Privacy Policy

Overview

Merge provides code review assessments for engineering teams. This Privacy Policy describes how MergeOA ("Merge," "we," "us") collects, uses, stores, and shares information when you visit our website, create a company account, send candidate invites, or complete an assessment.

Information we collect

We collect only what is needed to run assessments and support hiring teams. Candidate data is collected for a specific invite and assessment, not for unrelated marketing or resale.

• Account information such as name, work email, company name, and authentication details.
• Candidate information such as name, email address, assessment responses, code review comments, and submission timestamps.
• Proctoring and session recordings when enabled, including camera snapshots, microphone audio clips, screen-share snapshots, and browser activity signals such as tab visibility changes. These are collected only during the assessment window and only when the hiring organization has enabled proctoring for that assessment.
• Billing and subscription records provided by your company or payment processor.
• Integration data from connected systems such as applicant tracking systems, including invite metadata and result delivery status.
• Technical logs such as IP address, browser type, device information, and usage diagnostics.

How we use information

We use collected information to:

• Provide, secure, and improve the Merge assessment platform.
• Deliver invites, authenticate candidates, and generate hiring reports.
• Store assessment artifacts and proctoring evidence for review by authorized hiring teams.
• Process billing, provide support, and communicate about the service.
• Operate integrations with ATS and identity providers requested by customers.
• Detect abuse, enforce one-session assessment rules, and maintain platform integrity.

Assessment recordings and proctoring

When proctoring is enabled for an assessment, Merge may record camera snapshots, microphone audio, screen-share images, and related session events during the assessment window. Recordings are stored securely and made available only to authorized users within the hiring organization that issued the invite. Candidates are notified during the pre-assessment setup flow before recording begins.

Merge does not use candidate recordings for advertising, model training, or any purpose outside delivering the assessment experience to the hiring company that invited the candidate. Recordings and other proctoring artifacts exist so that company can review the assessment fairly; they are not a permanent archive held by Merge for its own use.

Sharing and integrations

We share information only as needed to operate Merge, including with infrastructure providers, email delivery services, authentication providers, storage providers, and ATS integrations configured by your organization. We do not sell personal information.

Data retention and deletion

We retain data only for as long as needed to provide the service, support the hiring company that created the invite, meet contractual obligations, resolve disputes, and comply with legal requirements.

Candidate assessment data. Responses, scores, reports, and related assessment artifacts are kept so the hiring organization can evaluate candidates. They are not retained by Merge for unrelated purposes after the company no longer needs them.

Proctoring recordings and session evidence. Camera snapshots, audio clips, screen-share captures, and similar recordings are stored only for the hiring company to review as part of that assessment. Merge clears this material after the applicable retention period or when the customer deletes the underlying invite or assessment data, unless a longer period is required by law or an active contractual hold.

Technical logs. Short-lived diagnostic and security logs may be kept for a limited period to operate and protect the platform, then rotated or deleted.

Customers may request deletion of company or candidate data subject to applicable law and active contractual terms. Candidates who want their data removed should contact the hiring organization that invited them; that organization can request deletion through Merge on the candidate's behalf.

Security

Merge uses access controls, encrypted transport, scoped storage keys, and audit logging to protect personal data. No method of transmission or storage is completely secure, but we work to safeguard information using commercially reasonable measures.

Your choices and rights

Depending on your location, you may have rights to access, correct, delete, or restrict processing of your personal information. Candidates should contact the hiring organization that invited them. Company administrators may contact Merge at hello@mergeoa.com.

Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated effective date.

Effective date: July 5, 2026