Privacy Policy

This Privacy Policy explains how MerchUp ("MerchUp", "we", "us", or "our") collects, uses, and protects your personal data when you use our platform.

We are committed to protecting your privacy and complying with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR), the EU GDPR (where applicable), and the Privacy and Electronic Communications Regulations (PECR).

For the terms that govern use of MerchUp, see our Terms of Service.

1. Who We Are

MerchUp is a software-as-a-service platform providing AI-powered tools for product content creation, editing, and management.

For the purposes of data protection law:

• MerchUp acts as a data controller for your account and usage data.
• MerchUp may act as a data processor when handling store or business data on your behalf.

2. Information We Collect

We collect the following categories of personal data:

Account Information

• Name
• Email address
• Account credentials

Store & Business Information

• Store name
• Store URL
• Platform connection details (e.g. Shopify)
• Product data and business content processed through the platform

Usage & Activity Data

• Actions taken within the platform
• Content generated, edited, or processed using AI
• Feature usage and interaction data
• Account activity logs

Technical & Location Data

• IP address
• Approximate geographic location (derived from IP)
• Device type, browser, and operating system

Tracking & Behavioural Data

• Session activity (pages viewed, time spent, interactions)
• Navigation patterns and feature usage
• Real-time usage monitoring (e.g. visibility of active users within internal admin dashboards)

Communications Data

• Messages sent to support
• Account-related communications

3. How We Use Your Data

We use your data to:

• Provide, operate, and maintain the MerchUp platform
• Generate and manage AI-powered product content
• Enable integrations with third-party platforms (e.g. Shopify)
• Improve functionality, performance, and user experience
• Monitor usage for security, fraud prevention, and abuse detection
• Provide customer support and respond to enquiries
• Analyse usage trends and behaviour to improve the service

We do not use your identifiable content for marketing without your explicit consent.

4. Legal Basis for Processing

Under UK GDPR / EU GDPR, we rely on:

• Contractual necessity - to deliver the service you signed up for
• Legitimate interests - to improve, secure, and optimise the platform
• Legal obligations - where required (e.g. compliance, fraud prevention)
• Consent - for cookies, tracking technologies, and optional communications

We ensure that our legitimate interests do not override your rights and freedoms.

5. Cookies and Tracking Technologies

We use cookies and similar technologies to maintain authentication and login sessions, analyse platform performance and usage, improve user experience and features, and support analytics and marketing (where applicable). Full details are provided in our Cookie Policy.

Where required by law:

• Non-essential cookies are only used with your consent.
• You can accept, reject, or manage preferences via our cookie banner.

6. Third-Party Integrations (e.g. Shopify)

If you connect your store:

• We access and process store data necessary to provide our services.
• We act as a data processor for certain store-related data.
• You are responsible for ensuring you have the right to share that data.

We do not control third-party platforms and are not responsible for their data handling practices.

7. Data Sharing

We do not sell your personal data.

We may share data with:

• Hosting and cloud infrastructure providers
• Analytics and performance tools
• Payment processors
• Third-party platforms (e.g. Shopify)
• Legal authorities where required

All third-party providers are required to process data securely and in accordance with applicable laws.

8. Data Retention

We retain personal data only as long as necessary to:

• Provide the service
• Fulfil contractual obligations
• Comply with legal requirements
• Resolve disputes and enforce agreements

We may retain limited data after account deletion where required or justified.

9. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• Secure data storage
• Access controls
• Monitoring and protection systems

However, no system is completely secure, and we cannot guarantee absolute security.

10. International Data Transfers

Your data may be processed outside your country, including in countries without equivalent data protection laws.

Where required, we implement safeguards such as:

• Standard contractual clauses
• Secure data handling agreements

11. Automated Processing and AI

MerchUp uses automated systems and AI to process content.

You acknowledge that:

• Processing may be automated.
• Outputs may vary and are not guaranteed.
• Decisions based on AI outputs remain your responsibility.

We do not make legally binding automated decisions about users.

12. Your Rights (UK & EU Users)

You have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion
• Restrict or object to processing
• Request data portability

To exercise your rights, contact us via our support page.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) or your local authority.

13. Marketing and Communications

We may send service-related communications.

We will only send marketing communications where:

• You have consented, or
• It is permitted under applicable law

You can opt out of marketing at any time.

14. Children's Data

MerchUp is not intended for individuals under 18.

We do not knowingly collect personal data from children.

15. Changes to This Policy

We may update this Privacy Policy from time to time.

Where required, we will notify users of material changes.

Continued use of the platform constitutes acceptance.

16. Contact

If you have any questions about this Privacy Policy or your data, please contact us via our support page.