Privacy Policy

This Privacy Policy explains how MerchUp ("MerchUp", "we", "us", or "our") collects, uses, and protects your personal data when you use our platform, including when you install and use the MerchUp Ai app ("the App") in connection with your Shopify-supported store.

We are committed to protecting your privacy and complying with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR), the EU GDPR (where applicable), and the Privacy and Electronic Communications Regulations (PECR).

For the terms that govern use of MerchUp, see our Terms of Service.

1. Who We Are

MerchUp is a software-as-a-service platform providing AI-powered tools for product content creation, editing, and management. MerchUp is operated by Jamie Moss, a sole trader established in the United Kingdom, trading as MerchUp.

For the purposes of data protection law:

• MerchUp acts as a data controller for your account and usage data.
• MerchUp acts as a data processor when handling store or business data on your behalf.

You can contact us about this policy, or about any data protection matter, at support@merchup.ai. Our full postal address is given in section 19.

2. The App and Your Shopify Store

MerchUp Ai provides AI-generated and AI-assisted product content — descriptions, templates, tags, SEO metadata, and images — to merchants who use Shopify to power their stores.

When you install the App, you authorise it through Shopify's standard OAuth flow. Shopify issues us an access token for your store, which we store securely and use only to make API requests on your behalf. We record your store domain, store name, store URL, store logo, the store contact email supplied by Shopify, the permissions (scopes) you granted, and the dates on which the App was installed, re-authorised, and uninstalled.

Section 4 sets out exactly which categories of store data the App reads through the Shopify APIs, and what each is used for.

3. Information We Collect

Separately from the store data described in section 4, we collect the following categories of personal data directly from you and from your use of the platform:

Account Information

• Name
• Email address
• Account credentials

Store & Business Information

• Store name
• Store URL and store domain
• Store logo and store contact email, as provided by the connected platform
• Platform connection details (e.g. Shopify), including granted permissions
• Product data and business content processed through the platform

Usage & Activity Data

• Actions taken within the platform
• Content generated, edited, or processed using AI
• Feature usage and interaction data
• Account activity logs

Technical & Location Data

• IP address
• Approximate geographic location (derived from IP)
• Device type, browser, and operating system

Tracking & Behavioural Data

• Session activity (pages viewed, time spent, interactions)
• Navigation patterns and feature usage
• Real-time usage monitoring (e.g. visibility of active users within internal admin dashboards)

Billing Data

• Your plan, credit balance, and transaction history
• Charges made through the Shopify Billing API. Payment card details are handled by Shopify and are never collected or stored by MerchUp.

Communications Data

• Messages sent to support
• Account-related communications

4. Data We Access From Your Store

When you install the App, we become able to access the following types of information from your Shopify account, according to the permissions you grant at install time:

• Products (read and write) — product titles, descriptions, product types, vendors, tags, images and media, variants, SKUs, prices, collections, and metafields. Read to generate and edit content; written back only when you choose to publish changes to your store.
• Inventory (read and write) — inventory quantities and the locations they are held at, so that generated content and product updates stay consistent with stock.
• Files (read)— images and media in your store's Files area, used as source material for product imagery and content.
• Discounts and price rules (read) — discount and price-rule configuration, so that generated content can accurately reflect active offers.
• Shipping (read) — shipping zones and rates, so that generated content can accurately reference delivery information.
• Store content (read)— blog posts, articles, and pages, including the names of their authors and contributors, used to match generated content to your store's existing voice.
• Published product listings (read) — publicly available product listings, used to render accurate previews of how content will appear.
• Shop and store owner details — your store name, domain, and the store contact email Shopify provides, used to identify your store and to contact you about your account.

We do not request access to your store's customer records or order records, and we do not store personal information about your customers. Any device or activity data we hold relates to people who use MerchUp itself, not to shoppers on your store.

5. How We Use Your Data

We use your data to:

• Provide, operate, and maintain the MerchUp platform and the App
• Generate and manage AI-powered product content
• Enable integrations with third-party platforms (e.g. Shopify)
• Improve functionality, performance, and user experience
• Monitor usage for security, fraud prevention, and abuse detection
• Provide customer support and respond to enquiries
• Analyse usage trends and behaviour to improve the service
• Bill you for your plan and any credits or add-ons you purchase
• Send you information or offers relating to our products and services, where permitted

We do not use your identifiable content for marketing without your explicit consent, and we do not sell your personal data.

6. Legal Basis for Processing

Under UK GDPR / EU GDPR, we rely on:

• Contractual necessity - to deliver the service you signed up for
• Legitimate interests - to improve, secure, and optimise the platform
• Legal obligations - where required (e.g. compliance, fraud prevention)
• Consent - for cookies, tracking technologies, and optional communications

We ensure that our legitimate interests do not override your rights and freedoms.

7. Cookies and Tracking Technologies

We use cookies and similar technologies to maintain authentication and login sessions, analyse platform performance and usage, improve user experience and features, and support analytics and marketing (where applicable). Full details are provided in our Cookie Policy.

