Privacy Policy

Last updated: September 1, 2026

Merch HQ ("Merch HQ," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use the Merch HQ Chrome extension and dashboard, or otherwise interact with us (collectively, "Services").

Please read this Privacy Policy carefully. If you do not agree with the terms of this Privacy Policy, please do not use our Services.

1. Information We Collect

We may collect information about you in a variety of ways, including:

a. Personal Information You Provide

We collect personal information that you voluntarily provide to us, such as your name, email address, and billing information when you sign up or subscribe to Merch HQ.

b. Automatically Collected Information

When you visit our website, our hosting provider, Cloudflare, automatically collects and stores information in "Server Log Files" that your browser transmits to us. This includes:

• IP address (anonymized/masked)
• Date and time of request
• Browser type and version
• Operating system used
• Referrer URL (the page you visited before coming to our site)

This data is processed based on our legitimate interest (Art. 6(1)(f) GDPR / Art. 31(1) FADP) in ensuring the stability and security of our website.

c. Cookies and Tracking Technologies

Our website uses only essential cookies required for the service to function. We do not use advertising or third-party tracking cookies. The cookies we set include:

• License key cookie: Stores your Merch HQ license key locally in your browser. When you use the extension or dashboard, this key is verified against Creem.io's API to confirm you have an active subscription. No passwords or Amazon credentials are involved in this check.
• Security token: Protects against cross-site request forgery (CSRF)
• Cloudflare cookies: Set by our hosting provider for security and performance (e.g. bot protection)

Because we use only technically necessary cookies, a cookie consent banner is not required under applicable EU and Swiss regulations. We do not use analytics cookies or track your behaviour across other websites.

2. Chrome Extension and Your Amazon Data

In this policy, "Amazon Merch data" means the sales, revenue, pricing, and ad-spend data available on your Amazon Merch on Demand account pages. This is separate from the account, subscription, billing, and website-request data described elsewhere in this policy.

• What the extension reads: Amazon Merch data from pages loaded in your authenticated browser session while the extension is active. The extension does not read or store your Amazon password.
• What stays in your browser: Amazon Merch data is processed and stored locally on your device. It is not transmitted to or stored on Merch HQ servers.
• What is transmitted: Your license key is sent to Creem.io's API to confirm that your subscription is active. This request does not contain your Amazon credentials or Amazon Merch data.
• What is stored: Merch HQ and its service providers separately store the account, subscription, billing, waitlist, email, and website security data identified in Sections 1 and 4. They do not store Amazon Merch data.
• Storage location: Amazon Merch data remains in the extension's local browser storage on your device. Other data may be processed in Switzerland, the EU, or the service-provider locations described in Section 7.
• Retention: Locally stored Amazon Merch data remains in your browser until you clear the extension's browser data or uninstall the extension. Retention periods for account data, billing records, and security logs are listed in Section 5.
• Deletion: Clear the extension's browser data or uninstall the extension to remove locally stored Amazon Merch data. To close your account and request deletion of personal data held by Merch HQ, email hey@getmerchhq.com.

3. How We Use Your Information

We use information we collect for the following purposes, each grounded in a specific legal basis under GDPR (Art. 6) and Swiss FADP:

• Providing and operating the service: processing your account and subscription data is necessary to perform our contract with you (Art. 6(1)(b) GDPR)
• Processing payments: billing data is shared with Creem.io to fulfil your subscription contract (Art. 6(1)(b) GDPR)
• Website security and stability: server log and Cloudflare data is processed based on our legitimate interest in keeping the service secure (Art. 6(1)(f) GDPR)
• Responding to enquiries: communication data is processed based on our legitimate interest in providing support (Art. 6(1)(f) GDPR)
• Legal compliance: retaining billing records as required by law (Art. 6(1)(c) GDPR)
• Waitlist sign-up: email addresses submitted via our waitlist form (powered by Tally.so) are collected based on your consent to be notified when Merch HQ launches (Art. 6(1)(a) GDPR)
• Sending transactional and marketing emails: we use Plunk to send account-related emails (e.g. subscription confirmations, account updates) based on our contract with you, and marketing emails only with your prior consent, which you can withdraw at any time (Art. 6(1)(b) and Art. 6(1)(a) GDPR)

4. How We Share Your Information

We do not sell your personal information. We share your information only with trusted service providers:

• Cloudflare: For web hosting, content delivery (CDN), and security services
• Creem.io: To act as a merchant of record for secure billing and invoicing. For more information, see Creem's privacy policy.
• Tally.so: We use Tally to power our waitlist form. When you submit the waitlist form, your name and email address are collected and stored by Tally. For more information, see Tally's privacy policy.
• Plunk: We use Plunk to send transactional emails (e.g. subscription confirmations, account updates) and marketing emails to subscribers who have opted in. You can unsubscribe from marketing emails at any time. Your name and email address are shared with Plunk for this purpose. Plunk is an EU-hosted, GDPR-compliant email provider. For more information, see Plunk's privacy policy.

5. Data Retention

We retain your personal data only as long as necessary for the purpose it was collected:

• Account data (name, email): retained for the duration of your account, then deleted within 30 days of account closure
• Billing and payment records: retained for 7 years as required by applicable accounting and tax law
• Server log data: retained for up to 90 days by Cloudflare for security purposes

You may request deletion of your account and personal data at any time by emailing hey@getmerchhq.com. We will action your request within 30 days, subject to any legal retention obligations.

6. Data Security

We implement reasonable administrative and technical measures, including HTTPS/TLS encryption for data transmitted between your browser and the relevant service, and Cloudflare's security services, to protect transmitted account, subscription, and website-request data. Merch HQ does not claim to encrypt Amazon Merch data at rest on its servers because Amazon Merch data is not stored there. However, no method of transmission over the internet or local storage is 100% secure.

7. International Data Transfers

We are based in Zurich, Switzerland. Your information may be processed in Switzerland, EU, or other countries where our service providers (like Cloudflare) maintain servers. We rely on standard contractual clauses or adequacy decisions to ensure your data remains protected.

8. Your Privacy Rights

If you are located in Switzerland or the EU, you have the following rights under GDPR and the Swiss FADP:

• Access: request a copy of the personal data we hold about you
• Rectification: request correction of inaccurate or incomplete data
• Erasure: request deletion of your personal data ("right to be forgotten")
• Restriction: request that we limit how we process your data
• Portability: receive your data in a structured, machine-readable format
• Objection: object to processing based on legitimate interest
• Withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting prior processing

To exercise any of these rights, email us at hey@getmerchhq.com. We will respond within 30 days. If you believe we have not handled your data correctly, you have the right to lodge a complaint with your local supervisory authority - in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC).

9. Children's Privacy

Our Services are not directed at children under the age of 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will update the "Last updated" date at the top of this page whenever we make changes. For material changes, we will make reasonable efforts to notify you, such as by email or a notice on our website, before the changes take effect.

11. Contact Us

If you have questions about this Privacy Policy, please contact us at: