Privacy Policy

This Privacy Policy explains how MerchUp ("MerchUp", "we", "us", or "our") collects, uses, and protects your personal data when you use our platform, including when you install and use the MerchUp Ai app ("the App") in connection with your Shopify-supported store.

We are committed to protecting your privacy and complying with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR), the EU GDPR (where applicable), and the Privacy and Electronic Communications Regulations (PECR).

For the terms that govern use of MerchUp, see our Terms of Service.

1. Who We Are

MerchUp is a software-as-a-service platform providing AI-powered tools for product content creation, editing, and management. MerchUp is operated by Jamie Moss, a sole trader established in the United Kingdom, trading as MerchUp.

For the purposes of data protection law:

• MerchUp acts as a data controller for your account and usage data.
• MerchUp acts as a data processor when handling store or business data on your behalf.

You can contact us about this policy, or about any data protection matter, at support@merchup.ai. Our full postal address is given in section 20.

2. The App and Your Shopify Store

MerchUp Ai provides AI-generated and AI-assisted product content — descriptions, templates, tags, SEO metadata, image alt text, SEO analysis and automated SEO runs, and images — to merchants who use Shopify to power their stores.

When you install the App, you authorise it through Shopify's standard OAuth flow. Shopify issues us an access token for your store, which we store securely and use only to make API requests on your behalf. We record your store domain, store name, store URL, store logo, the store contact email supplied by Shopify, the permissions (scopes) you granted, and the dates on which the App was installed, re-authorised, and uninstalled.

Section 4 sets out exactly which categories of store data the App reads through the Shopify APIs, and what each is used for.

3. Information We Collect

Separately from the store data described in section 4, we collect the following categories of personal data directly from you and from your use of the platform:

Account Information

• Name
• Email address
• Account credentials

Store & Business Information

• Store name
• Store URL and store domain
• Store logo and store contact email, as provided by the connected platform
• Platform connection details (e.g. Shopify), including granted permissions
• Product data and business content processed through the platform

Usage & Activity Data

• Actions taken within the platform
• Content generated, edited, or processed using AI
• Feature usage and interaction data
• Account activity logs

Search & SEO Data

• Target keywords you set or that our tools suggest, and the products or pages they are assigned to
• Competitor website domains you add or that our tools identify from publicly available search results, together with publicly available data about those websites (such as the search terms they rank for)
• Search-ranking measurements and history for your store and its pages
• SEO scan and automated-run history, including generated drafts and before/after records
• Search performance data from Google Search Console, only where you choose to connect it (section 5)

Technical & Location Data

• IP address
• Approximate geographic location (derived from IP)
• Device type, browser, and operating system

Tracking & Behavioural Data

• Session activity (pages viewed, time spent, interactions)
• Navigation patterns and feature usage
• Real-time usage monitoring (e.g. visibility of active users within internal admin dashboards)

Billing Data

• Your plan, credit balance, and transaction history
• Charges made through the Shopify Billing API. Payment card details are handled by Shopify and are never collected or stored by MerchUp.

Communications Data

• Messages sent to support
• Account-related communications

4. Data We Access From Your Store

When you install the App, we become able to access the following types of information from your Shopify account, according to the permissions you grant at install time:

• Products (read and write) — product titles, descriptions, product types, vendors, tags, images and media, variants, SKUs, prices, collections, and metafields. Read to generate and edit content; written back only when you choose to publish changes to your store.
• Inventory (read and write) — inventory quantities and the locations they are held at, so that generated content and product updates stay consistent with stock.
• Files (read and write)— images and media in your store's Files area, used as source material for product imagery and content; written to only when publishing generated or template imagery to your store.
• Discounts and price rules (read) — discount and price-rule configuration, so that generated content can accurately reflect active offers.
• Shipping (read) — shipping zones and rates, so that generated content can accurately reference delivery information.
• Store content (read and write)— blog posts, articles, and pages, including the names of their authors and contributors. Read to match generated content to your store's existing voice and to analyse your pages' SEO; written back only when you choose to publish SEO metadata (page meta titles and descriptions) to your store.
• Published product listings (read) — publicly available product listings, used to render accurate previews of how content will appear.
• Shop and store owner details — your store name, domain, and the store contact email Shopify provides, used to identify your store and to contact you about your account.

