Privacy Policy

Merchanite provides shipping protection for online stores. When a merchant installs our app, their shoppers can add package protection to an order at checkout. If a protected package is lost, damaged, stolen, returned to sender, or otherwise affected by a shipping issue, the shopper can file a claim through our portal, and we resolve eligible claims with either a refund or a replacement order, at Merchanite's discretion.

We take privacy seriously and aim to collect only the information we need to deliver and support this service. This policy describes those practices in plain language. We update it as our product and our legal obligations evolve, as described in "Changes to this policy" below. The version number and date shown with this policy always identify the edition you are reading.

We collect information in four ways: information you provide to us directly, information we collect automatically when you use our marketing site and the Merchanite app, information the Merchanite components collect in a shopper's browser on a merchant's storefront and at checkout, and information we receive from third parties such as the commerce platform a merchant uses. We describe each below.

Information you provide directly

If you are a merchant user, you provide business and account information when you set up and operate Merchanite, including your store name, your store's domain and public URL, contact details such as an email address and, optionally, a phone number, and any additional email addresses you ask us to send invoices to.

If you are a shopper filing a claim, you provide the details needed to evaluate that claim. This includes the type of claim (for example, lost, damaged, stolen, returned to sender, wrong item, or other), free-text descriptions you write to explain what happened, comments you add to a claim, and any photos or documents you upload as evidence to support it.

Information collected automatically

On our public marketing website, we collect limited analytics information such as pages viewed and basic usage events, subject to your consent and the controls described in "Cookies and tracking." We strip personal identifiers from this analytics data before it is sent. We do not run this marketing analytics inside the authenticated Merchanite app used by merchants or shoppers.

We also use an error-monitoring service to record technical diagnostic information when something goes wrong in our website, our portals, our API, or our Shopify app, and for a sample of ordinary requests, so we can detect, investigate, and fix problems and keep the service fast. These diagnostics can include:

• the network (IP) address a request or report came from, and the approximate location that address suggests;
• your browser, device, and operating system;
• the pages and requests involved and how long each step took (performance traces and profiles);
• request details, such as request headers and the non-personal fields of the information sent with a request, for example an order or claim identifier, a status, or an amount;
• the internal identifier of the signed-in account; and
• for merchant users and Merchanite staff only, a masked replay of the merchant or staff portal covering the moments before an error and the rest of that portal visit, for up to an hour.

These records are filtered before they are stored. The filtering is designed to remove passwords, authentication tokens, other credentials, and email addresses from every record. From the content submitted with a request, the filtering also removes contact details such as names and phone numbers, street addresses, and free-text content. Search terms entered in the portals may be recorded as they were typed, except that any email address within them is removed. The same filtering applies to the content shoppers submit through the claim and shopper portals and to the notifications we receive from our service providers, so a claim's type and order identifier may be recorded, for example, but not the description written for it. Uploaded files, such as claim evidence photos, and the information sent when you sign in are never recorded.

A session replay masks all text and every input and blocks images. It shows the layout of a page and how it was used, such as clicks and navigation, and the addresses of the pages and requests involved, which can include search terms typed in the portals, with credentials and email addresses removed. It does not show the text, images, or form entries on the screen. Replays are recorded only in the merchant and staff portals, never on the shopper portal, the claim pages, or our marketing site. We use these diagnostics only to keep Merchanite secure, reliable, and working, and never for advertising or profiling.

Information collected on a merchant's storefront and at checkout

When a merchant installs Merchanite, two small Merchanite components run in a shopper's browser: a protection widget on the merchant's storefront, and a protection option inside Shopify's checkout. Neither component asks a shopper for personal information, and neither sets advertising or profiling cookies.

The storefront widget keeps a few functional values in the browser's own storage so the protection option appears quickly and correctly. These are: a short-lived cached answer (five minutes) about whether protection is currently available on the store; the cart subtotal, order total, and currency the widget last displayed; a timestamp that stops the widget from re-sending its activation signal too often; and a count of the error reports already sent during the current browsing session, so the same error is not reported over and over. These values stay on the shopper's device and are strictly necessary to operate the protection option. The availability answer and the error-report count are cleared when the browsing session ends; the cart values and the timestamp stay until the shopper clears their browser storage.

The widget also sends us an activation signal so we can confirm to the merchant that their storefront is live. A browser sends it about once a day, or again after an hour if the previous signal failed. That signal carries only the store's Shopify domain and whether the store's protection pricing configuration could be read. It contains no shopper information.

If either component runs into an error, it reports that error to our error-monitoring provider so we can find and fix the fault. Those reports carry technical diagnostics: the error details, the store domain, a release identifier, and the network (IP) address the report was sent from, which our error-monitoring provider stores with each report. Before a storefront widget report is sent, email addresses and tokens are removed from its error message. Reports from the storefront widget also include the address of the page the error happened on, with any query string removed, and the browser user agent string. Reports from the checkout component include neither, and each value they carry is limited in length. We use these reports only to diagnose and fix faults.

