Privacy Policy

Introduction and Scope

Merkanthub, Inc. ("Merkanthub," "we," "us," or "our") operates a commercial and operational intelligence platform that helps brands, merchants, e-commerce teams, agencies, and the stores they manage optimize their operations, analytics, and marketing. This Privacy Policy describes how we collect, use, disclose, and protect personal information when you use our platform, website, and related services (collectively, the "Services").

By accessing or using our Services, you acknowledge that you have read and understood this Privacy Policy. If you are using the Services on behalf of an organization, you represent that you have sufficient authorization to act on its behalf.

Information We Collect

Account Information

When you create an account, we collect your name, email address, organization name, and role. If you subscribe to a paid plan, we collect billing information through our payment processor.

Usage Data

We automatically collect information about how you interact with our Services, including pages visited, features used, timestamps, browser type, device information, and IP address.

Third-Party Platform Data

When you connect third-party services to Merkanthub, we access and process data from those services as authorized by you. The specific data accessed depends on the service and the permissions you grant. The categories of integrations we support include:

• E-commerce platforms (e.g., Shopify, VTEX) — product catalogs, orders, inventory, and customer data.
• Advertising platforms (e.g., Google Ads, Meta Ads, TikTok Ads) — campaign performance, ad spend, and conversion data.
• Email marketing platforms (e.g., Klaviyo) — campaign metrics, subscriber data, and engagement analytics.
• Analytics and SEO tools (e.g., Google Analytics, Google Search Console) — traffic data, search performance, and audience insights.
• Productivity tools (e.g., Google Drive, Calendar, Docs, Sheets) — documents, calendars, and spreadsheets for collaboration and workflow automation.
• Custom integrations — additional third-party services connected through our integration framework.

We may add support for additional third-party services over time. When you connect any new integration, the same data handling practices described in this Privacy Policy apply. We will access only the data necessary to provide the features you enable, and your data will be processed in accordance with the terms described herein. See the "Google API Services User Data" section below for specific details about Google service integrations.

Google API Services User Data

Merkanthub's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

When you connect your Google accounts, we may access data from the following services based on the permissions you grant:

• Google Analytics — Website traffic data, audience reports, and conversion metrics to help you understand your store performance.
• Google Ads — Campaign performance data, ad spend, and conversion tracking to optimize your advertising investment.
• Google Drive — Documents and files you choose to share with the platform for collaboration and workflow automation.
• Google Calendar — Calendar events for scheduling and coordinating marketing campaigns and operational tasks.
• Google Docs — Document content for collaborative editing and content management workflows.
• Google Sheets — Spreadsheet data for reporting, data analysis, and bulk operations management.
• Google Search Console — Search performance data, indexing status, and SEO insights to improve your organic visibility.

We only access data that is necessary to provide the features you have enabled. We do not use Google user data for advertising purposes, do not sell Google user data to third parties, and do not use it to build user profiles for unrelated purposes. For a detailed breakdown of our Google data practices, see our Google API Usage Disclosure.

Meta Platform Data

When you connect your Meta (Facebook/Instagram) business accounts to Merkanthub, we may access and process data from Meta services based on the permissions you grant. This includes:

• Meta Ads — Campaign performance metrics, ad spend, audience insights, and conversion tracking to optimize your advertising investment across Facebook and Instagram.
• Business account information — Business Manager assets, page data, and engagement metrics necessary to manage your advertising operations.

Our use of Meta data is subject to Meta's Platform Terms and Developer Policies. In accordance with these requirements:

• We do not sell data obtained from Meta.
• We do not use Meta data for surveillance, to build independent advertising products, or to transfer data to data brokers.
• Ad account data from one client is strictly isolated and never used to benefit another client. Each organization's Meta data is accessible only to authorized members of that organization.
• When you disconnect your Meta account or remove our application from your Meta settings, we stop accessing new data immediately. All cached Meta-sourced data is deleted within 30 days.
• You may request deletion of all Meta-sourced data at any time by contacting info@merkanthub.com or through the platform settings.

