This policy explains what personal information Melbarrel collects, why we collect it, who we share it with and what you can do about it. It applies to melbarrel.com and to the Melbarrel platform.

1. Two different roles

Melbarrel handles personal information in two distinct roles, and your rights differ depending on which one applies:

As the controller — for the information we collect about our own users and visitors: your account details, billing records, support messages and website analytics.
As a processor (service provider) — for the information a business customer puts into their own workspace: their clients, appointments, invoices, documents, staff records and similar. That business decides what to collect and how long to keep it. We process it only on their instructions. If you are a client of a business that uses Melbarrel, please contact that business first; we will refer your request to them.

2. Information we collect

Account information — name, email address, phone number, company name, role and a securely hashed password.
Billing information — plan, subscription status, invoices and payment history. Card numbers are entered directly into Stripe and are never stored on our servers.
Workspace content — everything you or your team enter into the platform: customer records, bookings, quotes, invoices, files, signatures and module specific records.
Technical information — IP address, browser and device type, pages viewed, timestamps, error reports and sign in events. Sign in events are recorded so that account owners can review access to their data.
Enquiries — if you submit a form on melbarrel.com we keep the name, email, company, message and the IP address the form was sent from, so that we can answer you and detect automated abuse.

3. Why we use it

To provide, secure and support the service.
To create accounts, authenticate users and enforce permissions.
To take payment and issue invoices.
To send service messages: confirmations, reminders, security notices and changes to this policy.
To detect, investigate and prevent fraud, abuse and security incidents.
To meet legal and accounting obligations.
To answer sales and support enquiries.

We do not sell personal information, and we do not use workspace content to build advertising profiles.

4. Artificial intelligence features

Melbarrel includes an assistant, Melbear, and other optional AI features. When you use them, the text or images you supply — together with the specific records needed to answer your request — are sent to our AI providers, Anthropic and OpenAI, so that a response can be generated. Requests and responses are logged in your workspace so that account owners can audit what the assistant was asked and what it did.

AI features are optional. If you do not use them, no workspace content is sent to an AI provider. AI output can be wrong; it is a draft for a human to check, not professional advice.

5. Sensitive information

Some industry modules are designed to hold sensitive records — for example health notes in clinic and dental modules, immigration documents, or legal case files. Where a business customer uses those modules, that business remains responsible for the lawful collection of the records and for obtaining any consent required, including under health privacy legislation. We process such records only to run the service for that business.

6. Who we share it with

We share personal information only with service providers who help us run the platform, and only as far as they need it:

Hosting and infrastructure — to run the application and store data.
Stripe — to take card payments and manage subscriptions.
Email delivery — to send service messages. A business customer may configure their own mail server, in which case their messages are sent through it rather than ours.
Anthropic and OpenAI — for AI features, as described above.
Let's Encrypt — to issue TLS certificates when you connect your own domain. This involves your domain name, not personal data.

We may also disclose information where the law requires it, or to establish or defend a legal claim. If Melbarrel is ever involved in a merger or acquisition, personal information may be transferred as part of that transaction; we will give notice before it becomes subject to a different policy.

7. Where your information is processed

Melbarrel is operated from Canada. Our service providers may process information in other countries, including the United States. Where information crosses a border it remains protected by contractual commitments with those providers and by this policy.

8. How long we keep it

Workspace content is kept while the account is active. After an account is closed we keep it for a limited grace period so that it can be restored on request, then delete it.
Billing and tax records are kept for as long as accounting law requires.
Security and sign in logs are kept for a limited period and then removed.
Enquiry messages are kept while we are in contact and for a reasonable period afterwards.

A business customer can ask us to delete their workspace at any time.

9. Security

Access to the platform requires authentication, and permissions limit what each user can see. Data in transit is encrypted with TLS. Passwords are stored as one way hashes and are never readable by us. Access to production systems is restricted to the people who need it. No system can be guaranteed to be perfectly secure, but we work to keep the risk low and to notify affected people promptly if a breach occurs.

10. Cookies and local storage

We use only what is necessary to run the site: your browser stores a sign in token so that you stay signed in, and a small amount of interface state such as your theme preference. We do not use advertising or cross site tracking cookies.

11. Your rights

You can ask us to give you a copy of the personal information we hold about you, to correct it, or to delete it. You can also withdraw consent where we rely on it, and object to a particular use. Write to us at the address below and we will answer within the time the law allows. If you are not satisfied with our answer you may complain to your data protection authority; in Canada that is the Office of the Privacy Commissioner.

12. Children

Melbarrel is a business tool and is not directed at children. Some modules — for example childcare and school modules — hold records about children on behalf of a business customer. Those records are entered by that business, which is responsible for the consent of the parent or guardian.

13. Changes

If we change this policy we will update the date at the top of this page, and we will notify account owners by email before a material change takes effect.

14. Contact

Questions about this policy, or a request about your information: privacy@melbarrel.com.

Privacy Policy