“Cookies” are data files placed on your device that often include an anonymous unique identifier. “Log files” record actions taken on the site and collect data including your IP address, browser type, internet service provider, referring and exit pages, and date and time stamps. “Web beacons”, “tags”, and “pixels” are electronic files used to record information about how you browse the site. For more information about cookies, and how to disable them, visit allaboutcookies.org.

Where required by law:

• Non-essential cookies are only used with your consent.
• You can accept, reject, or manage preferences via our cookie banner.

8. Data Sharing and Service Providers

We do not sell your personal data. We share data with the following service providers, who process it only on our instructions and only so far as is needed to run the service:

• Shopify — platform integration and billing, where you install the App from the Shopify App Store.
• Vercel — application hosting and content delivery.
• Supabase — database hosting, authentication, and file storage.
• xAI — AI models used to generate and edit product content.
• OpenAI — AI models used for image generation and supporting content features.
• Resend — delivery of transactional and account-related email.
• Fastmail — receipt and handling of inbound support email.
• Google Analytics and Ahrefs Analytics — website analytics, loaded subject to your cookie consent.
• IP geolocation providers — resolving an approximate location from an IP address, so that pricing and currency can be shown correctly.

All service providers are required to process data securely and in accordance with applicable laws. Finally, we may also share your personal information to comply with applicable laws and regulations, to respond to a subpoena, search warrant, or other lawful request for information we receive, or to otherwise protect our rights.

9. Advertising and Analytics

We use analytics to understand how the platform and website are used, and we advertise MerchUp on third-party surfaces including the Shopify App Store. We do not build advertising profiles from the content you generate or from your store's data.

For more information about how targeted advertising works, you can visit the Network Advertising Initiative's educational page at thenai.org. You can opt out of Google Analytics using Google's opt-out browser add-on, and you can opt out of a number of other services via the Digital Advertising Alliance's opt-out portal at optout.aboutads.info. You can also reject non-essential cookies at any time using our cookie banner.

10. Data Retention

We retain personal data only as long as necessary to:

• Provide the service
• Fulfil contractual obligations
• Comply with legal requirements
• Resolve disputes and enforce agreements

In practice this means:

• While your account is open — we retain your account, store connection, generated content, and activity history so the service works as expected.
• When you uninstall the App — we immediately revoke and clear the Shopify access token for that store and mark the connection as uninstalled. Your MerchUp account itself is not deleted, so you can reinstall without losing your work.
• When Shopify sends a shop redaction request — normally 48 hours after uninstall, we permanently delete the cached product catalogue, product fetch records, publish and edit history, and Shopify session records for that store, and clear the stored store name, URL, logo, and contact email.
• Billing and transaction records — retained for as long as required by UK accounting and tax law, even after an account or store connection is closed.
• Compliance request records — we keep an audit log of privacy requests received from Shopify so we can demonstrate that they were handled.

11. Merchant and Customer Data Requests

As a Shopify app, we implement Shopify's mandatory privacy webhooks and respond to them as follows:

• Customer data request— because we do not store personal information about your store's customers, there is no customer data for us to export. We record the request and confirm receipt.
• Customer redaction — likewise, there is no customer data for us to erase. We record the request and confirm receipt.
• Shop redaction — we permanently delete the store data described in section 10.

If you would like your MerchUp account and its data erased outside of this process, contact us at support@merchup.ai.

12. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• Secure data storage
• Access controls
• Encryption of data in transit
• Monitoring and protection systems

However, no system is completely secure, and we cannot guarantee absolute security.

13. International Data Transfers

Your data may be processed outside your country, including in the United States and other countries that may not have equivalent data protection laws. This includes transfers to the service providers named in section 8.

Where required, we implement safeguards such as:

• Standard contractual clauses
• Secure data handling agreements

14. Automated Processing and AI

MerchUp uses automated systems and AI to process content.

You acknowledge that:

• Processing may be automated.
• Content you submit for generation or editing is sent to the AI providers named in section 8 in order to produce a result.
• Outputs may vary and are not guaranteed.
• Decisions based on AI outputs remain your responsibility.

We do not make legally binding automated decisions about users.

15. Your Rights (UK & EU Users)

You have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion
• Restrict or object to processing
• Request data portability

To exercise your rights, email us at support@merchup.ai or contact us via our support page.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) or your local authority.

16. Marketing and Communications

We may send service-related communications.

We will only send marketing communications where:

• You have consented, or
• It is permitted under applicable law

You can opt out of marketing at any time.

17. Children's Data

MerchUp is not intended for individuals under 18.

We do not knowingly collect personal data from children.

18. Changes to This Policy

We may update this Privacy Policy from time to time in order to reflect, for example, changes to our practices or for other operational, legal, or regulatory reasons.

Where required, we will notify users of material changes.

Continued use of the platform constitutes acceptance.

19. Contact

For more information about our privacy practices, if you have questions, or if you would like to make a complaint, please contact us by email at support@merchup.ai, via our support page, or by post using the details below:

Jamie Moss, trading as MerchUp
2 Hollerith Close
Oakgrove
Milton Keynes MK10 9UY
United Kingdom