Privacy Policy
MERGEguard by TLB Cloud · Last updated October 15, 2026
MERGEguard helps law firms identify and merge duplicate contacts in Clio. This policy explains what data we collect, how we use it, and how we protect it. We keep things simple. Only what's needed to run the service.
What we collect
| Data | What we collect |
|---|---|
| Account information | Your name, email address, phone number, firm name, and firm address, provided at signup. |
| Authentication data | Passkeys, hashed passwords, and any MFA methods you configure (authenticator app, SMS, or email). |
| Session and security data | Active sessions, trusted devices, login attempt records, and a log of security events on your account, used to protect it. |
| Team members | Names, email addresses, and roles of the people your firm's admin invites, and who invited them. |
| Clio data | Contact records and the records linked to them (such as matters, bills, communications, notes, and documents), accessed via your Clio account, used to detect and merge duplicates. |
How we use it
- •Authenticate you and secure your account.
- •Connect to your Clio account and perform duplicate detection and merging on your behalf.
- •If you turn on name capitalization, change the capitalization of the names of the contacts kept in your merges, and keep each name's before and after so the change can be undone.
- •Maintain system security and prevent abuse.
We do not use your data for advertising, marketing, or any purpose other than running the service.
Data sharing
We do not sell your data or share it for marketing purposes. Data is processed by the sub-processors that operate the service: Vercel (hosting), Supabase (database and secrets vault), Anthropic (AI features), Google (address autocomplete at signup), Resend (email), Twilio (SMS), Stripe (payments), Inngest (background jobs), and Cloudflare (DNS, TLS, and bot protection). Each processes data strictly to operate the service under its own confidentiality and security commitments. The full table of what each sub-processor handles is on our Security page.
Artificial intelligence
MERGEguard uses Anthropic as an AI sub-processor for a small set of features, with strict limits on what is sent:
- •Match explanations and scan summaries send categorical match metadata only (which fields agreed or differed); no contact field values are sent.
- •The in-app support assistant sends the text you type in that chat; no Clio contact data is attached, and the chat itself carries no user or firm identity. If a conversation is escalated to support, a summary of it is generated by Anthropic and the transcript plus your contact details are emailed to us.
- •No customer data is used to train or calibrate models.
California residents
Under the California Consumer Privacy Act (CCPA), California residents have the right to know what personal information we collect, the right to request deletion of that information, the right to opt out of any sale of personal information (we do not sell data), and the right to non-discrimination for exercising these rights. To exercise these rights, contact info@tlbcloud.net.
SMS and MFA
If you enable SMS authentication:
- •Your phone number is used only to send one-time verification codes.
- •Messages are sent only when you log in or take a security action. Never for promotions.
- •Message frequency varies based on your activity.
- •Standard message and data rates from your carrier may apply.
Data retention
We retain different types of data for different periods based on operational and legal requirements.
| Data type | Retention period |
|---|---|
| Account and firm data | Until account deletion |
| Team membership and roles | Until the person is removed or the account is deleted |
| Invitations | Deleted 90 days after the invitation is used or expires |
| Session data | Expire after 30 days; deleted when you log out |
| Scan results, merge logs, and merge snapshots | Life of your account; deleted roughly 90 days after your engagement ends |
| Legal acceptances | Indefinite (compliance record) |
| Admin action logs | Indefinite (security record) |
| Account security events | 90 days |
| Login attempts | 90 days |
| Email logs | Indefinite (compliance record) |
| System error logs | Indefinite (operational record) |
You may request deletion of your account and associated data at any time by contacting info@tlbcloud.net. Deletion requests are processed within 30 days.
Security
We use encrypted authentication (passkeys, hashed passwords), secure session management, and access controls to protect your account. No system is perfectly secure, but we take reasonable precautions.
We log security events on your account, such as sign-ins, failed sign-ins, verification code checks, changes to your password, passkeys, or MFA, and changes to your firm's users and roles, along with your browser's user agent. IP addresses are stored only as salted hashes, never in raw form, and passwords and codes are never logged. These records are deleted after 90 days.
Your control
You can update or remove authentication methods (passkeys, MFA, password) from the security settings page at any time. You can disconnect your Clio account from Settings at any time. To delete your account, contact us.
Cookies
MERGEguard uses the following cookies to operate the service:
| Cookie | Purpose |
|---|---|
| auth_session | Keeps you logged in during your session. |
| mg_firm_id | Remembers which firm you’re working in. |
| mg_trusted_device | Skips MFA re-verification on devices you’ve chosen to trust (30-day expiry). |
| mg_pending_auth | Temporarily holds your Clio connection during signup (30-minute expiry, then deleted). |
| mg_contact_count | Holds your Clio contact count during signup for plan recommendation (a number only; 30-minute expiry, then deleted). |
| clio_oauth_state | Protects the Clio connection flow against cross-site request forgery (10-minute expiry). |
| clio_oauth_return | Remembers where to send you back after connecting Clio (10-minute expiry). |
| mg_why_signup_seen | Remembers that you've seen the sign-up explainer so it doesn't open again (30-day expiry). |
No third-party tracking, advertising, or analytics cookies are used.
Contact
Questions or requests: info@tlbcloud.net