1. Scope and data controller
This policy applies to the MergeMac website, account registration and login, cloud Mac rentals, the console and support services. The service runs on dedicated physical Mac mini nodes, not virtual machines. When you browse public pages, create an account, pay for an order or submit a support request, we may process the business data described in this policy.
The entity operating MergeMac determines the purposes and means of processing this personal information and acts as the data controller for the platform’s business data. For questions about identity verification, data rights or the scope of processing, contact support@mergemac.com. To verify information about the operating entity, you can send a request to the same address.
We primarily process information to provide and fulfill rental services. We also process relevant records as necessary to protect account security, investigate misuse, resolve billing disputes and meet applicable legal obligations. We will explain separately any processing that requires your specific consent; general acceptance of the rental service does not replace a specific choice.
2. Data we collect
Account information.This includes your email address, account identifier, verification status and any contact details you choose to provide. We use your email to send verification codes, service and account notifications, verify data requests and contact you about support. We don’t store passwords in plain text accessible to support staff. Don’t send passwords, verification codes or connection private keys in support tickets or email.
Orders and billing records.These include your selected model, node, rental period, add-ons, order total, payment status, order and transaction identifiers, and information you provide for billing. We use these records to assign a physical node, confirm rental periods, process renewals, issue invoices and reconcile payments. They do not constitute collection of the work stored on your machine.
Console activity and security logs.These include login times, source IP addresses, basic technical information provided by your browser or device, and the time, target and outcome of actions such as placing an order, reinstalling a system or renewing a rental. We use them to verify requests, detect unusual access, troubleshoot service issues and restore service state—not to record source code entered in your remote editor.
Support tickets and email.These may include your questions, machine ID, order number, issue description and any screenshots or logs you choose to attach. Share only the excerpts needed to troubleshoot, and remove access tokens, signing materials and project secrets first. If the materials include information about team members, make sure you’re authorized to share it. Support staff won’t ask for an entire code repository unrelated to the issue.
3. Data we don’t collect
Reading source code, project files, build artifacts or business documents on your rented machine is not part of our standard service workflow. We don’t extract this content into website analytics systems. Records used to provide and manage the service are handled separately from work data stored on node disks.
Dedicated means the machine’s resources are assigned to one tenant for the rental period. CPU, unified memory and disk workspace aren’t shared with other tenants. This doesn’t mean files you choose to send to support are excluded from processing: logs, screenshots and attachments you submit become support materials and are used for the relevant support purpose.
If troubleshooting requires access to specific content on a node, we’ll first explain the scope and purpose and obtain your explicit authorization. You can provide a minimal, redacted reproduction case instead. Don’t post connection credentials in public requests. Reinstalling a system, clearing data at the end of a rental and deleting personal information are separate actions; see Section 6.
4. Payment data
We accept USDT-TRC20 and Visa / Mastercard / Amex (via Stripe), all settled in US dollars (USD). The gateways actually available are determined by the response from our backend. Stripe processes card details; MergeMac does not store full card numbers or security codes. We retain transaction identifiers, amounts and payment results needed to reconcile orders.
For USDT-TRC20 payments, we record only the on-chain transaction hash to verify receipt and link the payment to an order. We will never ask for your wallet’s private key or recovery phrase. The on-chain record associated with a transaction hash may be publicly searchable; account closure does not change the public nature of blockchain records.
Payment service providers process relevant data to complete payments, manage risk and meet their legal obligations. For refunds, payment disputes or billing checks, we share only the information needed for verification—not project source code, signing certificates or files on your node.
5. Cookies and analytics
The website and console use essential cookies or similar local storage to maintain your login, perform security checks and remember your language choice. Essential storage links authenticated requests to the correct account; it isn’t used to share login credentials between machines. If you disable or clear it, you may need to log in again, and some console features may not retain their state.
We use same-domain analytics to record page views, referral sources and key actions, such as clicks on plan and order links. This helps us assess site performance and identify information that needs improvement. Analytics events should not include passwords, verification codes, card details, remote access keys, support ticket contents or files stored on nodes.
You can view, restrict or clear site storage in your browser settings. Where consent is required by law for non-essential analytics, we enable it only after obtaining that consent and provide a way to withdraw it. Withdrawal does not affect processing carried out earlier on the basis of valid consent. Records needed for login security and optional usage analytics are handled separately for their respective purposes.