We do not request access to your store's customer records or order records, and we do not store personal information about your customers. Any device or activity data we hold relates to people who use MerchUp itself, not to shoppers on your store.

5. Google Search Console (Optional)

You can optionally connect your Google Search Console account to MerchUp to improve our SEO features with your store's real search performance data. If you do:

• You authorise us through Google's standard consent screen. Google issues us tokens for your account, which we store encrypted and use only to read Search Console data for the property you connect.
• We read search performance data for that property — the search queries your site appeared for, the pages of your site they led to, and the associated impressions, clicks, click-through rates, and average positions — and use it solely to provide and improve the SEO features in your account (for example, suggesting keywords your store already ranks for). Our access is read-only.
• We also receive the email address of the connected Google account (so we can show you which account is connected) and, during connection only, the list of Search Console properties on that account in order to find the one matching your store — only the matched property is stored.
• You can disconnect Google Search Console at any time from within MerchUp or by revoking access in your Google account settings. On disconnection we delete the stored tokens.

MerchUp's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer Google user data to third parties except as necessary to provide the features described above, do not use it for advertising, and do not allow humans to read it except with your consent, where necessary for security or compliance, or as required by law.

6. How We Use Your Data

We use your data to:

• Provide, operate, and maintain the MerchUp platform and the App
• Generate and manage AI-powered product content
• Provide SEO features — researching keywords, analysing competitors' public search presence, measuring your store's rankings, and generating SEO metadata and image alt text
• Enable integrations with third-party platforms (e.g. Shopify)
• Improve functionality, performance, and user experience
• Monitor usage for security, fraud prevention, and abuse detection
• Provide customer support and respond to enquiries
• Analyse usage trends and behaviour to improve the service
• Bill you for your plan and any credits or add-ons you purchase
• Send you information or offers relating to our products and services, where permitted

We do not use your identifiable content for marketing without your explicit consent, and we do not sell your personal data.

7. Legal Basis for Processing

Under UK GDPR / EU GDPR, we rely on:

• Contractual necessity - to deliver the service you signed up for
• Legitimate interests - to improve, secure, and optimise the platform
• Legal obligations - where required (e.g. compliance, fraud prevention)
• Consent - for cookies, tracking technologies, and optional communications

We ensure that our legitimate interests do not override your rights and freedoms.

8. Cookies and Tracking Technologies

We use cookies and similar technologies to maintain authentication and login sessions, analyse platform performance and usage, improve user experience and features, and support analytics and marketing (where applicable). Full details are provided in our Cookie Policy.

“Cookies” are data files placed on your device that often include an anonymous unique identifier. “Log files” record actions taken on the site and collect data including your IP address, browser type, internet service provider, referring and exit pages, and date and time stamps. “Web beacons”, “tags”, and “pixels” are electronic files used to record information about how you browse the site. For more information about cookies, and how to disable them, visit allaboutcookies.org.

Where required by law:

• Non-essential cookies are only used with your consent.
• You can accept, reject, or manage preferences via our cookie banner.

9. Data Sharing and Service Providers

We do not sell your personal data. We share data with the following service providers, who process it only on our instructions and only so far as is needed to run the service:

• Shopify — platform integration and billing, where you install the App from the Shopify App Store.
• Vercel — application hosting and content delivery.
• Supabase — database hosting, authentication, and file storage.
• xAI — AI models used to generate and edit product content, and to analyse your product images (which are shared with xAI by URL) in order to generate image alt text.
• OpenAI — AI models used for image generation and supporting content features.
• DataForSEO— search-data provider for our SEO features. We send it search terms (which may be derived from your product titles and keywords), your store's domain, and competitor domains, and receive publicly available search data (rankings, search volumes, and related metrics) in return.
• Google (Search Console API) — where you choose to connect Google Search Console, as described in section 5.
• Resend — delivery of transactional and account-related email.
• Fastmail — receipt and handling of inbound support email.
• Google Analytics and Ahrefs Analytics — website analytics, loaded subject to your cookie consent.
• IP geolocation providers — resolving an approximate location from an IP address, so that pricing and currency can be shown correctly.

All service providers are required to process data securely and in accordance with applicable laws. Finally, we may also share your personal information to comply with applicable laws and regulations, to respond to a subpoena, search warrant, or other lawful request for information we receive, or to otherwise protect our rights.

