Privacy Policy

This Privacy Policy explains how MerchUp ("MerchUp", "we", "us", or "our") collects, uses, and protects your personal data when you use our platform, including when you install and use the MerchUp Ai app ("the App") in connection with your Shopify-supported store.

We are committed to protecting your privacy and complying with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR), the EU GDPR (where applicable), and the Privacy and Electronic Communications Regulations (PECR).

For the terms that govern use of MerchUp, see our Terms of Service.

1. Who We Are

MerchUp is a software-as-a-service platform providing AI-powered tools for product content creation, editing, and management. MerchUp is operated by Jamie Moss, a sole trader established in the United Kingdom, trading as MerchUp.

For the purposes of data protection law:

• MerchUp acts as a data controller for your account and usage data.
• MerchUp acts as a data processor when handling store or business data on your behalf.

You can contact us about this policy, or about any data protection matter, at support@merchup.ai. Our full postal address is given in section 20.

2. The App and Your Shopify Store

MerchUp Ai provides AI-generated and AI-assisted product content — descriptions, templates, tags, SEO metadata, image alt text, SEO analysis and automated SEO runs, and images — to merchants who use Shopify to power their stores.

When you install the App, you authorise it through Shopify's standard OAuth flow. Shopify issues us an access token for your store, which we store securely and use only to make API requests on your behalf. We record your store domain, store name, store URL, store logo, the store contact email supplied by Shopify, the permissions (scopes) you granted, and the dates on which the App was installed, re-authorised, and uninstalled.

Section 4 sets out exactly which categories of store data the App reads through the Shopify APIs, and what each is used for.

3. Information We Collect

Separately from the store data described in section 4, we collect the following categories of personal data directly from you and from your use of the platform:

Account Information

• Name
• Email address
• Account credentials

Store & Business Information

• Store name
• Store URL and store domain
• Store logo and store contact email, as provided by the connected platform
• Platform connection details (e.g. Shopify), including granted permissions
• Product data and business content processed through the platform

Usage & Activity Data

• Actions taken within the platform
• Content generated, edited, or processed using AI
• Feature usage and interaction data
• Account activity logs

Search & SEO Data

• Target keywords you set or that our tools suggest, and the products or pages they are assigned to
• Competitor website domains you add or that our tools identify from publicly available search results, together with publicly available data about those websites (such as the search terms they rank for)
• Search-ranking measurements and history for your store and its pages
• SEO scan and automated-run history, including generated drafts and before/after records
• Search performance data from Google Search Console, only where you choose to connect it (section 5)

Technical & Location Data

• IP address
• Approximate geographic location (derived from IP)
• Device type, browser, and operating system

Tracking & Behavioural Data

• Session activity (pages viewed, time spent, interactions)
• Navigation patterns and feature usage
• Real-time usage monitoring (e.g. visibility of active users within internal admin dashboards)

Billing Data

• Your plan, credit balance, and transaction history
• Charges made through the Shopify Billing API. Payment card details are handled by Shopify and are never collected or stored by MerchUp.

Communications Data

• Messages sent to support
• Account-related communications

4. Data We Access From Your Store

When you install the App, we become able to access the following types of information from your Shopify account, according to the permissions you grant at install time:

• Products (read and write) — product titles, descriptions, product types, vendors, tags, images and media, variants, SKUs, prices, collections, and metafields. Read to generate and edit content; written back only when you choose to publish changes to your store.
• Inventory (read and write) — inventory quantities and the locations they are held at, so that generated content and product updates stay consistent with stock.
• Files (read and write)— images and media in your store's Files area, used as source material for product imagery and content; written to only when publishing generated or template imagery to your store.
• Discounts and price rules (read) — discount and price-rule configuration, so that generated content can accurately reflect active offers.
• Shipping (read) — shipping zones and rates, so that generated content can accurately reference delivery information.
• Store content (read and write)— blog posts, articles, and pages, including the names of their authors and contributors. Read to match generated content to your store's existing voice and to analyse your pages' SEO; written back only when you choose to publish SEO metadata (page meta titles and descriptions) to your store.
• Published product listings (read) — publicly available product listings, used to render accurate previews of how content will appear.
• Customers, gift cards and store credit (read and write) — Buy & sell only— when you use Buy & sell to give a customer store credit or a gift card, or to let them spend theirs, we look up the customer in your store by the name or email you enter, create them if they do not exist yet, read their store credit and gift card balances, and add or take off credit. Shopify itself emails the customer their gift card or store credit. We keep only the customer's name or email on that sale or credit note, and the Shopify customer reference of credit they spent, so the record makes sense to you later; balances are read from Shopify each time and never stored.
• Orders (read)— for paid orders from the last 60 days onwards, online and Shopify POS: which products and variants sold, the quantity still sold after refunds, the price paid after discounts, the order's currency, whether it was online or in person, and when it was paid, refunded or cancelled. We use this only to record real sale prices for the trading cards you scanned with MerchUp, shown as “Last sold” and in price history. We do not read or keep the buyer's name, email, phone number or address, or anything about orders that sold no card you scanned.
• Shop and store owner details — your store name, domain, and the store contact email Shopify provides, used to identify your store and to contact you about your account.

