Privacy Policy
Effective Date: January 1, 2026 • Last Updated: October 19, 2026
1. Introduction & Developer Attribution
Welcome to Merman Studio, an enterprise-grade cloud architecture diagramming canvas and visual engineering platform. This platform is engineered and developed by Renee Llup and operated by RLLLUP Software Solutions ("we", "our", or "us").
This Privacy Policy outlines the standards, procedures, and security controls governing the collection, utilization, and safeguarding of architectural blueprints, user account credentials, and platform telemetry across self-hosted and cloud deployments.
2. Intellectual Property & Diagram Data Ownership
You retain 100% full intellectual property rights, copyright, and exclusive ownership over all architectural diagrams, Mermaid.js code strings, system topology models, project configurations, and metadata created or stored within your workspaces.
3. Information We Collect
We collect only the essential information necessary to authenticate users, manage workspace collaboration, and deliver real-time diagram rendering:
Name, email address, profile avatar, and organizational affiliation provided via direct signup or authorized third-party OAuth providers (Google, GitHub).
Mermaid code definitions, layout presets, revision history snapshots, and workspace membership roles required for team collaboration.
4. Google Gemini AI Synthesis Standards
When utilizing AI-assisted features (AI Diagram Generator or Code-to-Diagram reverse engineering powered by Google Gemini), user prompts and structural architecture specifications are transmitted strictly for stateless, in-memory diagram synthesis.
Your data is not retained for training foundation AI models or public generative pipelines. Administrators can toggle or restrict AI processing globally at any time via Back Office settings.
5. Security & Administrative Controls
Merman Studio applies defense-in-depth security principles across infrastructure:
- Strict PostgreSQL Row Level Security (RLS) ensuring strict cross-organization tenant isolation.
- HTTP-only, secure SameSite cookie session management with SHA-256 code verifiers.
- Granular Role-Based Access Control (RBAC) across Owners, Lead Architects, Editors, Viewers, and Super Admins.
- Comprehensive immutable administrative audit logging of role grants, setting adjustments, and access events.
6. Legal Inquiries & Governance Contacts
For security inquiries, audit log requests, or questions regarding this Privacy Policy, please contact: