Privacy Policy

1. What we collect

When you buy something: your name, email address and shipping address; what you ordered and what you paid. Your card details go directly to Stripe and never reach our servers — we receive only the last four digits and card brand.

When you open a shop: your name, email address and password (stored only as a secure hash by our sign-in provider); your business’s name, location, description, website and social handles; the logos and artwork you upload; and your prices and settings. To pay you, Stripe collects identity and bank details for verification. We receive your verification status and payout records, not your full bank account or tax identification numbers.

When you send us a complaint or request: the contact details and information you include, such as a copyright notice or counter-notice.

Automatically: the pages you request, your IP address and browser information in our hosting provider’s server logs, and the cookies described below. To stop card-testing fraud we log the email address and a one-way hash of the IP address used for each checkout attempt, and delete the log after about two days.

2. How we use it

• To take payment, have your order printed and shipped, and send you order updates.
• To answer questions, handle reprints and refunds, and resolve disputes.
• To run shops: sign-in, the dashboard, payouts, and sales reports showing each shop how it is doing.
• To review shops and artwork for trademark and copyright problems, and to act on complaints.
• To prevent fraud and abuse and keep the Service secure.
• To meet legal, tax and accounting obligations.
• To understand and improve how the Service is used, using aggregate information.

We do not use your information for targeted advertising, and we do not sell it or share it for cross-context behavioral advertising.

3. Who we share it with

The shop you buy from sees your name, shipping address, email and the details of your order, so they can recognize their customers and help with questions. The Seller Agreement lets them use it only for that, and forbids selling it or adding you to marketing lists without your separate consent.

Service providers who process information on our behalf, under contracts that limit their use of it:

Rights holders. If a shop files a counter-notice to a copyright complaint, the law requires us to send it, including the shop’s contact details, to the person who complained.

For legal reasons. When we believe in good faith that the law requires it, or to protect the rights, property or safety of our users, the public or The Merch Counter.

In a business transfer. If The Merch Counter is merged, acquired or sells its assets, information may transfer to the new owner, who will be bound by this policy.

4. Cookies

We use only the cookies the Service needs to work:

• Sign-in cookies that keep a shop owner signed in, and a small cookie that tells the page header whether to show “Dashboard” or “Sign in”.
• Cart cookies that remember what is in your cart for each shop.
• Stripe’s cookies on the payment step, which Stripe uses to prevent fraud.

We do not use advertising or cross-site tracking cookies. Blocking the cookies above will stop the cart and sign-in from working.

5. How long we keep it

• Order records, including name, address and what was bought, are kept for seven years because tax and accounting law requires it.
• Shop accounts and their content are kept while the shop is open, and deleted or anonymized within 90 days of closing, except records we must keep for orders, payouts, tax or a legal claim — including records of artwork removed after a complaint.
• The checkout-attempt log used against card fraud is deleted after about two days.
• Server logs are kept by our hosting provider for a limited period.

6. Your choices and rights

Wherever you live, you can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Email privacy@themerchcounter.com from the address you used with us. We will confirm the request is yours before acting on it and respond within 45 days. We may keep information we are legally required to keep, and will tell you if so.

California and other US states with privacy laws. Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states with comprehensive privacy laws have the rights above to know, access, correct and delete, plus the right to opt out of the sale or sharing of personal information and of targeted advertising. We do not sell or share personal information or engage in targeted advertising, so there is nothing to opt out of; we honor Global Privacy Control signals regardless. We do not use sensitive personal information to infer characteristics about you. You may use an authorized agent, and we will not treat you differently for using any of these rights. If we decline a request you may appeal by replying to our decision, and if you remain unsatisfied you may contact your state attorney general.

In the past twelve months we have collected the categories described in section 1 — identifiers, commercial information, internet activity, and, for shops, professional information — from the sources and for the purposes described above, and disclosed them for business purposes only to the recipients in section 3.

7. Children

The Merch Counter is not directed to children under 13 and we do not knowingly collect their information. Shops must be opened by adults. If you believe a child has given us personal information, contact us and we will delete it.

8. Security and location

We protect information with encryption in transit, access controls that limit staff access to what their job needs, and providers with established security programs. No system is perfectly secure, and we will notify you of a breach affecting your information as the law requires. The Service is operated in the United States and information is stored there.

9. Changes and contact

If we change this policy materially we will post the new version here and, where appropriate, tell you by email before it takes effect. Questions or requests: privacy@themerchcounter.com, or by mail to [Company legal name], [Registered business address].