Privacy Policy

1. Scope and controller

This Privacy Policy applies to the MerchDraft website, account features, AI listing tools, image generation tools, support communications, and related services.

MerchDraft controls the personal data described in this policy. Questions and privacy requests can be sent to [email protected].

2. Data we collect

Account and identity data

We collect your email address, account identifier, authentication provider, and basic profile information supplied through Google or Supabase Auth.

Product content

We process product names, product facts, target keywords, marketplace selections, uploaded reference images, generated text, generated images, and generation history.

Usage and technical data

We may collect IP address, browser and device information, timestamps, page paths, feature events, request identifiers, error details, and security logs.

Purchase and support data

When paid packs become available, we may receive package, price, currency, transaction, customer, refund, and payment-status information from Paddle. Paddle processes your complete payment credentials. MerchDraft does not store complete card numbers.

If you contact us, we process your email address, message, attachments, and the information needed to answer your request.

3. How and why we use data

We use personal data to:

• create and secure accounts, authenticate users, and maintain sessions;
• generate listings and product images, store private assets, and show generation history;
• manage trial and purchased generation balances, transactions, refunds, and account deletion;
• provide support, diagnose errors, prevent fraud, enforce limits, and protect the service;
• understand feature usage and improve reliability, quality, accessibility, and user experience;
• meet accounting, tax, legal, and regulatory obligations.

Depending on your location and the activity, our legal bases may include performing a contract, taking steps at your request, legitimate interests in operating and protecting the service, consent, and compliance with legal obligations.

4. AI processing

MerchDraft sends the product facts you submit to MiniMax to create listing copy. Selected and normalized reference images, related product details, and generation instructions are sent through OpenRouter to an image model to create product visuals.

MerchDraft does not use AI output to make decisions that produce legal or similarly significant effects about individuals.

5. Service providers and disclosures

We disclose data only as needed to operate the service, complete a transaction, comply with law, or protect rights and safety. Current service categories include:

• Supabase for authentication, database services, and private file storage;
• Render for application hosting and server processing;
• Cloudflare for DNS, traffic delivery, and security;
• MiniMax and OpenRouter for AI text and image processing;
• Google when you choose Google sign-in;
• Paddle as merchant of record and payment processor when paid packs are offered;
• email and customer-support providers when those services are enabled.

We may also disclose information during a business transaction, in response to lawful process, or when reasonably necessary to investigate fraud, security issues, or violations of our policies.

6. Cookies and browser storage

MerchDraft uses browser storage and similar technology for authentication sessions, security, language choice, and theme preference. We do not currently use third-party advertising cookies.

MerchDraft does not sell personal information or share it for cross-context behavioral advertising. If this practice changes, we will update this policy and provide any legally required choices before the change applies.

7. Data retention

We keep account information while your account is active. Product content and generated assets remain available in your private history until you delete your account, remove content where a removal tool is available, or retention is no longer necessary.

Security, error, and usage records are retained for a limited period based on operational need. Purchase and transaction records may be retained longer when required for tax, accounting, fraud prevention, dispute handling, or legal compliance. Limited copies may remain temporarily in protected backups.

8. International transfers and security

MerchDraft and its service providers may process information in countries other than your own. Where required, we rely on recognized transfer mechanisms and provider safeguards.

We use access controls, private storage, encryption in transit, authenticated requests, and other technical and organizational measures designed to protect information. No online service can guarantee absolute security.

9. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or obtain a portable copy of personal data. You may also withdraw consent where processing relies on consent and complain to your local data-protection authority.

California residents may have rights to know, delete, correct, opt out of sale or sharing, limit certain uses of sensitive personal information, and receive equal service when exercising privacy rights. MerchDraft does not sell personal information or use sensitive personal information to infer characteristics.

You can delete your account and associated private files from the account panel. For other requests, email [email protected]. We may need to verify your identity before completing a request.

10. Children

MerchDraft is a business tool and is not directed to children under 18. We do not knowingly collect personal data from children. Contact us if you believe a child has provided personal data.

11. Changes to this policy

We may update this policy when the service, providers, or legal requirements change. We will post the updated date and provide additional notice when a change materially affects your rights.