Privacy Policy

Last updated: October 25, 2026

Merch HQ ("Merch HQ," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use the Merch HQ Chrome extension and dashboard, or otherwise interact with us (collectively, "Services").

Please read this Privacy Policy carefully. If you do not agree with the terms of this Privacy Policy, please do not use our Services.

1. Information We Collect

We may collect information about you in a variety of ways, including:

a. Personal Information You Provide

We collect personal information that you voluntarily provide to us, such as your name, email address, and billing information when you sign up or subscribe to Merch HQ.

b. Automatically Collected Information

When you visit our website, our hosting provider, Cloudflare, automatically collects and stores information in "Server Log Files" that your browser transmits to us. This includes:

• IP address (anonymized/masked)
• Date and time of request
• Browser type and version
• Operating system used
• Referrer URL (the page you visited before coming to our site)

This data is processed based on our legitimate interest (Art. 6(1)(f) GDPR) in ensuring the stability and security of our website.

c. Cookies and Tracking Technologies

We do not use advertising or tracking cookies on this website. Cookies and similar storage that are strictly necessary may be set by our hosting provider. Items related to the service include:

• License key (not a cookie): Your Merch HQ license key is stored locally in the extension's browser storage. When you use the extension, the key and a generated instance ID are sent to the Merch HQ license service, which checks them with Creem.io to confirm you have an active subscription. No passwords or Amazon credentials are involved in this check.
• Cloudflare cookies: Set by our hosting provider for security and performance (e.g. bot protection)

The website itself does not use analytics or advertising tools. If this changes, we will ask for your consent before loading them. Storage that is strictly necessary for a service you requested does not require consent (Section 25(2) TDDDG).

2. Chrome Extension and Your Amazon Data

In this policy, "Amazon Merch data"means the Amazon royalties (estimated payout), normalized to USD; net units, pricing, and aggregate advertising data available on your Amazon Merch on Demand account pages. This is separate from the account, subscription, billing, and website-request data described elsewhere in this policy.

• What the extension reads: Amazon Merch data from pages loaded in your authenticated browser session while the extension is active, aggregate advertising data from your authenticated Amazon Ads console session, and price, image, and rating details from public Amazon product pages. The extension does not read or store your Amazon password.
• Background requests and session: The extension may request additional Amazon pages in the background, not only the page you are viewing. It uses your existing Amazon session and temporarily handles request and CSRF context for these calls. You do not enter your Amazon password with Merch HQ.
• Chrome Sync: Extension settings, including Ads entity IDs, are stored with chrome.storage.sync and may be synchronized by Google if you enabled Chrome sync. Sales history is not stored this way.
• What stays in your browser: Amazon Merch data is processed and stored locally on your device. It is not transmitted to or stored on Merch HQ servers.
• What is transmitted: Your license key and a generated instance ID are sent to the Merch HQ license service (a Cloudflare Worker), which checks them with Creem.io's API to confirm that your subscription is active. This request does not contain your Amazon credentials or Amazon Merch data. Server logs of this service are subject to the retention in Section 5. Currency conversion requests go to the exchange-rate providers api.fxratesapi.com, api.frankfurter.app and open.exchangerate-api.com. These requests contain no sales history or Amazon account IDs, but the providers receive technical connection data such as your IP address. The extension also talks to Amazon directly from your browser (Merch on Demand, Amazon Ads, and Amazon product pages).
• What is stored: Merch HQ and its service providers separately store the account, subscription, billing, waitlist, email, and website security data identified in Sections 1 and 4. They do not store Amazon Merch data.
• Storage location: Amazon Merch data remains in the extension's local browser storage on your device. Other data may be processed in the EU or the service-provider locations described in Section 7.
• Retention: Locally stored Amazon Merch data remains in your browser until you clear the extension's browser data or uninstall the extension. Retention periods for account data, billing records, and security logs are listed in Section 5.
• Deletion: Clear the extension's browser data or uninstall the extension to remove locally stored Amazon Merch data. To close your account and request deletion of personal data held by Merch HQ, email hey@getmerchhq.com.

