Privacy Policy

Our role differs depending on who you are:

For registered Merchants, MerchXO is a Data Controller. We control how your account information, billing details, and store configuration data are processed in order to provide the Service.

For end-consumers purchasing through a Merchant's store, MerchXO is a Data Processor. Your personal data is collected by, and belongs to, the Merchant whose store you are shopping in. MerchXO processes that data solely on the Merchant's instructions and under the Merchant's control, and we do not use that data for our own purposes. The Merchant is the controller of that data and is responsible for their own privacy notices and compliance.

Merchants are required, under our Terms of Service, to maintain their own privacy policy and to comply with all applicable data-protection laws governing their end-customers.

Merchant personal & business identification. When you register, we collect your name, email address, organization name, billing address, payment identifiers, tax identification numbers where required for invoicing or compliance, and login credentials (stored securely, never in plain text).

Merchant end-customer data. When your customers place orders through your store, the transaction data — including shipping addresses, order details, contact information, and transaction metadata — is stored within your store's isolated database. We process this data only as a processor on your behalf.

Automated log and technical data. When you or your customers interact with the Service, we automatically collect log data such as IP addresses, device and browser information, pages visited, API telemetry, and error reports. This data helps us operate, secure, and improve the Service.

Cookies and similar technologies. We use essential cookies for authentication, session management, and security. We do not use advertising or cross-site tracking cookies on our marketing pages. Where non-essential analytics cookies are used, we obtain the appropriate consent as required by law.

Isolated storage. Merchant end-customer data is stored in the Merchant's own dedicated database instance (database-per-tenant architecture), isolated from the data of all other Merchants.

Encryption. Data is encrypted in transit using TLS 1.3 (or equivalent) and is encrypted at rest using industry-standard encryption.

Access controls. Access to stored data is limited to authorized personnel and only as needed to operate, maintain, or support the Service. We do not access Merchant end-customer data except to the extent necessary to provide the Service or where required by law.

Processing location. Data may be processed in the United States and in secure facilities located in other regions we use to provide the Service. Where we transfer personal data across borders, we rely on appropriate safeguards, including Standard Contractual Clauses where required by law.

We do not sell personal information, and we do not share it with third parties except in the limited circumstances described below:

• Payment processors / merchants of record. Stripe, Paddle, Lemon Squeezy, and local payment gateways process payments and may receive the payment data needed to complete a transaction. These providers handle payment information under their own privacy policies and processing agreements.
• Infrastructure providers. Cloud hosting, database, CDN, and other infrastructure vendors that host the Service and store data on our behalf.
• Shipping carriers. When you or your customers use shipping features, the data required to prepare and deliver a shipment (for example, the recipient's name and address) may be shared with the selected carrier.
• Analytics and support tools. Aggregated, non-identifying analytics and customer-support tools that help us operate and improve the Service.
• Legal and safety. Government authorities or other third parties where we are required to do so by law, regulation, legal process, or to protect the rights, property, or safety of MerchXO, our customers, or the public.

Each third party is contractually required to use the data only for the purposes we specify and to protect it with appropriate security measures.

Depending on your location and applicable law, you may have the following rights in relation to your personal data:

• Access: request a copy of the personal data we hold about you.
• Rectification: request correction of inaccurate or incomplete data.
• Data portability / export: request your data in a structured, commonly used, machine-readable format.
• Erasure ("Right to be Forgotten"): request deletion of your personal data, subject to legal retention obligations.
• Restriction and objection: request that we restrict or stop certain processing.
• Withdraw consent: where processing is based on consent, withdraw it at any time.

Merchants may exercise these rights by contacting us at the details below, or directly through their store settings.

End-customers should first contact the Merchant whose store they used. If the Merchant is unable to resolve the request, or where permitted, end-customers may also submit a data-subject request to us directly at [email protected]. Because we are a processor for that data, we will coordinate with the relevant Merchant to fulfill the request.

We respond to verifiable requests without undue delay and no later than one month after receipt, as required by applicable law. You also have the right to lodge a complaint with your local supervisory authority if you believe we have processed your data unlawfully.

Retention. We retain Merchant account data for as long as your account is active, and thereafter for as long as needed to comply with legal obligations, resolve disputes, and enforce our agreements. Merchant end-customer data is retained according to the Merchant's instructions and the retention schedule configured for the store, and is deleted when the Merchant deletes it or when the Merchant's subscription is terminated (subject to the data-export and recovery periods described in our Terms of Service).

Security. We implement technical and organizational measures designed to protect personal data, including encryption in transit and at rest, access controls, network monitoring, and routine security reviews. While we take these measures seriously, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

For Merchants who require it, we make available a Data Processing Addendum (DPA) incorporating EU Standard Contractual Clauses. Merchants may request the DPA and a current list of sub-processors by contacting us at the details below. We will provide reasonable prior notice of any change to our sub-processors.

We may update this Privacy Policy from time to time. We will post the updated policy on this page and update the "Last updated" date. For material changes, we will use reasonable efforts to notify you by email or through the Service. Continued use of the Service after the changes take effect constitutes acceptance of the updated policy.

Questions, concerns, or requests regarding this Privacy Policy or your data can be sent to:

MerchXO — Data Protection
Email: [email protected]
Or through our contact page.