56 Total

Key Facts · in the document’s own words

Does Mercury rely on AI alone to make decisions that could have legal consequences, financial implications, or otherwise materially affect users' rights or access to services?
“we do not rely on it alone to make decisions that could have legal consequences, financial implications, or otherwise materially affect your rights or access to our services. Such decisions always involve appropriate human oversight.”
Version CA-V-006797, captured Sept. 11, 2026 · live source ↗
Our reading, not the document’s words
Mercury states that it does not rely on AI alone to make decisions that could have legal consequences, financial implications, or otherwise materially affect users' rights or access to services, and that such decisions always involve appropriate human oversight.
Under certain U.S. privacy laws, what may Mercury's use of advertising cookies and similar technologies be considered even though Mercury does not exchange user information for money?
“Under certain U.S. privacy laws, the use of these technologies may be considered "sharing" or a "sale" of Personal Information, even though we do not exchange your information for money.”
Version CA-V-006797, captured Sept. 11, 2026 · live source ↗
Our reading, not the document’s words
Mercury states that under certain U.S. privacy laws, its use of advertising cookies and similar technologies may be considered 'sharing' or a 'sale' of Personal Information even though Mercury does not exchange user information for money.
What biometric information does Mercury collect?
“Biometric information, such as voiceprint, facial scan, and biometrics extracted from a photograph or image.”
Version CA-V-006797, captured Sept. 11, 2026 · live source ↗
Our reading, not the document’s words
Mercury collects biometric information, including voiceprint, facial scan, and biometrics extracted from a photograph or image, for identity purposes.
Who is responsible for ensuring a lawful basis to provide Personal Information to Mercury?
“the business customer is responsible for ensuring it has a lawful basis to provide Personal Information to Mercury.”
Version CA-V-006797, captured Sept. 11, 2026 · live source ↗
Our reading, not the document’s words
Mercury requires that the business customer is responsible for ensuring it has a lawful basis to provide Personal Information to Mercury.
To whom does Mercury disclose Personal Information as part of any reorganization, merger, sale, joint venture, assignment, or transfer?
“Parties involved in a corporate transaction, such as a potential or actual acquirer, successor, or assignee as part of any reorganization, merger, sale, joint venture, assignment, transfer...”
Version CA-V-006797, captured Sept. 11, 2026 · live source ↗
Our reading, not the document’s words
Mercury discloses Personal Information to parties involved in a corporate transaction, such as a potential or actual acquirer, successor, or assignee, as part of any reorganization, merger, sale, joint venture, assignment, or transfer.
What does Mercury rely on for transfers of Personal Information from the European Economic Area or United Kingdom?
“for transfers from the European Economic Area or United Kingdom, we rely on approved contractual protections (such as Standard Contractual Clauses) and additional technical and organizational safeguards...”
Version CA-V-006797, captured Sept. 11, 2026 · live source ↗
Our reading, not the document’s words
Mercury relies on approved contractual protections, such as Standard Contractual Clauses, and additional technical and organizational safeguards for transfers of Personal Information from the European Economic Area or United Kingdom.
Stay ahead of the changes
Track Mercury and hear on the next check after its terms change. We check daily where we can, and show you where we can't.
Summary
Generated by a model from the captured document; not read by a person

Mercury's Privacy Policy explains what personal data Mercury collects—including biometric data like facial scans and voiceprints—how it is used, and with whom it may be shared, including in corporate transactions such as mergers. Mercury does not sell your Personal Information for money, but its use of advertising cookies may legally count as a 'sale' or 'sharing' under certain U.S. privacy laws, giving you the right to opt out by clicking 'Your Privacy Choices' or enabling GPC. Mercury also states it never uses AI alone for decisions that could materially affect your legal or financial standing.

Analysis

This Privacy Policy establishes Mercury's practices for collecting, using, retaining, and sharing Personal Information, including sensitive categories such as biometric data. It sets a human-oversight requirement for consequential AI-assisted decisions and limits Mercury AI output from serving as a substitute for professional legal, financial, or tax advice. Data retention is governed by a necessity standard subject to extension under applicable financial-sector regulatory obligations. Cross-border transfers from the EEA and UK are covered by Standard Contractual Clauses and additional technical and organizational safeguards, and business customers bear responsibility for ensuring a lawful basis before providing Personal Information to Mercury.

