Merci

Your data and privacy.

What Merci keeps, where it lives, who can see it, how long, and how it lines up with California.

Swipe
MerciOne

The one rule

Your data is your data.

Everything a store puts into Merci belongs to the company that runs the store: the roster, the records, the photographs, the footage, the guest book. Merci stores it and works on it. Merci does not own it, does not sell it, and does not use it for anything you did not ask for.

The company can read it, print it, correct it by adding to it, and take it away. When a company leaves, its records are deleted and the key that unlocked them is destroyed. Nothing stays behind.

Whenever this book says "the company" it means the business that holds the account. Merci is the service; the company is the owner.

MerciTwo

What Merci keeps

Four kinds of people. Here is what is kept about each.

Crew. Name, and an email if they gave one. Their six-number sign-in, stored only as a hash nobody can read back. When side work started, which jobs they got and when they marked them done. The proof photograph of finished work, for 60 days. Anything filed for the record with their name on it, and any statement they wrote in their own words.
Managers and headquarters. Email and a password hash. Every note, record and decision they enter, with their name and the time on it.
Guests. From catering orders: the customer name and the order. From reservations: a first name and an initial on the board, and a phone number that is encrypted and shown only when a host taps to call.
The building. Camera footage, on the store's own box, and the flags Merci's eye raises from it: a frame, a short clip, a sentence.

Also the ordinary technical log every web service keeps: address, time, page. Used for security, nothing else.

MerciThree

Where it lives

Two places. Nothing on anybody's phone.

The store box. A small computer on the store's own network. The cameras record to its disk and stay there. It talks out to Merci over an encrypted connection; nothing on the internet can connect in to it. On the store's own network it runs the fallback server, so when the internet is down the crew can still check in and mark side work done and a manager can still see the cameras, the day's flags and who is in. For that it keeps a copy of the day: names, the scrypt hashes of PINs, today's side work, the current schedule. Never a PIN, never a record.

The service. One server in a data center, running the Merci application and its database. Every page a manager, crew member or headquarters opens comes from here.

A phone or tablet keeps two small cookies: that you are signed in, and which store you belong to. No names, no photos, no roster. Close the page and nothing keeps running.

MerciFour

How it is protected

Encrypted, fenced, and written in ink.

  • Encrypted at rest. Names, emails, phone numbers, notes, statements and recipe books are encrypted in the database with a key unique to each company. The key that unwraps it is never stored beside the data.
  • Encrypted in transit. Every page, every photograph, every frame, every time.
  • Fenced by company. The database itself refuses to hand one company's rows to another. It is not a rule in the app; it is a rule in the database.
  • Written in ink. A record, once filed, is never edited. Not by a manager, not by headquarters, not by Merci, not by the person who built it. Anything new goes underneath with a name and a time. The ledger is chained, so a changed line is caught by Verify.
  • Merci's own people see operational counts. Never your recipes, never your guests, never your records.
MerciFive

Who can see what

Each person sees their own floor, and no further.

A crew member sees their own shift and their own side work. Never another person's record, never the cameras.
A manager sees their store: the roster, the day, the records, the cameras live. A manager can ask Merci for a snippet and send it up. A manager cannot download footage.
Headquarters sees what a manager sent up, and can ask Merci for a time frame itself. Only headquarters can save a copy of footage, and every copy is written in the ledger with a name and a time.
The owner holds the accounts: adds and removes people, and nobody else can reset the owner's password.

Every time footage is asked for, cut, watched, sent up, saved or reviewed, one line goes in the audit log. Managers and headquarters can read it. Crew never see an audit log about themselves, because there is nothing in it about them.

MerciSix

What leaves the building

Three things go out. Each gets only what it needs.

  • To Merci's service. Heartbeats, live frames while a manager is watching, clips a manager asked for, and the eye's flags. Encrypted, signed with a per-store token.
  • To the AI model (Anthropic). A few still frames when the eye needs a second opinion, a table crop to judge clean or dirty, a clip a manager asked Merci to watch. Never audio, never names, never a face on purpose; the model is told not to describe a person beyond position and action. Under the API terms: not used to train.
  • Email and push. A sentence and a link to a manager or headquarters, through a mail relay and the phone's own push service. Never a picture.

Merci's spoken replies go to a voice service as text only. Nothing goes to a camera maker's cloud. No advertising, no analytics beacons, no data brokers. The full list of processors is on merciapp.net/privacy.

MerciSeven

The cameras

Video only. The floor, not the person.

  • No sound, ever. The cameras record no audio and Merci never asks for any. California is a two-party consent state for recording conversations; there is nothing here to consent to.
  • Never a restroom, locker room or anywhere somebody changes. Dining room, kitchen line, lobby, bar, patio.
  • No faces, no biometrics. The eye reads positions and movement. It does not recognise anyone, count steps, time a person, or note who talks to whom.
  • Written notice. The crew page "What Merci knows about you" is the notice, readable before signing in. Keep it posted where the sign-in tablet is.
  • A person decides. When the eye thinks it saw something it files a draft and a manager looks. Nothing the camera notices is ever a write-up on its own.
MerciEight

How long

Every number, in one place.

