PRIVACY POLICY

Last updated 7 October 2026

This Privacy Notice is provided by MERCHI.AI LIMITED (company number 16246476), whose registered office is at 128 City Road, London, EC1V 2NX (‘we’, ‘us’, or ‘our’). It describes how and why we collect, store, use, and share (‘process’) your personal information when you:

Visit our website at https://merchi.ai, or any website of ours that links to this Privacy Notice
Use the merchi.ai platform, which helps retailers drive revenue growth and reduce costs through AI-powered product content and merchandising automation
Use the merchi.ai Snap mobile app
Engage with us in other ways, including sales, marketing, or events

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are the controller responsible for decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you have any questions or concerns, please contact us at privacy@merchi.ai.

SUMMARY OF KEY POINTS

This summary provides key points from our Privacy Notice. You can find more detail by reading the full notice below.

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the features you use.
Do we process any sensitive personal information? No. We do not process special category data such as racial or ethnic origins, sexual orientation, or religious beliefs.
Do we collect information from third parties? Yes, in limited circumstances. For business contacts and prospecting purposes we may obtain your name, job title, employer, and business email address from sources such as LinkedIn, Apollo.io, and Hunter.io. See the Business contacts and prospects section for more detail.
How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with the law. We process your information only when we have a valid legal basis to do so.
With whom do we share personal information? We may share information in specific situations and with specific third parties, including our subprocessors listed in the DPA. We do not sell personal information.
International transfers: Some of our subprocessors are based in the United States. We ensure appropriate safeguards are in place for any transfer of personal data outside the UK or EEA.
How do we keep your information safe? We have appropriate organisational and technical measures in place to protect your personal information. However, no electronic transmission or storage technology can be guaranteed to be 100% secure.
What are your rights? Depending on where you are located, you may have rights to access, correct, delete, or object to the processing of your personal information. See the Your privacy rights section for more detail.
How do you exercise your rights? Contact us at privacy@merchi.ai. We will respond to all requests in accordance with applicable data protection laws.

WHAT INFORMATION DO WE COLLECT?
HOW DO WE PROCESS YOUR INFORMATION?
WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?
WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?
HOW DO WE HANDLE SINGLE SIGN-ON?
INTERNATIONAL TRANSFERS OF PERSONAL DATA
HOW LONG DO WE KEEP YOUR INFORMATION?
HOW DO WE KEEP YOUR INFORMATION SAFE?
DO WE COLLECT INFORMATION FROM MINORS?
WHAT ARE YOUR PRIVACY RIGHTS?
COOKIES AND SIMILAR TECHNOLOGIES
DO WE MAKE UPDATES TO THIS NOTICE?
HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register for or use the Services, express an interest in obtaining information about us or our products, or otherwise contact us.

The personal information we collect may include the following:

Names
Email addresses
Job titles
Employer
Phone numbers
Billing addresses
Usernames
Passwords (stored only in hashed form by our authentication provider, Supabase)

Sensitive information. We do not process sensitive information.

Payment data. We collect limited payment information necessary to process your subscription, such as billing address and the last four digits of your card. Full card numbers and security codes are collected and stored directly by Stripe, our payment processor. You can find Stripe’s privacy notice at https://stripe.com/gb/privacy.

Single sign-on. If you sign in using single sign-on (for example Google or Microsoft), we receive your name, email address and account identifier (and, where provided, your profile picture) from the identity provider. We use this information only to authenticate you and manage your account, and we do not access any other data held in that account. Where you sign in with Google, our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes.

Business contacts and prospects

If you are a business contact or prospect, we may hold your name, job title, employer, and business email address. We obtain this information from publicly available sources (such as LinkedIn and company websites) or from data enrichment services (such as Apollo.io and Hunter.io). We process this information on the basis of our legitimate interests in marketing our services to businesses. You have the right to object to this processing at any time by contacting privacy@merchi.ai. When we first contact you, and in any event within one month of obtaining your details, we will tell you who we are, where we obtained your details and how to object. If you ask us to stop, we will delete your details, keeping only the minimum needed to make sure we do not contact you again.

Information automatically collected

In Short: Some information is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity but may include device and usage information. This information is primarily needed to maintain the security and operation of our Services and for internal analytics.

Log and usage data. Our servers automatically collect information when you access or use the Services, including your IP address, browser type, device information, pages viewed, features used, and timestamps.

Device data. We collect information about the device you use to access the Services, including IP address, browser type, operating system, and system configuration.

Location data. We collect your approximate location based on your IP address. We do not collect precise GPS location data.

Session data. When you sign in to the app, we store a session token on your device. This is strictly necessary to keep you signed in and does not require your consent under the Privacy and Electronic Communications Regulations 2003.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.

