Change record
CA-X-004689
Mercury Privacy Policy
Entity
Date detected
August 28, 2026
Severity
Direction
Neutral
Taxonomy
Data collection expansion
Changes
+9 sentences added · 10 sentences modified

Impact Summary

Generated by a model from the captured document; not read by a person
Medium Neutral for users
Affected users
Business accounts All users Employees Contractors Payment recipients

Mercury expanded its privacy policy to clarify how it collects and processes personal information for business customers and their connected individuals. The updated terms now explicitly describe collection of investment profile information, demographic data (citizenship status, sex assigned at birth), and information about dependents and payment beneficiaries. Mercury also clarified that it may collect personal information directly from contractors and payment recipients at a business's direction, and added detail about how it uses this information for payroll, benefits, and payment processing. The policy now distinguishes between transactional SMS messages (which remain opt-in) and marketing SMS messages (which require separate consent), and clarified that phone numbers used for marketing SMS will not be shared with third parties for their own advertising purposes.

2 new obligations 1 obligation expanded

Businesses: If you use Mercury for payroll or payments, Mercury may collect personal information directly from your employees, contractors, and payment recipients to process those transactions.

Businesses: Mercury now discloses that it collects investment profile information and demographic data as part of its business customer services.

Consumers: If you receive SMS from Mercury, you can opt out of marketing messages without losing transactional messages like receipts.

Stay ahead of the changes
Track Mercury and hear on the next check after its terms change. We check daily where we can, and show you where we can't.
Share 𝕏 Share in Share 🔒 PDF

What this means for you

Generated by a model from the captured document; not read by a person

The updated policy expands the categories of personal information Mercury collects and processes for business customers. Mercury now explicitly collects investment profile information, demographic data (citizenship status, sex assigned at birth), and information about dependents and payment beneficiaries. For business customers, Mercury may collect personal information directly from contractors, payment recipients, and other connected individuals at the business's direction to support payroll, benefits, and payment processing. The policy also clarifies that marketing SMS messages require separate consent from transactional messages, and that phone numbers will not be shared with third parties for their own advertising purposes. You can opt out of marketing SMS messages without affecting receipt of transactional messages.

What you can do

→ Review Mercury's updated privacy policy if you are a business customer using Mercury for payroll, benefits, or contractor payments.

→ If you receive SMS from Mercury, you can opt out of marketing messages by following the opt-out instructions in the SMS; opting out of marketing messages will not affect receipt of transactional messages.

Historical Context

ConductAtlas has recorded 2 material changes to this document over 70 days of monitoring (since June 2026). An additional minor or cosmetic changes were excluded.

Across all monitored documents, Mercury has made 3 significant changes.

Key Clauses Affected

Generated by a model from the captured document; not read by a person
Personal information collection for business customers

Mercury now explicitly authorizes collection of personal information about employees, contractors, payment beneficiaries, and dependents directly from those individuals at the business's direction.

Demographic and investment profile data collection

Policy now explicitly discloses collection of investment profile information and demographic data (citizenship status, sex assigned at birth) for business customers.

SMS consent structure

Marketing SMS messages now require separate consent from transactional messages; opting out of marketing SMS does not affect transactional messages.

Full clause-by-clause analysis available with Insight.
ⓘ

This change record describes what was added, removed, or modified in the document. Analysis reflects what the updated agreement states or permits. It does not constitute a legal determination about enforceability. Applicability may vary by jurisdiction. Methodology

Evidence Verification

✓ Verified
Previous Version
6ef082fa557ca6798062f7cd34aaaeb30d7f30b01d405b1b12eb1809ffb1f375
August 22, 2026 00:59 UTC
✓ Verified
Current Version
a2cec828f89904ebe5e517004740b9e1df7d52ba8d783e5b82018c82a671e782
August 28, 2026 01:00 UTC
✓ Verified
Change Detected
August 28, 2026 01:00 UTC
✓
Analysis Methodology
✓ Verified
Source Document
https://mercury.com/legal/privacy
Record history

Wording edits to this record that do not change what it claims. Changes to a claim are published as corrections.