Shopify Store and Customer Data

When a merchant connects their Shopify store to Merkanthub, we access and process data from the Shopify Admin API based on the access scopes the merchant grants during installation. This data belongs to the merchant and, in part, to the merchant’s own customers; we act as a data processor on the merchant’s behalf. We access:

• Store operations data — products, variants, collections, inventory levels and locations, fulfillment and return records, discounts, draft orders, markets, and store configuration, used for reporting and for the operational actions you authorize.
• Order data — order contents, line items, totals, and financial and fulfillment status, used for analytics and operations.
• Protected customer data — customer name, email address, phone number, and shipping/billing address contained in customer records, orders, and draft orders. We request access to these fields only where a feature you enable requires them, and we handle them under Shopify’s Protected Customer Data requirements.

Our access to and use of Shopify data is governed by the Shopify API License and Terms of Use and the Shopify Protected Customer Data policy. In accordance with these requirements:

• Data minimization — we process only the minimum customer data required to provide the functionality you have enabled, and request only the access scopes those features need.
• No sale, no advertising, no profiling — we never sell Shopify customer data, never use it to build advertising products or profiles, and never transfer it to data brokers.
• Tenant isolation — each store’s data is strictly isolated and never used to benefit another store or agency; it is accessible only to authorized members of the organization that manages that store.
• AI processing — where Shopify data is processed by AI agents powered by third-party language model providers, it is subject to data processing agreements, is not used to train those models, and is limited to the purposes described above.
• Encryption — Shopify data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Shopify access tokens are stored in a dedicated secrets manager and are never stored in plaintext or in our application database.
• Deletion and redaction — we honor Shopify’s mandatory privacy webhooks. On a customer redaction request (customers/redact) we delete that customer’s personal data from our caches, materialized query results, and logs; on a customer data request (customers/data_request) we compile the data we hold; and when the app is uninstalled (shop/redact) we delete the store’s data and remove its access token. You may also request deletion at any time by contacting info@merkanthub.com.

How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Services.
• Generate analytics, reports, and AI-driven insights for your e-commerce operations.
• Process transactions and send related notices.
• Send technical notices, security alerts, and support messages.
• Respond to your requests, comments, and questions.
• Detect, prevent, and address fraud, abuse, and technical issues.
• Comply with legal obligations.

AI and Automated Processing

Merkanthub uses artificial intelligence (AI) agents to analyze data from your connected integrations and generate insights, recommendations, reports, and automated actions on your behalf. Our AI capabilities are powered by third-party large language model providers, selected based on the specific task requirements.

When your data is processed by AI:

• Only the data necessary for the specific task is sent to AI processing providers.
• AI providers are bound by data processing agreements that prohibit them from using your data to train their models.
• AI processing is always in service of features you have explicitly enabled — we do not process your data through AI for purposes you have not authorized.
• No fully autonomous decisions with legal or significant effects are made without human oversight.
• You can disable AI-powered features at any time through the platform settings.

Merkanthub improves how the Services work over time. What the platform learns is operational: which analysis methods, workflows, and tool sequences produce useful results. This learning is derived from de-identified usage patterns and does not carry your business data, your customers’ data, or organization-specific facts from one organization to another.

Context that our agents retain about your business (for example, your goals, working preferences, and operating context) is stored per organization, is accessible only to authorized members of that organization, and is deleted together with your data.

You have the right to request information about the logic involved in automated processing that affects you, and to contest decisions based on automated processing, as provided by applicable law.

Data Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

• With authorized members of your organization — Other users to whom the organization has granted appropriate access levels.
• With service providers — Trusted third-party service providers who assist us in operating the platform, subject to confidentiality obligations. A list of service provider categories is available upon request through our Data Processing Agreement.
• With AI processing providers — Third-party large language model providers that process your data to generate insights and recommendations, subject to data processing agreements that prohibit use of your data for model training.
• For legal compliance — When required by law, regulation, legal process, or governmental request.
• Business transfers — In connection with a merger, acquisition, or sale of assets, with notice to affected users.