We process your personal information for the following purposes:

To create and manage your account. We process your information so you can sign in, manage your account settings, and keep your account in working order.
To deliver our Services. We process your information (and the product data you upload) to operate the platform and generate product content on your behalf. Where your data is used as input to an AI model, this is to produce outputs for you. We do not currently use it to train AI models (see Section 5).
To process your subscription and payments. We process your billing information to manage your subscription, generate invoices, and handle payments via Stripe.
To communicate with you about your account and the Services. We may contact you with important notices, security alerts, updates to our terms or policies, and support messages.
To respond to your support requests. We process your information to respond to enquiries and resolve issues you raise via our support channels.
To request feedback. We may contact you to ask about your experience using the Services.
To send marketing communications. We may contact business prospects and existing customers about our products and services where we have a legitimate interest in doing so or where you have opted in. You can opt out at any time. See ‘WHAT ARE YOUR PRIVACY RIGHTS?’ for details.
To improve and develop the Services. We may process aggregated and anonymised usage data to analyse trends, diagnose technical issues, and improve platform performance and features.
To comply with legal obligations. We may process your information where required to comply with applicable law, respond to legal process, or protect the rights of merchi.ai or others.

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?

In Short: We process your personal information only where we have a valid legal basis to do so under UK GDPR and, where applicable, EU GDPR.

The legal bases we rely on are:

Performance of a contract. We process your information where it is necessary to provide the Services to you under our agreement, including creating and managing your account, delivering the platform, and processing your subscription payments.
Legitimate interests. We process your information where it is necessary for our legitimate interests (or those of a third party), provided those interests are not overridden by your rights. We rely on this basis to: market our services to business contacts and prospects; request feedback from customers; send service communications to users; analyse aggregated usage data to improve the platform; and protect the security and integrity of our systems.
Consent. Where you have opted in to receive marketing communications, we process your information on the basis of your consent. You can withdraw your consent at any time by clicking ‘unsubscribe’ in any marketing email or by contacting us at privacy@merchi.ai. Withdrawing consent does not affect the lawfulness of any processing carried out before withdrawal.
Legal obligation. We process your information where we are required to do so by law, including to cooperate with regulatory authorities, respond to lawful requests for information, or exercise or defend legal claims.

We do not process your information on the basis of vital interests in the ordinary operation of our Services.

If you have questions about the specific legal basis we rely on for any particular processing activity, please contact us at privacy@merchi.ai.

In Short: We share your information only with third-party service providers who help us operate the Services, and in the limited circumstances described below.

Service providers. We share your data with third-party vendors and service providers who perform functions on our behalf. In each case, we ensure these providers are bound by appropriate data protection agreements. Our current service providers include:

Provider	Purpose	Location
Stripe	Subscription billing and payment processing	UK/EU
Supabase	Database hosting	EU (Frankfurt)
Vercel	Application hosting, edge functions and website analytics	EU
OpenRouter	AI model routing (zero data retention)	US
Trigger.dev	Background job orchestration	UK (company) / EU (data)
Bright Data	Web data collection for product enrichment	Israel
Aptabase	Mobile app analytics	EU
Google Workspace	Business email	EU
ClickUp	Customer support	US
Apollo.io	Business contact enrichment (prospects only)	US
Hunter.io	Business contact email verification (prospects only)	EU

Where providers are located outside the UK or EEA, appropriate transfer safeguards are in place. See Section 7 — International Transfers of Personal Data for details.

Business transfers. We may share or transfer your information in connection with a merger, sale of company assets, financing, or acquisition of all or part of our business. You will be notified of any such transfer where required by law.

Legal disclosure. We may disclose your information where required by law, regulation, legal process, or governmental request, or where we believe disclosure is necessary to protect the rights, property, or safety of merchi.ai, our customers, or others.

We do not sell your personal information. We do not share your personal information with third parties for their own marketing purposes.

5. DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?

In Short: Yes. Our core platform uses AI to generate and enhance product content on behalf of our business customers.

How our AI works

Our platform uses AI to generate product descriptions, attributes, and related content from product data that our customers provide. This is the core function of the Services.

AI requests are routed through OpenRouter, an AI gateway service operating under a zero data retention (ZDR) policy. OpenRouter routes requests to underlying model providers, which may include Anthropic, Google Cloud AI, and OpenAI. These providers process data only to generate a response and do not retain, store, or use API-tier request data to train their models.

What data is sent to AI providers

The data sent to AI providers consists primarily of product information (names, descriptions, specifications, imagery) provided by our customers. This data may incidentally include personal information if, for example, a product description references an individual or a customer’s dataset includes contact details. We recommend customers avoid uploading personal data to the platform where it is not necessary for the content generation task.