2026-10-11 · Feed summary edited · summary regenerated by summarize_events
Previous text
Expanded data collection practices for business accounts to include contractors, payment beneficiaries, and employees; clarified SMS consent structure separating transactional from marketing messages.
2026-10-11 · Impact summary edited · summary regenerated by summarize_events
Previous text
The updated policy states that Mercury may now collect personal information directly from employees, contractors, payment beneficiaries, and dependents at a business's direction, without requiring those individuals' direct consent to Mercury. This expands the pool of individuals whose data Mercury processes beyond those who directly use the service. Additionally, the revised SMS terms separate transactional messages (receipts, confirmations) from marketing messages, requiring separate consent for marketing SMS. You can manage marketing SMS consent independently from transactional message receipt.
2026-10-11 · Summary edited · summary regenerated by summarize_events
Previous text
Mercury's privacy policy was updated to expand the types of personal information the company collects and processes, particularly for business customers and their connected individuals. New language clarifies that Mercury may collect data directly from payment recipients, contractors, and other third parties at a business's direction, and adds specific examples of payment and payroll processing purposes. The policy also modifies SMS messaging consent terms to distinguish between transactional and marketing messages, and removes 'affiliates' from a previous restriction on sharing mobile opt-in data.
2026-10-07 · Change line edited · change line rewritten to the 2026-10-07 template: no detection date, no sentence counts
Previous text
Mercury updated their Mercury Privacy Policy on August 28, 2026. Change detected: 9 sentence(s) added, 10 sentence(s) modified. Document contained 193 sentences after update.
Citation Record
Entity: Mercury
Document: Mercury Privacy Policy
Record ID: CA-X-004689
Version: CA-V-006180
Captured: 2026-08-28 01:00:50 UTC
URL: https://conductatlas.com/change/2026-08-28-mercury-mercury-privacy-policy-4689/
Accessed: Oct. 17, 2026
Permanent archival reference. Stable identifier suitable for legal filings, compliance documentation, and research citation.
For legal and compliance teams

Institutional Analysis

Generated by a model from the captured document; not read by a person
Assessment

Mercury's updated privacy policy materially expands the scope of personal data collection and processing for business customers. The policy now explicitly authorizes collection of investment profile information, demographic data, and information about dependents and payment …

🔒 Full institutional analysis

Regulatory exposure, obligation change, escalation trigger, board-ready language, and recommended action for legal and compliance teams.

Unlock the full institutional analysis — Insight

ConductAtlas provides verified policy intelligence sourced directly from platform documents. All analysis is intended to support, not replace, legal and compliance review. Record CA-X-004689.

Full Changes

View complete diff →

Document Context

Version history → Policy drift analysis → Document page →
Document
Mercury Privacy Policy
Entity
Mercury
Captured
August 28, 2026
Source URL
https://mercury.com/legal/privacy
Other changes to Mercury Privacy Policy
Previous change Aug 19, 2026
Mercury's privacy policy cookie disclosure table now includes a new cookie from OpenAI marked for advertising and data sale purposes. …
Low Neutral
View full version history →
More from Mercury
Oct 6, 2026 Low
Mercury Terms of Service

Mercury updated its Terms of Service to October 5, 2026 and added a new section on third-party AI connections. The …

Sep 25, 2026 Medium
Mercury Terms of Service

Mercury revised its promotional offers section to clarify that third-party partners may change or discontinue perks at any time, even …

Aug 19, 2026 Low
Mercury Privacy Policy

Mercury's privacy policy cookie disclosure table now includes a new cookie from OpenAI marked for advertising and data sale purposes. …

Get the weekly coverage letter

Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.

Stay ahead of the changes

Track Mercury policy changes

Get alerted when this policy changes again, including what changed and why it matters.

All Mercury changes →