Privacy Policy

1. Who we are

The controller of the personal data described here is WaveSync NY LLC, registered in New York, United States. Contact us about privacy at privacy@merchvio.com.

2. Our two roles

As a controller, we decide how to use the data about our own customers and website visitors: your account, billing, support conversations and security logs. This policy covers that data.

As a processor, we store and process the data you put into your workspace (for example your buyers' names and addresses, your suppliers and your staff) only on your instructions. Your business is the controller of that data, and our Data Processing Agreement applies to it. If you are one of our customer's buyers or staff, please contact that business first.

3. What we collect

• Account details: your name, work email, password (stored only as a secure hash), business name, country, VAT or tax number, and whether you sign up as a business.
• Billing details: plan, currency, invoices and payment status. Card details are entered on Stripe's checkout page and kept by Stripe; we see only the card type, last four digits and expiry date.
• Security and usage records: sign-in times, IP address, browser and device, two-step settings, and the audit log of actions in your workspace.
• Messages: what you send us by email or support request.
• Website visits: our web server records the IP address, page and time of each request for security and fault-finding. We do not use analytics or advertising tools and we do not track you across other websites. See our cookie notice.

4. How we use it and why

We do not sell personal data, we do not use it for advertising, and we do not make decisions about you by automated means that have legal or similarly significant effects.

5. Who we share it with

We share personal data only with the companies that help us run the service (listed on our sub-processors page), with professional advisers such as accountants and lawyers under confidentiality, with authorities when the law requires, and with a buyer if the business is sold, who must keep this policy.

6. International transfers

WaveSync NY LLC is based in New York, United States, and some of our providers are in other countries. When personal data from the UK or the European Economic Area goes to a country without an adequacy decision, we protect it with the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or the EU-US Data Privacy Framework and its UK Extension where the recipient is certified.

7. How long we keep it

• Account and workspace data: while your account is open, then 30 days after your paid period ends so you can export it, after which it is deleted.
• Billing and tax records: as long as tax law requires, usually 7 years.
• Security logs and web server logs: up to 12 months.
• Support messages: up to 2 years after the conversation ends.
• Backups: deleted data can remain in encrypted backups until they are overwritten, normally within 35 days.

8. Your rights (UK and EU)

You can ask us to give you a copy of your personal data, correct it, delete it, limit how we use it, send it to you or another provider in a common format, or stop using it where we rely on legitimate interests. Where we rely on consent, you can withdraw it at any time. Email privacy@merchvio.com. We reply within one month and may need to confirm your identity.

You can complain to a data protection authority: in the UK the Information Commissioner's Office (ico.org.uk), or in the EU the authority where you live or work. We would appreciate the chance to put things right first.

9. Asking us to delete your data

You can ask us to delete personal data at any time, whether you are one of our customers, someone who wrote to us, or a person whose details sit in a customer's workspace. How to ask, and what happens, depends on which of our two roles applies.

If you are our customer, or you have written to us

1. Email privacy@merchvio.com from the address on your account, with the word Deletion in the subject, and say whether you want your whole account deleted or only particular data.
2. We confirm within 5 working days and may ask one question to be sure it is really you. We never ask for your password.
3. We delete the data within 30 days of agreeing what is to go, and write to you when it is done.

You can also close your account yourself in Settings › Billing. Closing it starts the same clock: your workspace stays readable for 30 days after your paid period ends so you can export what you need, and is then deleted.

If your details are in a customer's workspace

If you are a buyer, supplier or member of staff of a business that uses Merchvio, that business decides what happens to your data and we act only on its instructions. Please ask that business first - they can delete your records themselves, straight away. If you do not know who they are, or they do not reply, write to us at privacy@merchvio.com and we will pass your request on and tell you we have done so.

If you connected an advertising or sales channel account

If you connected an outside account (for example a Facebook or Instagram ad account, a marketplace or a shop) to your workspace, disconnecting it in Channels immediately deletes the access token we held and stops any further reading. To delete the figures already imported as well, ask us as above, or delete the connection's data from the channel's own screen.

What we have to keep, and for how long

Deletion is not always total, and we would rather say so than surprise you:

• Invoices and tax records stay for as long as tax law requires, usually 7 years. We cannot delete these on request.
• Security logs showing sign-ins and administrative actions stay up to 12 months, because they are how we investigate abuse of other people's accounts.
• Encrypted backups are overwritten on their own schedule, normally within 35 days. Deleted data can sit in them until then; it is not restored into the live service.
• Where we must keep something, we keep only that, and we use it only for the reason it was kept.

Deletion is free, and asking for it never changes how we treat you. If we refuse a request, we say which exception applies and you can complain to a data protection authority (see your rights). California residents have the same deletion right under section 10.

10. California residents

This section applies to California residents under the California Consumer Privacy Act as amended by the CPRA, including people who use the service for their business.

• Categories we collect: identifiers (name, email, IP address), commercial information (plan and billing history), internet activity (sign-ins and use of the service) and professional information (business name and role). Sources: you, your use of the service, and Stripe.
• Why: the purposes in section 4.
• Selling and sharing: we do not sell personal information and do not share it for cross-context behavioral advertising. We do not knowingly collect information from anyone under 16.
• Sensitive information: we use account passwords only to sign you in, and do not use sensitive information for any other purpose.
• Your rights: to know what we collect and how we use it, to delete it, to correct it, and not to be treated differently for using these rights. You can use an authorised agent. Send requests to privacy@merchvio.com; we will verify your request using your account email.
• Retention: as in section 7.

11. Security

We protect personal data with encryption, access controls and an audit log. See our security page for details.

12. Children

The service is for businesses and is not meant for anyone under 18.

13. Changes

We will update this page when our practices change and change the date at the top. If a change matters, we will email account owners before it applies.

Questions about this page? Email privacy@merchvio.com or write to WaveSync NY LLC.