6. Retention and deletion
We set retention periods based on data type, the service relationship and legal obligations; we don’t keep all information indefinitely by default. We retain account information for as long as needed to provide account services. Order, billing and transaction verification records may need to be kept after a rental ends to meet financial recordkeeping obligations, handle payment disputes or resolve outstanding matters. Specific periods depend on applicable requirements and the purpose of each record. You can ask us about the basis for retaining information associated with your account.
We keep activity logs and support materials only as long as needed for security investigations, troubleshooting, service follow-up and dispute resolution. When the purpose has been fulfilled and there is no further basis for retention, we delete or anonymize the relevant personal information. Records retained under restrictions are not used for unrelated purposes. Backup copies are removed through normal rotation and are not returned to routine business use when a backup is restored.
We reset the system before handing over a node and clear disk data when the rental ends. You can also reinstall the system from the console. Reinstallation and end-of-rental clearing apply to work data on the node; they do not also delete orders, billing records or support tickets. Export anything you need before your rental ends or you reinstall the system. Deleting your account is not a substitute for backing up your project.
When you request account closure or deletion of personal information, we first verify that you own the account and check for an active rental, outstanding bills or records we’re legally required to retain. We process the request for information that can be deleted. If some information can’t be deleted yet, we’ll explain why, limit how it is used and describe the conditions for further action. We won’t imply that closing an account immediately removes every business record.
7. International data transfers
MergeMac offers five physical nodes: Singapore, Tokyo, Seoul, Hong Kong and the eastern United States. Once you select a node, project materials, build artifacts and files created during operation are processed there. Before choosing, check your team’s requirements for the location of source code, customer data and signing materials.
Choosing a physical node’s location doesn’t mean account, order, payment or support data is stored only there. Operational activities, payment services and support may involve processing locations outside your region. Necessary transfers are made in line with applicable data protection requirements, with limits on who can access the data, its scope and its use. When service providers are involved, we require them to process information for agreed purposes and apply appropriate safeguards.
Contact support to ask about data flows and safeguards for a specific service. Moving between nodes requires a new order; changing a display option in the console won’t automatically transfer disk files. Before migrating, confirm the destination node, data to be transferred and backups, and remove unnecessary keys and personal information from migration packages.
8. Your rights and contact details
To the extent allowed by applicable law, you may request access to your personal information or a copy of it, correction of inaccurate information, deletion of information that is no longer needed, restriction of or objection to certain processing, and withdrawal of consent you previously gave. Where applicable, you may also request data portability. Withdrawing consent does not affect processing necessary to fulfill an order, protect account security or meet legal obligations.
Sign in to theconsole and submit a support ticket, or email us from the address associated with your account at support@mergemac.com. Tell us the type of request, the account it relates to and what you’d like us to handle. You generally don’t need to attach project files, complete images of identity documents, machine passwords or payment secrets.
To prevent others from accessing your data, we verify your identity through your account or email address. If a team member makes a request on your behalf, we may need to confirm the scope of their authorization. We respond within applicable time limits. If your request is unclear, requires further verification or is subject to a legal retention requirement, we’ll explain what additional information we need or why we can’t fully comply.
If you have questions about the outcome, you can ask us to review it through the channels above. You may also file a complaint with a competent data protection authority, as permitted by law. A privacy request does not change the configuration of a service you’ve purchased. If you want node files deleted, your rental ended or your account closed, specify the action you want so we can handle each request separately.
9. Policy updates
We’ll update this policy if our service workflows, processing purposes or applicable requirements change, and show the relevant version and effective date on this page. We’ll provide appropriate notice through the website, console or your account email when changes materially affect data categories, purposes or your choices. Where renewed consent is required by law, publishing a new version alone does not replace it.
This policy doesn’t replace instructions provided at the time of a specific action. For example, review the data-clearing notice before reinstalling a system, the payment gateway’s processing information when paying, and the authorization request before support troubleshooting. Email our support address to ask about policy changes and their impact on existing accounts.
This policy is governed by the laws of the jurisdiction where the platform’s operating entity is based. Please contact support first to discuss any dispute. If court proceedings are necessary, they will be brought before a court with jurisdiction in that jurisdiction. Any mandatory rights you have under applicable law remain unaffected.