What this means for you

Mercury collects highly sensitive personal data, including biometrics, and may share Personal Information with potential or actual acquirers in corporate transactions. Its use of advertising cookies may qualify as a 'sale' or 'sharing' of your Personal Information under applicable U.S. privacy law. If that right applies to you, you can exercise it by clicking the 'Your Privacy Choices' link on Mercury's platform or by enabling the Global Privacy Control (GPC) in your browser. Mercury also commits that any AI-assisted decision with legal or financial consequences for you will always include appropriate human oversight.

Institutional Analysis
Stay ahead of the changes

Institutional analysis available with Insight

Which mapped governance frameworks each document engages, tied to the specific provisions that engage them.

3 important changes detected

9 versions captured · Latest change detected by ConductAtlas: August 2026

What changed Mercury expanded its privacy policy to clarify how it collects and processes personal information for business customers and their connected individuals. The updated terms now explicitly describe collection of investment profile information, demographic data (citizenship status, sex assigned at birth), and information about dependents and payment beneficiaries. Mercury also clarified that it may collect personal information directly from contractors and payment recipients at a business's direction, and added detail about how it uses this information for payroll, benefits, and payment processing. The policy now distinguishes between transactional SMS messages (which remain opt-in) and marketing SMS messages (which require separate consent), and clarified that phone numbers used for marketing SMS will not be shared with third parties for their own advertising purposes.
Why this matters The updated policy expands the categories of personal information Mercury collects and processes for business customers. Mercury now explicitly collects investment profile information, demographic data (citizenship status, sex assigned at birth), and information about dependents and payment beneficiaries. For business customers, Mercury may collect personal information directly from contractors, payment recipients, and other connected individuals at the business's direction to support payroll, benefits, and payment processing. The policy also clarifies that marketing SMS messages require separate consent from transactional messages, and that phone numbers will not be shared with third parties for their own advertising purposes. You can opt out of marketing SMS messages without affecting receipt of transactional messages.
View full change record →
What changed Mercury's privacy policy cookie disclosure table now includes a new cookie from OpenAI marked for advertising and data sale purposes. The updated table adds the __oppref cookie provided by OpenAI to the list of tracking cookies Mercury uses, categorizing it under Advertising and SaleOfInfo alongside cookies from Facebook, Google, LinkedIn, and other advertising partners.
Why this matters The updated privacy policy discloses that Mercury now uses a cookie provided by OpenAI for advertising and data sale purposes. This cookie is added to Mercury's existing disclosure of third-party tracking cookies used for advertising and analytics. The change clarifies Mercury's data-sharing practices with OpenAI but does not establish new collection mechanisms beyond what was already disclosed for advertising partners.
View full change record →

June 19, 2026 medium

Mercury added a new section to its privacy policy disclosing SMS and MMS messaging practices. The updated policy states that Mercury may send SMS and MMS messages to users who …

View change record →
Clauses withheld

We withheld clauses we had published from this document. Each withholding is recorded in our correction log:

Featured provisions
Generated by a model from the captured document; not read by a person

Complete Provision Index

Every distinct legal provision identified in this document. Featured provisions appear above with analysis.

56 provisions
11 featured
13 clause types
Disclosure and Transparency Requirements 1
Restricted or Prohibited Content/Industries 1
Stay ahead of the changes

Monitoring

Mercury has updated this document before. Monitor includes alerts from a daily check, structured change summaries, and monitoring for up to 20 platforms.

Stay ahead of the changes

Governance Intelligence

Need provision-level monitoring and regulatory mapping? Insight includes governance timelines, drift analysis, and full provision tracking.

Cross-platform context

See how other platforms handle Advertising cookies may constitute sale or sharing and similar clauses.

Compare across platforms →
Archival ProvenanceSource & Archival Record
This version captured September 11, 2026 01:01 UTC
Last successful capture October 21, 2026 00:51 UTC
Date stated by the document August 27, 2026 (as printed in this version)
Capture Method Automated scheduled archival capture
Document ID CA-D-000530
Version ID CA-V-006797
SHA-256 (extracted text, extractor v5) b600d8d283bff143386b57d3c729015c070bf6a9cc0627377eeec6b6691597b3
Archived bytes SHA-256 (anchor) 1442dc15e797d766b05aa6ee5f8ca77d939db58f68c099e42abcb6c656b4f480
✓ Snapshot stored ✓ Archived bytes anchored (verified Sept. 11, 2026)

Governance Monitoring

Monitor governance changes across the platforms you rely on.

Structured alerts for policy changes, governance events, and provision updates across 343 platforms.

Start monitoring → Compare plans