AI model training

We do not currently use customer data to train, fine-tune or improve AI models, and our AI providers do not use it to train theirs. Our customer contracts allow us in future to use anonymised and aggregated data, which no longer identifies any person or business, to improve our own models. If we decide to do that, we will update this notice and give our business customers at least 30 days’ notice and the option to opt out first. Any configuration or context data used to improve the quality of outputs for a specific customer is stored and processed solely for that customer’s benefit and is not shared with or accessible by any other party.

Our AI products

Our AI-powered features include:

Product description generation and enrichment
Attribute extraction and classification
Merchandising automation

A full list of our AI subprocessors is published in our Data Processing Agreement.

6. HOW DO WE HANDLE SINGLE SIGN-ON?

In Short: If you sign in using a third-party identity provider such as Google or Microsoft, we receive limited profile information from that provider to authenticate you.

The Services support single sign-on (SSO), which allows you to log in using an existing account with a supported identity provider (currently Google and Microsoft). If you use SSO, the identity provider will share your name, email address, and account identifier (and, where provided, your profile picture) with us. We use this information only to create or authenticate your account.

We do not receive access to your identity provider account beyond what is necessary to verify your identity. We do not access your contacts, calendar, files, or any other data held in your identity provider account.

Where you sign in with Google, our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

7. INTERNATIONAL TRANSFERS OF PERSONAL DATA

In Short: Some of our service providers are based outside the UK and EEA. We ensure appropriate safeguards are in place for all such transfers.

Some of the third parties listed in Section 4 are located in countries outside the United Kingdom and the European Economic Area. Where we transfer personal data to these countries, we ensure that an appropriate transfer mechanism is in place as required by UK GDPR Article 46.

Transfers within the EEA and to adequate countries. Transfers of personal data to countries that have received a UK adequacy decision (including all EEA member states and Israel) are permitted without additional safeguards. Our primary hosting infrastructure (Supabase and Trigger.dev in Frankfurt and Vercel EU functions) falls within this category.

Transfers to the United States. Some of our service providers process data in the United States, including OpenRouter, ClickUp and Apollo.io, and some EU-hosted providers (such as Supabase) may access data remotely from the United States for support purposes.

OpenRouter. In addition to contractual safeguards, OpenRouter operates a zero data retention (ZDR) policy for API requests routed through the Services. Data is not stored or logged beyond the generation of a response.

You may request a copy of the relevant transfer safeguards by contacting us at privacy@merchi.ai.

8. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We retain your information for as long as necessary to fulfil the purposes described in this Privacy Notice, and for as long as required by law.

Our retention periods by category are:

Category	Retention period
Account and profile data	Duration of your subscription, plus 12 months to allow for reactivation
Content you upload and content we generate for you	For the duration of your subscription, then deleted within a reasonable period after it ends (including from backups as they expire)
Billing and financial records	6 years from the end of the relevant financial year (HMRC requirement)
Support and correspondence records	2 years from resolution of the matter
Business contact and prospect data	Until you object to processing, or 2 years from our last meaningful contact, whichever is earlier
Aggregated and anonymised analytics	Indefinitely (no personal data retained)

When a retention period expires, we will securely delete or anonymise your personal information. Where deletion is temporarily not possible (for example, because data is held in backup archives), we will isolate it from further processing until deletion can be completed.

You may request early deletion of your personal information at any time. See Section 11 (Your Privacy Rights) for details.

9. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We use a combination of technical and organisational measures to protect your personal information.

We have implemented appropriate technical and organisational measures to protect the security of personal information we process. These include:

Encryption in transit and at rest. All data transmitted to and from the Services is encrypted using TLS. Data stored in our database is encrypted at rest.
Secure sign-in. Sign-in is handled by Supabase Auth, using either single sign-on (Google or Microsoft) or an email address and password. Passwords are stored only as one-way hashes, and we never see them in plain text.
Payment data isolation. Card and payment data is handled exclusively by Stripe and is never stored on our systems.
Access controls. Access to production systems and customer data is restricted to authorised personnel on a least-privilege basis.
Subprocessor obligations. All third-party service providers who handle personal data on our behalf are contractually required to maintain appropriate security standards. See Section 4 for our subprocessor list.
Cyber insurance. We maintain cyber liability insurance to support our response to data security incidents.

Despite these measures, no method of electronic transmission or storage is completely secure. In the event of a personal data breach affecting your rights and freedoms, we will notify you and, where required, the Information Commissioner’s Office (ICO) in accordance with our obligations under UK GDPR.

If you become aware of any security vulnerability or incident relating to the Services, please contact us immediately at privacy@merchi.ai.

10. DO WE COLLECT INFORMATION FROM MINORS?

In Short: No. The Services are for business use only and are not directed at individuals under 18.

The Services are provided exclusively to businesses and are not directed at, or intended for use by, individuals under the age of 18. Users must be at least 18 years old and acting in a professional capacity on behalf of a business to use the Services. We do not knowingly collect personal information from anyone under 18.