Data Retention and Deletion

We retain your personal information for as long as your account is active or as needed to provide you the Services. When you disconnect a third-party integration, we stop accessing new data from that service. Cached data from disconnected integrations is deleted within 30 days unless retention is required for legal or contractual obligations.

You may request deletion of your account and associated data by contacting us at info@merkanthub.com. We will process your request within 30 days and confirm once deletion is complete. Some data may be retained in anonymized or aggregated form that cannot identify you.

Your Rights

Depending on your location, you may have the following rights regarding your personal information:

United States (CCPA / CPRA — California Residents)

• Right to know what personal information is collected and how it is used.
• Right to delete personal information held about you.
• Right to opt-out of the sale of personal information (we do not sell personal information).
• Right to non-discrimination for exercising your privacy rights.

Canada (PIPEDA)

• Right to access your personal information held by us.
• Right to challenge the accuracy and completeness of your data.
• Right to withdraw consent for data processing.

Mexico (LFPDPPP)

• ARCO rights: Access, Rectification, Cancellation, and Opposition regarding your personal data.
• Right to revoke consent previously granted for data processing.

Colombia (Habeas Data Law)

• Right to know, update, and rectify your personal data.
• Right to request proof of consent granted to Merkanthub.
• Right to revoke consent and request deletion when applicable.

Brazil (LGPD)

• Right to confirmation of data processing and access to your data.
• Right to correction of incomplete, inaccurate, or outdated data.
• Right to anonymization, blocking, or deletion of unnecessary or excessive data.
• Right to data portability.

Argentina (Law 25.326)

• Right to request information about and access your personal data.
• Right to request the rectification, update, or deletion of data that is inaccurate, outdated, or processed without a valid basis.
• Right to request that certain data be kept confidential where applicable.

Chile (Laws 19.628 and 21.719, as in force)

• Right to access your personal data and to know its origin, recipients, and purpose.
• Right to request the rectification or update of inaccurate or incomplete data.
• Right to request the deletion, objection, blocking, or portability of your data where applicable.

Peru (Law 29733)

• ARCO rights: Access, Rectification, Cancellation, and Opposition regarding your personal data.
• Right to revoke consent and to request information about the processing of your data.

Ecuador (Organic Law on Personal Data Protection)

• Right to access your data and to request its rectification or update.
• Right to request deletion, to object to processing, or to request its suspension where applicable.
• Right to portability and not to be subject to decisions based solely on automated processing, in the cases provided by law.

European Union and European Economic Area (GDPR)

• Right to be informed about and to access your personal data.
• Right to request rectification, erasure, or restriction of processing.
• Right to data portability and to object to certain processing.
• Right to withdraw consent and not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects, subject to the exceptions provided by law.
• Right to lodge a complaint with the competent data protection authority.

To exercise any of these rights, contact us at info@merkanthub.com. We will respond within the timeframe required by applicable law.

International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States. When we transfer data internationally, we implement appropriate safeguards in compliance with applicable data protection laws, including standard contractual clauses where required.

Data Security

We implement industry-standard technical and organizational measures to protect your information, including encryption of data in transit and at rest, access controls based on the principle of least privilege, regular security assessments, and secure credential management. While no system is completely secure, we are committed to protecting your data and promptly addressing any security incidents.

Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to improve your browsing experience and analyze site traffic. The types of cookies we use include:

• Essential cookies — Required for basic site functionality, such as language preference.
• Analytics cookies — Help us understand how visitors interact with our website. We use Google Analytics to collect anonymized usage data.

You can control cookies through your browser settings. Disabling certain cookies may limit the functionality of our website.

Children's Privacy

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected data from a child, we will take steps to delete it promptly.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by updating the effective date at the top of this page and, where required by law, by sending you a notice via email or through the platform. We encourage you to review this page periodically.

Contact Information

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at:

Merkanthub, Inc. Email: info@merkanthub.com