credentials and fields marked as required are necessary to use the relevant function. Optional editorial, analytics and rights fields are voluntary, but omitting them may limit review, traceability or publishing readiness.

4. Why we process data

We process data to authenticate and protect the workspace; synchronize authorized product and account data; create editable content and media; support human review and rights checks; submit explicitly approved content to connected channels; maintain schedules, audit evidence and deletion receipts; measure content performance; troubleshoot services; and meet legal, regulatory and contractual obligations.

Under Swiss data-protection law, processing follows the principles of lawfulness, proportionality, transparency, purpose limitation and security. Where the EU or UK GDPR applies, the legal basis depends on the context and may be performance of a contract or pre-contractual steps, compliance with a legal obligation, or Mercury’s legitimate interests in secure and accountable business communications and channel operations. Where a specific activity requires consent, we request it separately; consent can be withdrawn prospectively.

5. AI assistance and human control

Copilot functions may send the data described above to Google AI services, OpenAI or Higgsfield to suggest text, campaign plans, design settings, images or videos. The configured router prefers Google AI for supported text tasks and may use OpenAI as a fallback or for supported media functions; Higgsfield may be used for connected image and video workflows. Generative outputs can be incomplete, inaccurate or alter visual details. They are proposals, not legal, rights, safety or platform-compliance determinations. Authorized people must compare media with the source, verify claims, select required disclosures and give final approval before publication.

OpenAI states that API content is not used to train its models by default. The Copilot sends store: false for Responses API text requests. OpenAI may still retain limited abuse-monitoring data for up to 30 days unless stricter account controls apply. Video jobs can remain available for download for up to 48 hours and are subject to the provider’s documented abuse-monitoring retention. Do not enter secrets or unnecessary sensitive personal data in an AI field.

The Copilot does not use AI to make decisions that produce legal or similarly significant effects about individuals without meaningful human involvement.

6. Recipients and service providers

Access is limited to authorized Mercury personnel and service providers that need the data for the stated purposes. Depending on the function used, recipients include:

• Render for the Frankfurt application runtime and managed database, Google Cloud for protected MCP infrastructure, monitoring, encrypted backups and related cloud services, and Cloudflare for network delivery and security; provider administration, support and subprocessors may also process limited data in other disclosed locations;
• Google for requested Gemini/Vertex AI functions, Google Workspace or Gmail and Drive document workflows, Google Ads read-only reporting, and authorized backup storage;
• OpenAI and Higgsfield, including their approved subprocessors, for requested AI and media functions;
• Shopify for authorized product synchronization;
• Meta, TikTok and Google Ads for account authorization, content submission where enabled, publication status and authorized read-only analytics or reporting;
• Bexio for authorized finance-document, bookkeeping and payment-preparation workflows; the Copilot does not independently execute a payment;
• a Mercury-controlled Synology WebDAV media server for durable storage of originals and derivatives.

Mercury does not sell Copilot personal data or use it for third-party behavioral advertising. A connected platform processes data under its own terms and privacy information once content or an authorization request is sent to it.

7. International transfers

Processing takes place in Switzerland and the EEA, including configured services in Germany or Ireland, and may also take place in the United States and other countries in which a provider or its subprocessors operate. For each restricted transfer, Mercury relies on the safeguard applicable to the provider and service, which may include an adequacy decision or recognized standard contractual clauses with any required Swiss or EU adaptations and supplementary technical and organizational measures. You may request information about the relevant destination country and safeguard.

8. Publishing and external media

When an authorized user submits content for publication, the selected caption, media and settings are sent to the chosen platform and may become public according to the selected audience. Channel-ready derivatives may be made available through a public HTTPS address so a platform can retrieve them; uploaded source originals are restricted to authenticated Copilot users. If a user registers media hosted on an external website, opening that media can disclose normal connection data, such as the user’s IP address, to that host.

9. Cookies and similar technology

The Copilot sets one strictly necessary first-party session cookie named mercury_session. It contains a random session identifier, is not accessible to browser scripts, uses SameSite=Strict, is marked Secure in production and expires after eight hours. Failed login attempts are temporarily associated with an IP address for up to 15 minutes to limit abuse. The Copilot does not set optional analytics or advertising cookies; infrastructure providers may apply strictly necessary security mechanisms.

10. Retention

• Sessions expire after eight hours; failed-login controls use a 15-minute window.
• Connected-account credentials are kept while the integration is active or until they expire, are revoked, are disconnected or must be removed following a verified request. Disconnecting an account does not automatically erase separate editorial, media, publication or analytics records.
• Draft and profile version histories are limited by the application; successful change-audit records are limited to the most recent 5,000 entries and Meta deletion receipts to the most recent 500.
• Editorial, product, rights, media, publication and performance records are kept while the workspace is active and for as long as reasonably needed for business continuity, accountability, legal claims, rights management or applicable record-keeping duties.

Mercury reviews retention using purpose, sensitivity, contractual commitments, platform requirements and legal limitation or record-keeping periods. Data is deleted or anonymized when it is no longer required, subject to technically necessary backup cycles and lawful retention exceptions. A verified privacy request can trigger an earlier case-specific review.

11. Security

Mercury applies tenant- and role-based access, server-side credential handling, encrypted transport, AES-256-GCM encryption for provider credentials in active application state, login throttling, review and publishing controls, audit records, restricted source-media access and browser security policies. Operational database backups are encrypted and access-controlled; credentials and secret values are excluded from repository backups. Encryption keys are held separately as deployment secrets. Historical infrastructure backups expire under the applicable retention and deletion cycle. No system can be guaranteed completely secure. Authorized users must keep credentials confidential, avoid entering unnecessary personal or sensitive data, and report suspected misuse promptly.

12. Your rights

Subject to applicable law and any lawful exceptions, you may request information and access, correction, deletion or destruction, restriction, data portability, or object to processing. You may also withdraw consent where processing relies on it. We may request proportionate information to verify identity and authority. We generally respond within 30 days, or inform you if more time is lawfully required.

Submit a request through Mercury’s contact form by selecting “Privacy request”. You may also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, where applicable, your competent EU or UK supervisory authority.

13. Changes

We update this notice when the Copilot, its providers or legal requirements materially change. The date above identifies the current version. Material changes are communicated through an appropriate internal channel.