1. Introduction

Welcome to MerchLaunch Inc. ("MerchLaunch", "we", "our", or "us"). This Privacy Policy explains how we collect, use, disclose, and protect your personal and organizational data when you access or use our website, platform, or services (collectively, the "Services").

By using our Services, you acknowledge that you have read and understood this Privacy Policy.

2. Information We Collect

We collect information to provide and improve our Services. The types of information we collect include:

a) Account & Business Information You Provide:

• Your name, email address, phone number (optional), and company name.
• Billing and shipping addresses.
• Store settings, product data (including design files if uploaded and linked to your account), and inventory data.
• Communication preferences.

b) End-Customer Data Processed on Your Behalf:

• Names, shipping addresses.
• Email addresses or other contact information (e.g., phone numbers) provided by you or your end-customers for order fulfillment and communication.
• Order details and payment status (we do not store full payment card numbers).

c) Usage & Device Data (Automatically Collected):

• IP address, browser type, operating system, device identifiers.
• Usage logs (e.g., pages visited, features used, actions taken, timestamps, referring URLs).
• Location data (e.g., derived from your IP address).
• Cookies and similar tracking technologies (please see our "Cookies & Tracking" section below for more details).

d) Payment Information:

We do not directly collect or store your full credit card or payment card information. Payments are processed securely by our third-party payment processors (e.g., Stripe). We may receive transaction identifiers and summary information from these processors.

3. How We Use Your Data & Legal Basis for Processing

We use your information for the following purposes, relying on the specified legal bases:

• To Provide and Maintain Our Services (Contractual Necessity):
  • Create and manage your account and user permissions.
  • Process and fulfill orders, including sharing necessary information with logistics partners if you opt into fulfillment services.
  • Provide customer support and respond to your inquiries.
• To Improve Our Services (Legitimate Interest):
  • Analyze usage patterns to understand how our Services are used, identify areas for improvement, and enhance user experience.
  • Develop new features and functionalities.
• For Security and Compliance (Legitimate Interest; Legal Obligation):
  • Ensure platform security, prevent fraud and abuse, and protect the rights and safety of MerchLaunch, our users, and the public.
  • Comply with legal obligations, court orders, or other lawful requests from public authorities.
• For Communication (Contractual Necessity; Legitimate Interest; Consent):
  • Send you transactional emails related to your account and service usage (e.g., order confirmations, password resets, important service updates).
  • Send you optional marketing emails about new features, promotions, or other news we think may interest you. We will only send you marketing emails if you have explicitly consented, or where permitted by applicable law (e.g., for existing customers regarding similar services). You can opt-out of marketing communications at any time by clicking the "unsubscribe" link in the email or by updating your account preferences.
• For Analytics (Legitimate Interest; Consent for certain cookies):
  • To understand website traffic and usage patterns using analytics providers.

4. Data Sharing & Third Parties

We do not sell your personal data. We may share your data with the following categories of third parties only for the purposes described in this Privacy Policy:

• Payment Processors: Such as Stripe, to securely process your payments.
• Logistics & Fulfillment Partners: If you opt-in to our fulfillment services, we will share necessary order and shipping information with these partners to fulfill your orders.
• Analytics Providers: Such as Google Analytics, to help us understand how our Services are used. These providers may use cookies and other tracking technologies. You can learn more about Google's practices at https://policies.google.com/privacy/partners and opt-out by downloading the Google Analytics opt-out browser add-on.
• Cloud Hosting & Infrastructure Providers: To host our platform and store data.
• Communication Service Providers: To send emails and other communications.
• Law Enforcement or Regulators: We may disclose your information if required by law, subpoena, or other legal process, or if we have a good faith belief that disclosure is reasonably necessary to (i) investigate, prevent, or take action regarding suspected or actual illegal activities or to assist government enforcement agencies; (ii) enforce our agreements with you; (iii) investigate and defend ourselves against any third-party claims or allegations.

All third parties are contractually bound to protect your data, maintain its confidentiality, and are only permitted to use it for the specific services they provide to us and in accordance with our instructions.

5. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you with our Services. We may also retain your personal data for longer periods as required for our legitimate business interests, such as for legal, tax, audit, and compliance purposes, or to resolve disputes. When your data is no longer needed, we will securely delete or anonymize it.

You may request the deletion of your account and associated personal data by contacting us (see "Your Rights" and "Contact Us" sections).

6. Cookies & Tracking Technologies

We and our third-party partners use cookies and similar tracking technologies (e.g., web beacons, pixels) to provide and improve our Services, analyze usage, and for other purposes described in this policy.

What are Cookies:

Cookies are small text files stored on your device.

Types of Cookies We Use:

• Essential Cookies: Necessary for the Services to function (e.g., session management, security).
• Performance & Analytics Cookies: Help us understand how you interact with our Services, allowing us to improve performance and user experience.
• Functionality Cookies: Remember your preferences and choices to provide a more personalized experience.
• Marketing Cookies (if applicable): Used to deliver relevant advertisements (ensure this is accurate for your practices).

Your Choices:

Most web browsers allow you to control cookies through their settings preferences. You can typically set your browser to refuse cookies or to alert you when cookies are being sent. However, if you disable essential cookies, some parts of our Services may not function properly.

7. Your Rights

Depending on your jurisdiction (e.g., if you are in the EEA, UK, or California), you may have certain rights regarding your personal data. These rights may include:

• The right to access: You can request a copy of the personal data we hold about you.
• The right to rectification: You can request that we correct any inaccurate or incomplete personal data.
• The right to erasure (right to be forgotten): You can request that we delete your personal data under certain conditions.
• The right to restrict processing: You can request that we limit how we use your personal data under certain conditions.
• The right to data portability: You can request that we transfer your personal data to another organization, or directly to you, under certain conditions.
• The right to object to processing: You can object to our processing of your personal data when it's based on our legitimate interests or for direct marketing purposes.
• The right to withdraw consent: Where we rely on your consent to process personal data, you have the right to withdraw that consent at any time.

To exercise these rights, please contact us at support@merchlaunch.com. We may need to verify your identity before processing your request. We will respond to your request within the timeframes required by applicable law (typically within one month for GDPR-related requests).

8. International Data Transfers

We store and process data primarily in the United States. If you are accessing our Services from outside the United States, your information will be transferred to, stored, and processed in the United States or other countries where our service providers are located. Data protection laws in these countries may differ from those in your jurisdiction.

When we transfer personal data from the European Economic Area (EEA), UK, or Switzerland to countries outside of these regions, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission or other legally recognized transfer mechanisms to ensure your data is adequately protected.

9. Security

We implement robust technical and organizational security measures designed to protect your personal data from unauthorized access, use, disclosure, alteration, or destruction. These measures include:

• Data encryption in transit (e.g., using SSL/TLS technology).
• Role-based access controls to limit access to personal data.
• Regular security assessments and vulnerability scanning.
• Secure development practices.
• Employee training on data protection and security.

However, please note that no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security.

10. Children’s Privacy

Our Services are intended for businesses and individuals over the age of 18 (or the age of majority in their jurisdiction) and are not directed at children under the age of 13 (or a higher age threshold as required by applicable law). We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without parental consent, we will take steps to delete that information.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, Services, or applicable laws. If we make material changes, we will notify you by posting the updated policy on our website and updating the "Last Updated" date, and/or by sending you an email or other notification as required by applicable law. We encourage you to review this Privacy Policy periodically.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: