Privacy Policy

Table of Contents

Effective date: October 26, 2026
Last updated: October 26, 2026

This Privacy Policy explains how Mercury Creative LLC ("Mercury Digital," "we," "us," or "our") collects, uses, and shares personal information. Mercury Digital is the AI services arm of Mercury Creative. This policy covers our website at https://mercury.digital (the "Site"), our business communications, including outreach emails, and our sales and marketing activities.

It does not cover data we process for clients during a paid engagement. That data is governed by the client's contract with us, including any data processing agreement (DPA). See "Client data in engagements" below.

1. Information we collect

Information you give us. When you request an AI Opportunity Audit, fill out a contact form, email us, or book a call, we collect:

  • Name
  • Work email address
  • Company name
  • Phone number
  • Your message and anything else you choose to share

Information collected automatically. When you visit the Site, we and our service providers collect:

  • Device and browser information, IP address, and approximate location (city/region)
  • Pages viewed, referring site, time on page, and similar usage data
  • Campaign information, such as UTM parameters in the link you clicked
  • Cookie and similar identifiers (see "Cookies and analytics")

Business contact information from third parties. We get professional contact information from business data providers (such as Apollo.io), public sources (such as company websites and professional networking profiles), and referrals. This may include name, job title, employer, business email, business phone, company details, and professional profile links. We use it to contact people about services that may be relevant to their business.

2. How we use information

We use personal information to:

  • Respond to your requests and schedule audits or calls
  • Provide, run, and improve the Site
  • Send business communications about our services, including B2B outreach emails
  • Understand how visitors find and use the Site, and measure our marketing
  • Manage our relationships with prospects and clients in our CRM
  • Protect the Site and our business, prevent fraud and abuse, and keep things secure
  • Comply with law and enforce our terms

We do not use personal information from the Site or our outreach to train AI models.

If you are in the European Economic Area or the United Kingdom, we rely on:

  • Legitimate interests: running and improving the Site, B2B marketing and outreach to business contacts, and security. We weigh these interests against your rights, and you can object at any time.
  • Contract: taking steps you request before entering into an agreement, such as scoping an audit.
  • Consent: non-essential cookies, where required. You can withdraw consent at any time.
  • Legal obligation: where the law requires us to keep or disclose information.

4. Cookies and analytics

We use cookies and similar technologies to operate the Site and understand how people use it.

  • Google Analytics (through Google Site Kit for WordPress) collects usage data so we can see how the Site performs. Learn more at https://policies.google.com/technologies/partner-sites. You can opt out with the Google Analytics Opt-out Browser Add-on: https://tools.google.com/dlpage/gaoptout.
  • CRM tools. We use or may use CRM and marketing tools (for example, HubSpot) that set cookies that help us recognize returning visitors, connect form submissions to site activity, and record campaign (UTM) information.

You can control or delete cookies in your browser settings. Blocking cookies may affect how parts of the Site work.

Do Not Track / Global Privacy Control. We do not currently respond to browser Do Not Track or Global Privacy Control signals. You can opt out by emailing us at joshua@mercury.one.

5. How we share information

We do not sell personal information for money. We share it only as follows:

  • Service providers (subprocessors) that help us run our business under contracts that limit their use of the data. These include cloud hosting and website providers, CRM and marketing automation, email delivery and outreach tools, scheduling tools, analytics providers, business data providers, and AI model providers.
  • Professional advisers such as lawyers and accountants.
  • Legal and safety reasons: to comply with law, respond to lawful requests, or protect rights, property, or safety.
  • Business transfers: in connection with a merger, acquisition, financing, or sale of assets.
  • With your direction or consent.

6. Client data in engagements

When we build automations or AI employees for a client, we may process data that belongs to the client or its customers. We handle that data only according to our agreement with the client, including any statement of work (SOW) and DPA. The client controls that data. If your information is in a client's systems, please contact that client first. We will help them respond.

7. Email outreach and how to opt out

We send business-to-business emails to professionals whose roles suggest our services may be relevant. We follow the U.S. CAN-SPAM Act and other laws that apply. Every marketing email we send:

  • Identifies us as the sender and includes our postal address
  • Uses accurate subject lines and header information
  • Includes a simple way to unsubscribe

To stop receiving our emails, click "unsubscribe" or reply "unsubscribe" to any message, or email joshua@mercury.one. We process opt-outs promptly, and within 10 business days. We keep a suppression list so we don't contact you again. We may still send non-marketing messages about an active engagement.

8. Data retention

We keep personal information only as long as we need it for the purposes above. This includes keeping prospect records for an active sales cycle and client records for the length of the relationship plus a reasonable period for legal, tax, and accounting needs. We keep suppression (do-not-contact) records indefinitely so we can honor opt-outs. Inactive prospect records are deleted after 24 months.

9. Security

We use reasonable administrative, technical, and physical safeguards to protect personal information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

10. Your privacy rights

Depending on where you live, you may have the right to:

  • Know or access the personal information we have about you
  • Correct inaccurate information
  • Delete your information
  • Get a copy of your information in a portable format
  • Opt out of targeted advertising, "sharing," or "selling" of personal information
  • Object to or restrict certain processing (EU/UK)
  • Withdraw consent where we rely on it
  • Not be discriminated against for using these rights

California residents (CCPA/CPRA). In the past 12 months we have collected the categories listed in Section 1: identifiers (such as name, email, phone, IP address), professional or employment information, internet or other electronic activity, and approximate geolocation. We collect them from you, your device, and business data providers, for the purposes in Section 2, and we disclose them to the service providers in Section 5. We do not sell personal information for money. We do not knowingly sell or share the personal information of anyone under 16. Cookies used for analytics or advertising may count as "sharing" under California law. You can opt out by adjusting your browser settings or emailing us. We do not use sensitive personal information to infer characteristics about you.

EU/UK residents. You may also complain to your local data protection authority. Our main operations are in the United States, so your information will be transferred to and processed in the U.S. Where required, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses.

How to make a request. Email joshua@mercury.one with the subject "Privacy Request." We will need to verify your identity, usually by confirming your email address. You may use an authorized agent; we may ask for proof of their authority. We will respond within the time the law requires (generally 30–45 days).

11. Children

The Site is for businesses and is not directed to children under 16. We do not knowingly collect personal information from children. If you think a child has given us information, contact us and we will delete it.

The Site may link to sites we don't control. Their privacy practices are their own. Please review their policies.

13. Changes to this policy

We may update this policy from time to time. We will post the new version here and change the "Last updated" date. If changes are significant, we will give more prominent notice.

14. Contact us

Mercury Creative LLC, doing business as Mercury Digital
Email: joshua@mercury.one