Privacy Policy

This policy explains what personal data MerchReal (merchreal.com, "we") collects, why, who helps us process it, and the rights you have. We keep it short and only describe what the service actually does.

1. Who is responsible

MerchReal is the controller of your personal data. Contact us about privacy or your data at support@merchreal.com.

2. What we collect

• Account: your e-mail address and, if you add it, your name.
• Sign-in: one-time 6-digit codes (stored only as a scrambled hash, valid for 10 minutes) and a sign-in cookie for your session. If you sign in with Google, Google tells us your e-mail address, your name and that the address is verified. We never see your Google password.
• Your content: the photos, mockups and print files you upload, the photos and listing texts we generate for you, your project names and the settings you choose.
• Credits: your balance and a history of credits you received and used.
• Usage: when you last used the service, whether you signed in with Google or e-mail, and which main steps you took (opened the app, uploaded a file, created a listing, downloaded it). Only inside MerchReal, no third-party tracking.
• Technical and security data: your IP address and a random identifier that the site stores in your browser. We use them to stop abuse of free credits (for example, many accounts from one browser) and to limit repeated sign-in attempts. Our server also keeps short technical logs to fix errors.

We do not use advertising or analytics trackers and we do not sell your data.

3. Why we use it and on what legal basis

• To provide the service you asked for: your account, generations, projects and credits (performance of a contract).
• To understand how the service is used and improve it, from our own usage records (our legitimate interest).
• To keep the service secure and fair: sign-in limits and free-credit protection (our legitimate interest).
• To send e-mails you need to use the service, such as sign-in codes. We do not send marketing e-mails without your consent.

4. Who processes data for us

Provider	What for	Where
Oracle Cloud	Server that runs MerchReal and stores your account and projects	Frankfurt, Germany (EU)
Resend	Sending sign-in e-mails	EU (Ireland) and USA
OpenAI	Generating images from your uploads and settings	USA
Google	Google sign-in, and image generation when the Nano Banana model is used	USA and other locations
Cloudflare	Domain name service and forwarding of e-mails sent to our support address	Global
Stripe (Link)	Payments for credit packs, fraud prevention, sales tax and VAT. Stripe receives your card details directly; we only get the result of the payment, the amount and your e-mail	USA and EU

When data goes outside the EU (for example to the USA), it is protected by the providers' safeguards required by EU law, such as the EU-U.S. Data Privacy Framework or Standard Contractual Clauses.

5. How long we keep it

• Account, projects, images, credit history and usage records: until you delete them or your account.
• Sign-in codes: 10 minutes. Sessions: up to 30 days, or until you sign out.
• Free-credit protection records (browser identifier, IP address): up to 12 months, also after an account is deleted, so that free credits can't be claimed again and again.
• Records of sign-in attempts: up to 30 days. Server logs: a few weeks.

6. Cookies and browser storage

We use only what the site needs to work: a sign-in cookie (mr_session), a short-lived cookie during Google sign-in (mr_oauth), and your browser's local storage for the random identifier above and small preferences such as whether the menu is collapsed. No advertising or analytics cookies.

7. Your rights

Under the GDPR you can ask to access, correct, download or delete your data, restrict or object to its use, and withdraw consent you gave. You can delete your projects at any time and your whole account in Settings → Delete account; everything else, write to support@merchreal.com. You can also complain to a data protection authority, for example the Polish authority (UODO) or the one in your country.

8. Age

MerchReal is for people aged 18 and over. We don't knowingly collect data from children.

9. Security

Connections are encrypted (HTTPS), sign-in codes and sessions are stored only as hashes, and each user can see only their own projects and files.

10. Changes

If we change this policy, we will update the date above and, for important changes, tell you in the app or by e-mail.