Last updated: 5 October 2026
1. Who we are
This website, merlows.com (“Merlows”, “we”, “us”), is run by Dominic Merlow, trading as Merlows. For UK data protection law we are the controller of the personal data described here.
Contact: info@merlows.com
Address: PO Box 5543, High Street, London, W1A
2. What we collect, why, and our lawful basis
| When | What we collect | Why | Lawful basis |
|---|---|---|---|
| You create an account (including “Join” on the homepage) | First and last name, email address, password (stored hashed, never readable by us), and whether you register as a Reader or a Writer | To run your account, let you sign in and save items | Contract (providing the account you asked for) |
| You use your dashboard | Details you add to your profile, your profile photo, documents or images you upload, articles you save, and your email preferences | To provide the features you use | Contract |
| You sign in with Google | The name and email address Google shares with us when you approve | To sign you in | Contract |
| You use the Contact form | Your name, email address, subject and message | To reply to you | Legitimate interests (answering people who write to us) |
| You use Ask AI | The question you type, and the answer returned | To provide the assistant. See section 5 | Legitimate interests |
| You browse the site | Pages viewed, approximate location, device and browser type, referrer, and your IP address, through Google Analytics and Jetpack Stats | To understand which articles are read and to keep the site working | Consent for Google Analytics cookies; legitimate interests for basic Jetpack statistics and security |
| Any visit | Your IP address and request details in server logs | Security, preventing abuse, fixing faults | Legitimate interests |
We do not sell personal data. We do not use it to make decisions that have legal or similarly significant effects on you.
The shop is not open yet. When it opens we will collect order and delivery details and add them here before taking any order.
3. Cookies
When you first visit, a banner lets you accept or reject cookies that are not strictly necessary, and you can change your choice later.
- Strictly necessary: keep you signed in, protect forms, and remember your cookie choice. These do not need consent.
- Analytics: Google Analytics (measurement ID G-1YP5CEDWY3) and Jetpack Stats count visits and show which pages are read. Google Analytics cookies are used only if you accept them.
Fonts are loaded from Google Fonts, which means your browser contacts Google when a page loads. Profile pictures for writers may be loaded from Gravatar (Automattic).
4. Who we share data with
We use these providers to run the site. They process data on our behalf or, for Google and Automattic services, under their own privacy terms:
- our web hosting provider (hosting and server logs)
- Automattic (Jetpack, Jetpack Stats, Gravatar): automattic.com/privacy
- Google (Analytics, Fonts, and Sign in with Google): policies.google.com/privacy
- OpenRouter and the AI model provider it routes to (Ask AI): openrouter.ai/privacy
- our email provider, when we reply to you or send account emails
We may also disclose data where the law requires it, or to protect our rights or the safety of others.
5. Ask AI
Ask AI is an AI assistant. Whatever you type is sent to OpenRouter and the AI model provider behind it, so an answer can be generated. Please do not enter personal, confidential or sensitive information. Answers can be wrong; see our Terms of Use.
6. Sending data outside the UK
Some of the providers above are based in, or process data in, the United States and other countries. Where that happens we rely on a lawful transfer mechanism, such as an adequacy decision, the UK-US data bridge, or standard contractual clauses with the UK addendum.
7. How long we keep it
- Account details: until you delete your account, then removed from live systems within 30 days.
- Contact form messages: they arrive as email to our mailbox and are kept for up to 12 months after we last wrote to you.
- Ask AI questions: how long our AI provider keeps them is set by its own policy (see section 4).
- Analytics: Google Analytics keeps data for up to 14 months.
- Server logs: up to 90 days.
8. Your rights
Under UK data protection law you can ask us to: give you a copy of your personal data; correct it; erase it; restrict or stop using it; move it to another service; and you can object to processing based on legitimate interests. Where we rely on your consent, you can withdraw it at any time, for example through the cookie banner.
To use any of these rights, email info@merlows.com. We will reply within one month. If you are unhappy with how we handle your data you can complain to the Information Commissioner’s Office at ico.org.uk (helpline 0303 123 1113). We would like the chance to put it right first.
9. Children
Merlows is not aimed at children under 13 and we do not knowingly collect their data. If you think a child has given us personal data, email us and we will delete it.
10. Changes to this policy
We will update this page when what we do with data changes, and change the date at the top. For significant changes we will say so on the site.