If we become aware that a user is under 18, we will deactivate the relevant account and delete any associated personal information promptly. If you believe we may hold data relating to an individual under 18, please contact us at privacy@merchi.ai.

11. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: Under UK GDPR, you have rights over your personal information and can exercise them by contacting us at privacy@merchi.ai.

Your rights

You have the following rights in relation to your personal information:

Right of access. You may request a copy of the personal information we hold about you.
Right to rectification. You may ask us to correct inaccurate or incomplete personal information.
Right to erasure. You may ask us to delete your personal information where we no longer have a lawful basis to retain it.
Right to restriction. You may ask us to restrict processing of your personal information in certain circumstances, for example while a dispute is being resolved.
Right to data portability. Where we process your personal information by automated means on the basis of your consent or a contract, you may request a machine-readable copy of your data.
Right to object. You have the right to object to processing carried out on the basis of our legitimate interests, including direct marketing. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests.
Rights relating to automated decision-making. You have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Our AI features generate product content on behalf of your business and do not make automated decisions about individuals.

To exercise any of these rights, contact us at privacy@merchi.ai. We will respond within one month of receiving your request, as required by UK GDPR Article 12.

Where we rely on consent as the lawful basis for processing (currently, marketing communications), you may withdraw your consent at any time by clicking ‘unsubscribe’ in any marketing email or by contacting us at privacy@merchi.ai. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Opting out of marketing

You may unsubscribe from marketing communications at any time by clicking the unsubscribe link in any marketing email or by contacting us at privacy@merchi.ai. You will continue to receive service-related communications necessary for the operation of your account.

Right to complain

If you believe we are processing your personal information unlawfully, you have the right to complain to the Information Commissioner’s Office (ICO):

Online: ico.org.uk/make-a-complaint
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

merchi.ai Limited is registered with the ICO under registration number ZC017588.

12. COOKIES AND SIMILAR TECHNOLOGIES

In Short: We use strictly necessary cookies to operate the Services. We do not use advertising or tracking cookies.

What we use

Cookie / token	Purpose	Type	Duration
Session token	Keeps you signed in after you log in	Strictly necessary	Until you sign out or the session expires
CSRF token	Protects against cross-site request forgery	Strictly necessary	Session
Preference cookies	Remembers your account settings (e.g. language, display preferences)	Strictly necessary	12 months

Analytics

We use privacy-focused analytics to understand how our website and app are used:

Website: Vercel Web Analytics. It sets no cookies and stores nothing on your device. Visits are counted using a hash of request data that is discarded after 24 hours, and we see only aggregated statistics such as pages viewed, referring site, country, device type and browser.
Mobile app: Aptabase. It collects no device identifiers. Sessions are counted using a hash of your IP address and app details combined with a value that changes every 24 hours, and we see only aggregated statistics. Aptabase stores this data in the European Union.

We use this information only to understand and improve the Services. Neither tool stores or reads information on your device for tracking, and the data we receive cannot identify you, so we do not ask for consent. If you have any questions or concerns about our analytics, contact privacy@merchi.ai.

What we do not use

We do not use advertising cookies, third-party tracking pixels, or any technology designed to track your browsing activity across other websites.

Managing cookies

The session and CSRF cookies listed above are strictly necessary for the Services to function. You cannot opt out of these while using the Services. You may delete cookies at any time via your browser settings, but doing so will sign you out of your account.

If you have questions about our use of cookies, contact us at privacy@merchi.ai.

13. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes. We will notify you of material changes.

We may update this Privacy Notice from time to time. The current version is identified by the “Last updated” date at the top of this page.

Where changes are material (for example, a new category of personal data, a new purpose for processing, or a new subprocessor in a sensitive location), we will notify you by email or by a prominent notice within the Services at least 14 days before the change takes effect. Your continued use of the Services after that date constitutes acceptance of the updated notice.

For minor or administrative changes (such as updated contact details or clarifications that do not affect your rights), we will update the page without separate notification.

14. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, or wish to exercise your privacy rights, please contact us:

By email: privacy@merchi.ai

By post:

MERCHI.AI LIMITED 128 City Road London EC1V 2NX United Kingdom

We aim to respond to all privacy enquiries within 5 business days.

If you are not satisfied with our response, you have the right to raise a complaint with the Information Commissioner’s Office (ICO). See Section 11 for details, or contact the ICO directly at ico.org.uk/make-a-complaint.

15. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Account settings. You can review and update your name, email address, and account preferences directly within your account settings at any time.

Formal requests. To request access to, correction of, or deletion of your personal information, contact us at privacy@merchi.ai. We will respond within one month, as required by UK GDPR. See Section 11 for the full list of your rights and how we handle requests.

Account closure. To close your account and request deletion of your data, contact your account manager or email privacy@merchi.ai. We will delete your personal information in accordance with the retention periods set out in Section 8, subject to any legal obligations to retain records.