10. Advertising and Analytics

We use analytics to understand how the platform and website are used, and we advertise MerchUp on third-party surfaces including the Shopify App Store. We do not build advertising profiles from the content you generate or from your store's data.

For more information about how targeted advertising works, you can visit the Network Advertising Initiative's educational page at thenai.org. You can opt out of Google Analytics using Google's opt-out browser add-on, and you can opt out of a number of other services via the Digital Advertising Alliance's opt-out portal at optout.aboutads.info. You can also reject non-essential cookies at any time using our cookie banner.

11. Data Retention

We retain personal data only as long as necessary to:

• Provide the service
• Fulfil contractual obligations
• Comply with legal requirements
• Resolve disputes and enforce agreements

In practice this means:

• While your account is open — we retain your account, store connection, generated content, SEO data (keywords, scans, run history), and activity history so the service works as expected.
• When you disconnect Google Search Console — we delete the stored Google tokens immediately, as described in section 5.
• When you uninstall the App — we clear the Shopify access token we hold for that store and mark the connection as uninstalled (Shopify also invalidates the token on its side). Your MerchUp account itself is not deleted, so you can reinstall without losing your work.
• When Shopify sends a shop redaction request— normally 48 hours after uninstall, we permanently delete the cached product catalogue, product fetch records, publish and edit history, Shopify session records, and the store's SEO data (keywords, competitor lists, scans and rank history, synced page and collection SEO records, drafts, and run records) for that store, revoke and delete any connected Google Search Console tokens, and clear the stored store name, URL, logo, and contact email.
• Billing and transaction records — retained for as long as required by UK accounting and tax law, even after an account or store connection is closed.
• Compliance request records — we keep an audit log of privacy requests received from Shopify so we can demonstrate that they were handled.

12. Merchant and Customer Data Requests

As a Shopify app, we implement Shopify's mandatory privacy webhooks and respond to them as follows:

• Customer data request— because we do not store personal information about your store's customers, there is no customer data for us to export. We record the request and confirm receipt.
• Customer redaction — likewise, there is no customer data for us to erase. We record the request and confirm receipt.
• Shop redaction — we permanently delete the store data described in section 11.

If you would like your MerchUp account and its data erased outside of this process, contact us at support@merchup.ai.

13. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• Secure data storage
• Access controls
• Encryption of data in transit
• Monitoring and protection systems

However, no system is completely secure, and we cannot guarantee absolute security.

14. International Data Transfers

Your data may be processed outside your country, including in the United States and other countries that may not have equivalent data protection laws. This includes transfers to the service providers named in section 9.

Where required, we implement safeguards such as:

• UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses (for transfers subject to UK GDPR)
• EU Standard Contractual Clauses (for transfers subject to EU GDPR)
• Secure data handling agreements

15. Automated Processing and AI

MerchUp uses automated systems and AI to process content.

You acknowledge that:

• Processing may be automated.
• Content you submit for generation or editing — including product text and product image URLs — is sent to the AI providers named in section 9 in order to produce a result.
• Automated SEO runs make automated selections on your behalf (for example choosing target keywords, generating metadata and alt text, and revising drafts based on search-result checks). Their outputs are drafts: nothing is published to your store without an explicit action by you.
• Outputs may vary and are not guaranteed.
• Decisions based on AI outputs remain your responsibility.

We do not make legally binding automated decisions about users.

16. Your Rights (UK & EU Users)

You have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion
• Restrict or object to processing, including objecting to direct marketing at any time
• Request data portability
• Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal

To exercise your rights, email us at support@merchup.ai or contact us via our support page.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) or your local authority.

17. Marketing and Communications

We may send service-related communications.

We will only send marketing communications where:

• You have consented, or
• It is permitted under applicable law

You can opt out of marketing at any time.

18. Children's Data

MerchUp is not intended for individuals under 18.

We do not knowingly collect personal data from children.

19. Changes to This Policy

We may update this Privacy Policy from time to time in order to reflect, for example, changes to our practices or for other operational, legal, or regulatory reasons.

Where required, we will notify users of material changes.

Continued use of the platform constitutes acceptance.

20. Contact

For more information about our privacy practices, if you have questions, or if you would like to make a complaint, please contact us by email at support@merchup.ai, via our support page, or by post using the details below:

Jamie Moss, trading as MerchUp
2 Hollerith Close
Oakgrove
Milton Keynes MK10 9UY
United Kingdom