3. How We Use Your Information

We use information we collect for the following purposes, each grounded in a specific legal basis under GDPR (Art. 6):

• Providing and operating the service: processing your account and subscription data is necessary to perform our contract with you (Art. 6(1)(b) GDPR)
• Processing payments: billing data is shared with Creem.io to fulfil your subscription contract (Art. 6(1)(b) GDPR)
• Website security and stability: server log and Cloudflare data is processed based on our legitimate interest in keeping the service secure (Art. 6(1)(f) GDPR)
• Responding to enquiries: communication data is processed based on our legitimate interest in providing support(Art. 6(1)(f) GDPR)
• Legal compliance: retaining billing records as required by law (Art. 6(1)(c) GDPR)
• Waitlist sign-up: email addresses submitted via our waitlist form (powered by Tally.so) are collected based on your consent to be notified when Merch HQ launches (Art. 6(1)(a) GDPR)
• Sending transactional and marketing emails: we use Plunk to send account-related emails (e.g. subscription confirmations, account updates) based on our contract with you, and marketing emails only with your prior consent, which you can withdraw at any time(Art. 6(1)(b) and Art. 6(1)(a) GDPR)

4. How We Share Your Information

We do not sell your personal information. We share your information only with trusted service providers:

• Cloudflare: For web hosting, content delivery (CDN), and security services
• Creem.io: To act as a merchant of record for secure billing and invoicing. For more information, see Creem's privacy policy.
• Tally.so: We use Tally to power our waitlist form. When you submit the waitlist form, your name and email address are collected and stored by Tally. For more information, see Tally's privacy policy.
• Plunk: We use Plunk to send transactional emails (e.g. subscription confirmations, account updates) and marketing emails to subscribers who have opted in. You can unsubscribe from marketing emails at any time. Your name and email address are shared with Plunk for this purpose. Plunk is an EU-hosted, GDPR-compliant email provider. For more information, see Plunk's privacy policy.

5. Data Retention

We retain your personal data only as long as necessary for the purpose it was collected:

• Account data (name, email): retained for the duration of your account, then deleted within 30 days of account closure
• Billing and payment records: retained for the periods required by German commercial and tax law (generally 6 to 10 years depending on the document type, Sections 147 AO and 257 HGB); other data is not kept for these periods
• Server log data: retained for up to 90 days by Cloudflare for security purposes

You may request deletion of your account and personal data at any time by emailing hey@getmerchhq.com. We will action your request within 30 days, subject to any legal retention obligations.

6. Data Security

We implement reasonable administrative and technical measures, including HTTPS/TLS encryption for data transmitted between your browser and the relevant service, and Cloudflare's security services, to protect transmitted account, subscription, and website-request data. Merch HQ does not claim to encrypt Amazon Merch data at rest on its servers because Amazon Merch data is not stored there. However, no method of transmission over the internet or local storage is 100% secure.

7. International Data Transfers

We are based in Germany. Your information may be processed in the EU or in other countries where our service providers (such as Cloudflare, Creem.io or the exchange-rate providers named in Section 2) operate. Where data is transferred outside the EU/EEA, we rely on adequacy decisions or standard contractual clauses (Art. 44 ff. GDPR). We do not promise that all data stays in Germany.

8. Your Privacy Rights

You have the following rights under the GDPR:

• Access: request a copy of the personal data we hold about you
• Rectification: request correction of inaccurate or incomplete data
• Erasure: request deletion of your personal data ("right to be forgotten")
• Restriction: request that we limit how we process your data
• Portability: receive your data in a structured, machine-readable format
• Objection: object to processing based on legitimate interest
• Withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting prior processing

To exercise any of these rights, email us at hey@getmerchhq.com. We will respond within 30 days. If you believe we have not handled your data correctly, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, your place of work, or the place of the alleged infringement (Art. 77 GDPR).

9. Children's Privacy

Our Services are not directed at children under the age of 18, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will update the "Last updated" date at the top of this page whenever we make changes. For material changes, we will make reasonable efforts to notify you, such as by email or a notice on our website, before the changes take effect.

11. Contact Us

If you have questions about this Privacy Policy, please contact us at: