OceanMerge · DRAFT for legal review

Privacy notice

Last updated 12 November 2026

This notice explains how OceanMerge collects, uses, shares and stores personal data when you use the OceanMerge Capital Readiness Index and the OceanMerge Capital Readiness Report.

Who we are

OceanMerge is operated by Ryan Babbage, a sole trader based in Victoria, Australia (ABN 40 844 930 305). In this notice, “OceanMerge”, “we”, “us” and “our” mean Ryan Babbage trading as OceanMerge. We decide how and why your personal data is used, so we are responsible for it (in some laws, the “controller”). For any question about this notice or your personal data, email contact@oceanmerge.ae.

The service

The OceanMerge Capital Readiness Index is a free self-assessment of how ready a company is to raise capital. You may optionally buy the OceanMerge Capital Readiness Report (US$249.99 for startups, US$499 for mid-market companies), which includes a deeper questionnaire. The report is unlocked instantly in your browser after payment. We do not email the report to you.

What we collect

Information you give us. Company name; your name, work email and role; your organisation profile (for example sector, stage, incorporation, headquarters, markets, revenue and growth bands, headcount, ownership, prior funding, the amount, type and timing of the capital you are seeking and, if you choose to give them, the exact amount and valuation you expect); your answers to the Index questions and, if you buy the report, the deep-dive questions; and whether you opted in to be contacted.

Your answers may describe confidential commercial and financial matters. We treat them as confidential and use them only as this notice describes.

Marketing source. If present in the link you used: utm_source, utm_medium and utm_campaign.

Payment information. Stripe collects your card details on its own systems. We receive a payment reference, the amount, the currency and the payment status. We never see or store your full card number.

Technical information. Our hosting provider processes technical information such as IP address, browser type and request details to deliver and protect the website.

Please do not include sensitive personal information (for example, about health) or information you are not authorised to share.

Cookies and local storage

This service sets one essential cookie, rc_sid (HttpOnly, SameSite=Lax, 24 hours), which protects forms against cross-site request forgery. Your questionnaire progress and any marketing source tags are saved in this browser tab using sessionStorage, which is not a cookie, and are sent to us only when you submit. Stripe’s hosted checkout may set its own cookies on stripe.com. We keep anonymous daily totals of page views, starts, completions and payments, with no personal identifiers.

How we use your information, and why

• To calculate your Index score and, if you buy it, produce your Capital Readiness Report (to provide the service you asked for).
• To take payment, process refunds and prevent fraud (to perform our contract with you).
• To follow up with you about OceanMerge’s capital readiness services and diagnostic call, as described below (your consent, or our legitimate interest in following up with customers about a product they bought).
• To understand which marketing sources bring people to the Index, and to keep the service secure (our legitimate interests).
• To meet legal, tax and accounting obligations (legal obligation).

We do not sell your personal data. Your score is calculated automatically from your answers; it is general information only and is not used to make decisions that have legal or similarly significant effects on you.

Follow-up contact and investor introductions

If you buy the report, or tick the optional contact box and your score meets our qualification threshold, we store a short record (company, your email and role, track, score, band, red-flag count, paid or free status and marketing source) in our internal customer records system, the Command Centre, and we may email you about our services. If you neither tick the box nor buy the report, we will not contact you for marketing. You can opt out at any time by emailing contact@oceanmerge.ae.

We never share your answers, report or contact details with any investor or third party without your express, specific consent. If we later discuss an introduction with you, we will tell you exactly what would be shared and with whom first.

Who we share it with

• Cloudflare: website hosting, security and our database (stored in Western Europe).
• Stripe: payment processing; for some purposes Stripe acts independently under its own privacy policy (stripe.com/privacy).
• Our access-restricted Command Centre.

We may also disclose information where the law requires it, or to professional advisers bound by confidentiality.

International transfers

OceanMerge is based in Australia. Your data is stored in Western Europe and may be processed in the United States and other countries by our service providers, which may not have the same data-protection laws as your country. Where the law requires, we rely on appropriate safeguards such as standard contractual clauses.

How long we keep it

• Index records without a purchase: 24 months, then deleted or anonymised.
• Your report stays available through your unique link for 24 months after purchase.
• Purchase, payment and refund records: 5 years, to meet Australian tax record-keeping requirements.
• Command Centre records: until you opt out, or 24 months after our last contact, whichever comes first.

How we protect it

Encrypted (HTTPS) connections, card details handled only by Stripe, and access limited to people who need it. Your report opens by a unique link: anyone with the link can open it, so keep it private, and email contact@oceanmerge.ae if you think it has been shared by mistake.

Your rights

Depending on where you live, you may have rights under laws such as the Australian Privacy Act 1988 (Cth), the EU or UK GDPR, the UAE Personal Data Protection Law, Saudi Arabia’s Personal Data Protection Law and Qatar’s Personal Data Privacy Protection Law, including to access, correct or delete your data, object to marketing, receive a portable copy and withdraw consent. Email contact@oceanmerge.ae; we will respond within one month. You can also complain to the Office of the Australian Information Commissioner (oaic.gov.au) or your local data-protection authority.

This notice describes our practices. It is not a claim of certification or audited compliance under any data-protection law.

Changes

We may update this notice. The dated version on this page is the current one.

See also: Privacy notice · Terms of use · Refund policy.