This Privacy Policy explains how Merch Studio collects, uses, and protects your personal information when you use our website and services.
1. Information we collect
- Account information: name, email address, password hash, and profile details you provide.
- Content: designs, artwork, product mockups, project files, and approvals you upload or create.
- Billing information: processed by our payment provider; we store only billing metadata (plan, status, last 4 digits) and never full card details.
- Usage data: device, browser, IP address, pages visited, and feature interactions, collected via cookies and server logs.
- Communications: messages you send us and email engagement data (opens, clicks) for transactional and product emails.
2. How we use your information
- to provide, maintain, and improve the Service;
- to authenticate you and secure your account;
- to process payments and manage subscriptions;
- to send transactional emails (e.g. verification, password reset, approvals);
- to respond to support requests;
- to detect, prevent, and address fraud or abuse;
- to comply with legal obligations.
3. Legal bases (GDPR/UK GDPR)
We process personal data on the bases of contract performance (to deliver the Service), legitimate interests (to keep the Service safe and improve it), consent (for optional marketing), and legal obligation (e.g. tax).
4. Sharing
We share information only with:
- service providers (hosting, email delivery, payments, AI inference) acting as processors under contract;
- authorities when required by law or to protect rights and safety;
- a successor entity in the event of a merger, acquisition, or asset sale.
We do not sell your personal information.
5. AI processing
When you use AI features, prompts and uploaded content may be sent to third-party model providers strictly to generate the requested output. We do not allow them to use Your Content to train their models.
6. International transfers
Your information may be processed in countries outside your own. Where required, we use appropriate safeguards such as Standard Contractual Clauses.
7. Retention
We retain personal data for as long as your account is active and as needed to provide the Service. After account deletion, residual data is removed within 90 days, except where longer retention is required by law (e.g. tax records) or for backups.
8. Your rights
Depending on your location, you may have rights to access, correct, delete, port, or restrict processing of your personal data, and to object to certain processing or withdraw consent. To exercise these rights, email [email protected]. You also have the right to lodge a complaint with your local data protection authority.
9. Cookies
We use strictly necessary cookies for authentication and security, and limited analytics cookies to understand product usage. You can control cookies through your browser settings.
10. Security
We use industry-standard measures including encryption in transit, hashed passwords, role-based access controls, and audit logging. No system is perfectly secure; please use a strong unique password and enable any available security features.
11. Children
The Service is not directed to children under 16, and we do not knowingly collect their personal data.
12. Changes
We will post material changes to this policy on this page and, when appropriate, notify you by email.
13. Contact
For privacy questions or to exercise your rights, contact [email protected].