Information from third parties

When a merchant installs Merchanite on their store, we receive order information from the merchant's commerce platform (Shopify) by way of order notifications. This typically includes the shopper's name and email address, the order details, the shipping (ship-to) and billing addresses for the order, and the payment method shown on the order, such as the card brand and its last four digits. We never receive or store a full card number, expiry date, or security code.

We also receive identity and authentication information from our authentication provider (Clerk) when a merchant user or a shopper signs in to a Merchanite portal. That provider manages sign-in credentials and account identity on our behalf; in our own systems we store only the identifiers needed to link an account to its activity.

We use the information we collect to provide, operate, secure, and improve Merchanite. For merchants, this means setting up your store, operating the protection offering at checkout, processing claims, and billing. For shoppers, this means letting you purchase protection, file and track claims, and receive a resolution.

More specifically, we use information to: enable shoppers to add shipping protection to an order and to record whether an order is protected; evaluate and resolve claims, including reviewing the evidence and details you provide and issuing a refund or a replacement order; maintain the financial records associated with protection fees and claims; invoice merchants for protection fees collected, net of the agreed revenue share; communicate with you about your account, your orders, and your claims; monitor, secure, troubleshoot, and improve our service; and comply with our legal obligations.

We do not use the information we receive from a merchant's store, including any shopper information in it, to create, develop, train, fine tune, or improve any machine learning or artificial intelligence system.

For individuals in the European Union or European Economic Area, our lawful bases for this processing are: performance of a contract, for operating the protection offering, processing and resolving claims, and billing; our legitimate interests, for securing our service, preventing fraud, monitoring errors and performance (including the diagnostics and masked session replays described under "Information collected automatically"), and improving what we offer; your consent, for analytics on our marketing site; and compliance with a legal obligation, for the financial and accounting records we are required to keep.

We do not sell your personal information. We share it only as needed to run our service, with the categories of recipients described here, and as required by law.

We rely on a small set of service providers (sometimes called processors) that handle information on our behalf and under our instructions. These currently include: Shopify, the commerce platform from which we receive order information; Clerk, which provides authentication and account identity; DigitalOcean, which provides our database hosting and file storage, including storage of claim evidence files; Amazon Web Services (AWS), which carries order notifications through our event and queuing pipeline; Sentry, which provides error and performance monitoring, including masked session replay of merchant and staff screens; Postmark, which delivers our transactional email, such as claim updates and account notices; Calendly, which merchant users can use to book an onboarding call with us; and Google Analytics, which provides analytics for our marketing website only.

Separately from these providers, when a shopper purchases protection or files a claim, the related order, claim, and evidence information is shared with and accessible to the merchant whose store the shopper used. That merchant is a distinct party, not one of our service providers, and it handles that information under its own privacy practices.

We are also adding providers as our service grows. We are onboarding Stripe to process merchant invoice payments. When Stripe begins handling personal information, it will do so under the same processor framework described above, and we will update this policy before that happens.

Where a merchant acts as the controller of its shoppers' personal information, Merchanite acts as that merchant's processor. Our Data Processing Addendum sets out the terms that govern that processing, including the current list of sub-processors, the safeguards we use for international transfers, and how quickly we notify a merchant of a personal data breach.

We may also disclose information when we believe in good faith that doing so is required to comply with applicable law, legal process, or a lawful governmental request; to enforce our agreements; to protect the rights, property, or safety of Merchanite, our users, or others; or in connection with a merger, acquisition, financing, or sale of assets, in which case we will require the recipient to honor commitments consistent with this policy.

On our public marketing website, we use Google Analytics to understand how visitors find and use the site. By default, analytics storage is set to denied, which means analytics cookies are not set unless and until you consent to them. We have built this denied-by-default behavior into the marketing site, and we are working on a consent control that will let you grant or change that choice; until it is available, analytics remains in its denied-by-default state. Because analytics is off by default and we do not sell or share personal information for cross-context behavioral advertising, browser opt-out preference signals such as Global Privacy Control are consistent with how the site already behaves. We do not run this marketing analytics inside the authenticated Merchanite app, so browsing the merchant or shopper portals does not generate marketing analytics tracking.

When you sign in to a Merchanite portal, our authentication provider sets first-party session cookies that are necessary to keep you securely logged in and to operate the app. These cookies are essential to providing the service.

In the merchant and staff portals only, our error-monitoring service keeps an identifier in the browser's session storage so that a masked replay can be tied to the browsing session in which an error happened. It is not a cookie, it is cleared when the browsing session ends, and it is not used for advertising, analytics, or profiling. The shopper portal, the claim pages, and our marketing site do not use it.