Footage on the box
3 days
A week around anything the eye flagged. Then gone.
Proof photos
60 days
The fingerprint stays, so the record shows one was filed.
Video on a guest incident
1 year
A small version a second year, then a still and the record.
Anything about an employee
5 years
Including a clip. California keeps injury records that long.
Sign-in links
1 hour
A crew welcome link 7 days, a new account's first link 3 days, a password reset 2 hours. Each works once.
Everything else
While the account is open
Deleted, with the key, when the company leaves.

The database is backed up before every change to its shape, and backups are kept at least 14 days. Personal fields are encrypted inside a backup exactly as they are in the database. Footage is never backed up: it lives once, on the box.

MerciNine

What Merci never does

The list the crew page makes, kept here too.

×Never your location. Not at sign-in, not on a photo, not ever.
×No face scan, no fingerprint, no voiceprint.
×No microphones. The cameras record no sound.
×Nothing when you are off the clock.
×Cannot see contacts, texts, the photo library, or other apps.
×Nothing sold, shared for advertising, or handed to a broker.
×Does not touch payroll. Does not draft the schedule.
MerciTen

Nothing is a write-up

Merci documents. A person decides.

Everything Merci writes down is a record of what happened, kept so that nobody has to remember it and nobody can be blamed for something they didn't do. A flag from the eye, a note for the record, a statement in someone's own words: none of it is a mark against anyone.

  • No automatic consequences. Merci never rates, ranks, scores or disciplines a person. Any decision about a person is made by a person, and the record shows who.
  • A statement is asked for, never demanded. The person sees a one-line ask and a blank form. The record itself is not shown to them.
  • Release is a checklist, not a time clock. A shift ends when the work is done and checked, not on a timer Merci runs.

California is moving on automated decisions at work. Merci's posture already matches the direction: the tool informs, the human decides, and the human's name is on it.

MerciEleven

Your rights

Know, correct, copy, delete. Ask, and it is done.

  • Know. The crew page lists everything collected and why. This book is the long version.
  • A copy. Any record prints to a PDF for the person it is about. Personnel records within 30 days of asking; Merci does it the same day.
  • Correct. A record is never rewritten, so a correction is added underneath in the person's own words, with a date. Both stay.
  • Delete. Anything the law does not require kept. Injury and employee records stay their five years.
  • Opt out. Nothing to opt out of: nothing is sold or shared.

Crew ask their manager or headquarters, who hold the records. A company asks [email protected] for anything Merci holds on its behalf, including the whole account.

MerciTwelve

California, line by line

Where each rule lands in Merci.

CCPA and CPRAMerci is below the size thresholds and honours the rights anyway: know, correct, copy, delete, no sale. Employee data is treated the same as anyone's.
CalOPPAA privacy policy is posted at merciapp.net/privacy and this book says the same thing in more words.
Labor Code § 1198.5 and § 432A copy of personnel records within 30 days, and a copy of anything a person signed. Any record prints; a signed page prints as signed.
Penal Code § 632No audio is recorded anywhere, so no conversation is ever captured.
Labor Code § 435No camera in a restroom, locker room or changing area. Written notice of the cameras is on the crew page.
MerciThirteen

California, continued

Security, breaches, and injuries at work.

Civil Code § 1798.81.5Reasonable security: personal fields encrypted at rest with a per-company key, everything encrypted in transit, one company fenced from the next in the database.
Civil Code § 1798.82A breach of personal information is disclosed to the people affected without unreasonable delay, with what was taken, when, and what to do. The ledger shows what was touched.
Cal/OSHA and SB 553Anything filed about an employee, including a clip, is kept five years. A workplace-violence incident is logged without identifying details.
Civil Code § 1798.83Merci shares nothing for anyone's direct marketing, so there is nothing to disclose under "Shine the Light".

Reviewed against the public text of these rules on 2026-09-24. This is how Merci is built, not legal advice; your own counsel says what your policy must say.

MerciFourteen

Leaving

Take it all with you, or ask for it gone.

  • Export. Every record prints. For everything at once, a company writes to [email protected] and gets its data back in plain files.
  • Delete. On request, the company's records are removed and its encryption key destroyed. What the law requires kept is handed back first.
  • The box. Footage lives on the store's own hardware. Unplug it and the footage goes with the box.
  • Nobody is locked in. No contract term keeps your data here. The account is yours to close.
MerciFifteen

Merci

Questions? [email protected]

merciapp.net/books

Read alongside
A note for HR for the crew portal in plain words. For IT for what runs where. The crew page at merciapp.net/crew/privacy, readable without signing in. The film for HR at merciapp.net/film/hr.
MerciSixteen