Apart from the Buy & sell customer details described above, we do not store personal information about your customers. From your orders we keep only the sale facts of scanned cards described above (card, condition, price, currency, channel, and time), filed under an anonymous store reference rather than your store's name, and never anything about the buyer. We never use your customers' details for marketing, profiling, analytics or anything other than the credit you asked us to give or use, and we never sell them. Every time MerchUp reads or changes a customer's data, we record who did it, when, and what (without the customer's name or email). Any device or activity data we hold relates to people who use MerchUp itself, not to shoppers on your store.

How Your Store's Product Data Is Used

The product information we read from your store, and the products and scans you add in MerchUp, are used only to provide MerchUp to you, unless you choose to opt in to Help improve MerchUp(offered during setup and in Settings, off until you turn it on).

If you opt in, we may use your store's product information, including what you added before opting in, to improve MerchUp's shared product and card catalogue, product and card recognition, and MerchUp's AI; include your completed sale prices in pooled price figures that do not identify you; and keep a small copy of your product photos (the AI-edited version where you edit one) to show other MerchUp merchants as an example image when a product matches, which they may not use in their own store. This never includes your name, store name, customer details, or other information that identifies you or your customers. You can turn it off at any time in Settings: from then on nothing new from your store is shared, while what you had already shared stays part of MerchUp until you uninstall the app, delete your account, or ask us to delete your store's data (see section 11). We record when you opted in or out and the version of these terms you agreed to.

To recognise products when you scan them, MerchUp uses its own product and card catalogue, built mainly from publicly available, openly licensed data sources (such as published web product data and open book, encyclopaedic, and government product databases). It contains facts about products, such as barcodes, names, brands, and categories, and no information about you, your store, or your customers.

5. Google Search Console (Optional)

You can optionally connect your Google Search Console account to MerchUp to improve our SEO features with your store's real search performance data. If you do:

• You authorise us through Google's standard consent screen. Google issues us tokens for your account, which we store encrypted and use only to read Search Console data for the property you connect.
• We read search performance data for that property — the search queries your site appeared for, the pages of your site they led to, and the associated impressions, clicks, click-through rates, and average positions — and use it solely to provide and improve the SEO features in your account (for example, suggesting keywords your store already ranks for). Our access is read-only.
• We also receive the email address of the connected Google account (so we can show you which account is connected) and, during connection only, the list of Search Console properties on that account in order to find the one matching your store — only the matched property is stored.
• You can disconnect Google Search Console at any time from within MerchUp or by revoking access in your Google account settings. On disconnection we delete the stored tokens.

MerchUp's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer Google user data to third parties except as necessary to provide the features described above, do not use it for advertising, and do not allow humans to read it except with your consent, where necessary for security or compliance, or as required by law.

6. How We Use Your Data

We use your data to:

• Provide, operate, and maintain the MerchUp platform and the App
• Generate and manage AI-powered product content
• Provide SEO features — researching keywords, analysing competitors' public search presence, measuring your store's rankings, and generating SEO metadata and image alt text
• Enable integrations with third-party platforms (e.g. Shopify)
• Improve functionality, performance, and user experience
• Monitor usage for security, fraud prevention, and abuse detection
• Provide customer support and respond to enquiries
• Analyse usage trends and behaviour to improve the service
• Bill you for your plan and any credits or add-ons you purchase
• Send you information or offers relating to our products and services, where permitted

We do not use your identifiable content for marketing without your explicit consent, and we do not sell your personal data.

7. Legal Basis for Processing

Under UK GDPR / EU GDPR, we rely on:

• Contractual necessity - to deliver the service you signed up for
• Legitimate interests - to improve, secure, and optimise the platform
• Legal obligations - where required (e.g. compliance, fraud prevention)
• Consent - for cookies, tracking technologies, and optional communications

We ensure that our legitimate interests do not override your rights and freedoms.

8. Cookies and Tracking Technologies

We use cookies and similar technologies to maintain authentication and login sessions, analyse platform performance and usage, improve user experience and features, and support analytics and marketing (where applicable). Full details are provided in our Cookie Policy.

“Cookies” are data files placed on your device that often include an anonymous unique identifier. “Log files” record actions taken on the site and collect data including your IP address, browser type, internet service provider, referring and exit pages, and date and time stamps. “Web beacons”, “tags”, and “pixels” are electronic files used to record information about how you browse the site. For more information about cookies, and how to disable them, visit allaboutcookies.org.

Where required by law:

• Non-essential cookies are only used with your consent.
• You can accept, reject, or manage preferences via our cookie banner.

9. Data Sharing and Service Providers

We do not sell your personal data. We share data with the following service providers, who process it only on our instructions and only so far as is needed to run the service:

• Shopify — platform integration and billing, where you install the App from the Shopify App Store.
• Vercel — application hosting and content delivery.
• Supabase — database hosting, authentication, and file storage.
• xAI — AI models used to generate and edit product content, and to analyse your product images (which are shared with xAI by URL) in order to generate image alt text.
• OpenAI — AI models used for image generation and supporting content features.
• DataForSEO— search-data provider for our SEO features. We send it search terms (which may be derived from your product titles and keywords), your store's domain, and competitor domains, and receive publicly available search data (rankings, search volumes, and related metrics) in return.
• Google (Search Console API) — where you choose to connect Google Search Console, as described in section 5.
• Resend — delivery of transactional and account-related email.
• Fastmail — receipt and handling of inbound support email.
• Google Analytics and Ahrefs Analytics — website analytics, loaded subject to your cookie consent.
• IP geolocation providers — resolving an approximate location from an IP address, so that pricing and currency can be shown correctly.

All service providers are required to process data securely and in accordance with applicable laws. Finally, we may also share your personal information to comply with applicable laws and regulations, to respond to a subpoena, search warrant, or other lawful request for information we receive, or to otherwise protect our rights.

10. Advertising and Analytics

We use analytics to understand how the platform and website are used, and we advertise MerchUp on third-party surfaces including the Shopify App Store. We do not build advertising profiles from the content you generate or from your store's data.

For more information about how targeted advertising works, you can visit the Network Advertising Initiative's educational page at thenai.org. You can opt out of Google Analytics using Google's opt-out browser add-on, and you can opt out of a number of other services via the Digital Advertising Alliance's opt-out portal at optout.aboutads.info. You can also reject non-essential cookies at any time using our cookie banner.

11. Data Retention

We retain personal data only as long as necessary to:

• Provide the service
• Fulfil contractual obligations
• Comply with legal requirements
• Resolve disputes and enforce agreements

In practice this means:

• While your account is open — we retain your account, store connection, generated content, SEO data (keywords, scans, run history), and activity history so the service works as expected.
• When you disconnect Google Search Console — we delete the stored Google tokens immediately, as described in section 5.
• When you uninstall the App — we clear the Shopify access token we hold for that store and mark the connection as uninstalled (Shopify also invalidates the token on its side). Your MerchUp account itself is not deleted, so you can reinstall without losing your work.
• When Shopify sends a shop redaction request— normally 48 hours after uninstall, we permanently delete the cached product catalogue, product fetch records, publish and edit history, Shopify session records, and the store's SEO data (keywords, competitor lists, scans and rank history, synced page and collection SEO records, drafts, and run records), the store's Add products items and photos, and every Buy & sell record (offers, sales, stock, credit notes, and the customer details and access log described in section 4) for that store, revoke and delete any connected Google Search Console tokens, and clear the stored store name, URL, logo, and contact email. The store's photos are deleted with it, and so is any Catalogue Data from the store (see section 9 of our Terms of Service): nothing from a store connected through Shopify stays in MerchUp's shared catalogue once the store's data is deleted, including anything shared through "Help improve MerchUp" and its example images. (Turning that sharing off on its own stops new sharing and deletes nothing.) Product and card details MerchUp holds from public data sources are not affected, because they do not come from your store.
• If no deletion request arrives— if your store stays uninstalled for 25 days, or is closed, and Shopify has not sent a redaction request, we delete the same store data automatically, so it is always gone within 30 days. You can also ask us to delete your store's data at any time (see section 12).
• When you delete your account(Settings › Account) — we cancel your plan and delete your account, logins, stores, photos and records straight away. For a store connected through Shopify this includes everything it shared through "Help improve MerchUp". For a store not connected through Shopify, Catalogue Data you shared stays in MerchUp under the licence in section 9 of our Terms of Service; it does not identify you. Billing records are kept as described below.
• Customer data access log — kept for 13 months, then deleted automatically.
• Billing and transaction records — what you were billed and credited (plan and subscription records, credit purchases and usage, and the email and store name they were billed to) are kept for six years after the end of the accounting year they belong to, as UK tax law requires, even after your account or store connection is closed. When a store or account is deleted, these records are moved to a separate restricted archive used only for tax and legal purposes, and each record is deleted automatically on the day its six years end. Our payment providers (Shopify and Stripe) keep their own payment records under their own policies.
• Compliance request records — we keep an audit log of privacy requests received from Shopify so we can demonstrate that they were handled.

12. Merchant and Customer Data Requests

As a Shopify app, we implement Shopify's mandatory privacy webhooks and respond to them as follows:

• Customer data request— the only customer data we hold is the Buy & sell detail described in section 4, which you can see on the sale or credit note in Buy & sell. We record the request and confirm receipt; contact us if you need it exported.
• Customer redaction— we remove that customer's name, email and Shopify customer reference from every Buy & sell record of your store, and record that we did.
• Shop redaction — we permanently delete the store data described in section 11.

If you would like your store's data deleted sooner, or your MerchUp account and its data erased outside of this process, contact us at support@merchup.ai.

13. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• Secure data storage
• Access controls — customer data is readable only by our servers, never directly by any account
• Encryption of data in transit and at rest, including our backups
• Encryption of the Shopify and Google access tokens we store
• A log of every access to your customers' data
• Monitoring and protection systems

However, no system is completely secure, and we cannot guarantee absolute security.

14. International Data Transfers

Your data may be processed outside your country, including in the United States and other countries that may not have equivalent data protection laws. This includes transfers to the service providers named in section 9.

Where required, we implement safeguards such as:

• UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses (for transfers subject to UK GDPR)
• EU Standard Contractual Clauses (for transfers subject to EU GDPR)
• Secure data handling agreements

15. Automated Processing and AI

MerchUp uses automated systems and AI to process content.

You acknowledge that:

• Processing may be automated.
• Content you submit for generation or editing — including product text and product image URLs — is sent to the AI providers named in section 9 in order to produce a result.
• Automated SEO runs make automated selections on your behalf (for example choosing target keywords, generating metadata and alt text, and revising drafts based on search-result checks). Their outputs are drafts: nothing is published to your store without an explicit action by you.
• Outputs may vary and are not guaranteed.
• Decisions based on AI outputs remain your responsibility.

We do not make legally binding automated decisions about users.

16. Your Rights (UK & EU Users)

You have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion
• Restrict or object to processing, including objecting to direct marketing at any time
• Request data portability
• Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal

To exercise your rights, email us at support@merchup.ai or contact us via our support page.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) or your local authority.

17. Marketing and Communications

We may send service-related communications.

We will only send marketing communications where:

• You have consented, or
• It is permitted under applicable law

You can opt out of marketing at any time.

18. Children's Data

MerchUp is not intended for individuals under 18.

We do not knowingly collect personal data from children.

19. Changes to This Policy

We may update this Privacy Policy from time to time in order to reflect, for example, changes to our practices or for other operational, legal, or regulatory reasons.

Where required, we will notify users of material changes.

Continued use of the platform constitutes acceptance.

20. Contact

For more information about our privacy practices, if you have questions, or if you would like to make a complaint, please contact us by email at support@merchup.ai, via our support page, or by post using the details below:

Jamie Moss, trading as MerchUp
2 Hollerith Close
Oakgrove
Milton Keynes MK10 9UY
United Kingdom