On a merchant's storefront and at checkout, the Merchanite components set no cookies at all. They keep only the strictly necessary browser storage values described under "Information collected on a merchant's storefront and at checkout" above, and none of those values are used for advertising or profiling.

Where we use information for analytics, we limit the data collected and remove personal identifiers from it before it is sent, so the analytics stream is not intended to contain information that identifies you personally.

We keep personal information for as long as it is necessary to provide Merchanite, to support and resolve claims, to maintain the financial and billing records associated with the service, and to meet our legal, accounting, and compliance obligations. When information is no longer needed for these purposes, we take steps to remove or anonymize it.

Retention periods differ by record type, so the table below states the period that applies to each kind of record we hold.

When a merchant uninstalls Merchanite, we delete that store's access credentials and end its sign-in sessions straight away. Records already created for that store remain subject to the periods in the table above, and a merchant or a shopper can ask us to erase their information at any time.

Some records cannot be erased on request because we are legally required to keep them, in particular the financial records described above. Where that applies, we tell you what we kept and why. If you would like to request deletion of your information, see "Your rights" below.

We use technical and organizational measures designed to protect personal information. Sensitive fields are encrypted at rest using industry-standard encryption, including shopper names and email addresses, merchant account email addresses and phone numbers, and the precise parts of a shipping or billing address such as the street lines and any geographic coordinates. We also apply access controls so that information is reached only through our authenticated, permission-checked systems, and we scope access to information so that one merchant cannot reach another merchant's data.

Some operational data, such as coarse geographic fields used for shipping and region purposes, store names and URLs, the card brand and last four digits on an order, the additional invoice email addresses a merchant adds, and certain free-text claim notes, is stored without field-level encryption (the database and its backups remain encrypted at the disk level) because it is needed in plain form to operate the service or because it does not by itself identify a person. No method of transmission or storage is completely secure, and while we work to protect your information, we cannot guarantee absolute security.

Depending on where you live, you may have rights regarding your personal information. The rights we can act on today are access to and a copy (export) of the personal information we hold about you, and deletion of that information. To exercise either of these, contact us by email using the details in "Contact" below; our team handles these requests on your behalf, as we do not currently offer a self-service download-or-delete portal.

When we act on a deletion request for a shopper, we remove or anonymize the shopper's identifying details (such as name and email), the associated shipping and billing addresses, the card brand and last four digits recorded on their orders, and any uploaded claim evidence files. A merchant user who wants to access or delete their own information can make the same request on the email channel above, and our team will handle it manually. Some records, such as claim and transaction history kept for financial and legal reasons, may be retained as permitted by law. We will tell you if we cannot fully complete a request and why.

Residents of other US states with comprehensive privacy laws may have similar rights, including the right to access, delete, or correct their personal information. You can make any of these requests on the same email channel, and if we deny a request you may ask us to reconsider it by replying to our response, which we will review. We will respond to verified requests within the time required by applicable law, and an authorized agent may submit a request on your behalf with proof that they are permitted to act for you.

California residents (CCPA/CPRA)

If you are a California resident, you may request to know and access the personal information we hold about you and request that we delete it. You also have the right not to be discriminated against for exercising these rights. As stated above, we do not sell your personal information and we do not share it for cross-context behavioral advertising. Any precise geolocation we hold is collected only as part of a shipping address and is used solely to provide and support the protection service, not to infer characteristics about you, so we do not offer a separate right to limit its use. To exercise your rights, contact us by email using the details in "Contact" below, and we will verify and process your request.

EU/EEA residents (GDPR)

If you are in the European Union or European Economic Area, you may request access to and a copy of your personal information (Article 15) and request its erasure (Article 17). You may also contact us to ask about other rights you may have under the GDPR, such as correction of inaccurate information and restriction of or objection to certain processing, and you may lodge a complaint with your local data protection authority. To make a request, contact us by email using the details in "Contact" below; we handle these requests directly rather than through an automated portal.

Merchanite is operated from the United States, and the service providers we use may also process information in the United States or other countries. If you access Merchanite from outside the United States, your information may be transferred to, stored in, and processed in the United States, where data protection laws may differ from those in your country. Where required, we use appropriate safeguards for international transfers of personal information.

Merchanite is intended for businesses and their adult customers. It is not directed to children, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us using the details in "Contact" below, and we will take appropriate steps to delete it.

Our website and app may contain links to third-party websites and services, including the merchant stores that use Merchanite and the providers we work with. We are not responsible for the privacy practices or content of those third parties. We encourage you to review the privacy policies of any third-party site or service you visit.

We may update this Privacy Policy from time to time to reflect changes in our practices, our service, or applicable law. When we make material changes, we will update the version or date shown with the policy and, where appropriate, provide additional notice. We encourage you to review this policy periodically to stay informed about how we protect your information.

If you have questions about this Privacy Policy or wish to exercise any of your privacy rights, please contact us by email using the address shown below. We are happy to help and will respond as promptly as we reasonably can.