MerchFace Inc. Privacy Policy

Effective Date: August 7, 2026
Previous version: Privacy Policy in effect through August 6, 2026

1. Introduction

MerchFace Inc. (“Company,” “we,” “us,” or “our”) offers several related services. We operate MerchFace app, a product accounting application that helps individuals and businesses track their products across channels and their finances by importing transactions from financial accounts they choose to connect (the “App”). We operate our website at MerchFace.com (the “Site”), which describes our work and allows you to contact us. We provide e-commerce development and financial analysis to business clients on an engagement basis (the “Professional Services”). We may also offer branded merchandise and other products for sale (the “Shop”). In this Policy, the App, the Site, the Professional Services, the Shop, and any related communications are referred to collectively as the “Service,” and this Policy applies to all of them.

This Privacy Policy describes the personal information we collect, how we use and share it, and the rights and choices available to you. Not every part of it applies to every interaction with us: Sections 2.2 and 4 apply only if you connect a financial account through the App; Section 2.5 applies only to our Professional Services clients; and Section 2.6 applies only if you place an order through the Shop.

For users in the European Economic Area, the United Kingdom, and Switzerland, the Company is the data controller for the personal information described in this Policy, except as described in Section 2.7. Please read this Policy carefully as continued use, to the extent permitted by applicable law, constitutes acceptance.

2. Information We Collect

2.1 Information you provide to us

  • Account information. Name, email address, and password when you register, and any profile or business details you choose to add.
  • Payment information. If you purchase a subscription, our payment processors (we currently use Stripe, Square, and Shopify) collect your payment card details. We receive limited billing information (such as card type, last four digits, and billing status) but do not store full card numbers.
  • Communications. Information you provide when you contact support or otherwise correspond with us.

2.2 Financial account information received through our connection providers

When you choose to connect a bank, credit card, payment, or other financial account, we receive information about that account through one of our connection providers: Plaid Inc. (“Plaid”), Teller Inc. (“Teller”), or PayPal (“PayPal”) (each, a “Connection Provider”). Which provider handles a given connection depends on your financial institution and the connection method you choose, and we identify the Connection Provider to you before the connection begins. Through a Connection Provider we may receive account identifiers (institution name, account name, type, and masked account number), balances, and transaction history such as dates, amounts, merchant descriptions, and categories.

We do not receive or store the username or password for your financial institution. You provide those credentials directly to the Connection Provider, or authenticate directly with your financial institution through it, and our access to your account data is read-only: the Service cannot move money or initiate transactions.

2.3 Information collected automatically

  • Device and log data, such as IP address, browser and device type, operating system, and the dates and times of access.
  • Usage data, such as pages viewed and features used, which helps us understand how the Service is used and improve it.
  • Cookies and similar technologies, described in Section 6.

2.4 Information you provide about other people

The Service allows you to record and organize activity that involves other people and organizations - for example, the names and contact details of customers, clients, vendors, contractors, or employees appearing in your invoices, bills, expenses, or transaction records, or in materials you send us in connection with a Professional Services engagement. When you enter or upload that information, we process it on your behalf and in accordance with your instructions. You are responsible for ensuring that you have the authority and any legally required basis to provide it to us, and that you have given any notices and obtained any consents required by applicable law. Individuals whose information you provide should direct questions or requests about that information to you in the first instance; if they contact us directly, we will refer them to you and assist you in responding as required by law.

2.5 Professional Services clients and Site enquiries

If you contact us through the Site or engage us for Professional Services, we collect the information you provide in connection with that enquiry or engagement. This may include your name, business name, role, email address, telephone number, mailing and billing addresses, the content of your enquiry or brief, project files and materials you share with us, and records of our correspondence, proposals, statements of work, invoices, and payments. If you subscribe to updates or a mailing list on the Site, we collect the address you provide and your subscription preferences.

2.6 Merchandise orders

If we make branded merchandise or other products available and you place an order, we collect your name, email address, shipping and billing addresses, telephone number where you provide one, the items ordered, the order value, and your delivery and returns history. Payment card details are collected by our payment processors and/or shopping platforms (we currently use Stripe, Square, and Shopify) as described in Section 2.1, and we do not store full card numbers. We share the information necessary to fulfil your order with our fulfilment, printing, and shipping partners as described in Section 5.

2.7 Our role as controller or processor

For the personal information we collect about you as a user of the Service - your account, billing, usage, order, and connected financial account data - we act as a controller (or “business,” where that term applies), and this Policy governs. For personal information about third parties that you enter or upload into the App, or that you provide to us in the course of a Professional Services engagement, you act as the controller or business and we act as a processor or service provider. In that role we process the information only to provide the Service to you, on your documented instructions, and as permitted by our agreement with you. Where required, we will enter into a data processing agreement with you; you may request one at privacy@merchface.com.

3. How We Use Information

We use personal information for the following purposes. For users in the EEA and UK, the legal basis for each purpose appears in parentheses.

  • To provide and operate the Service, including importing and categorizing transactions and generating accounting reports (performance of a contract).
  • To create and administer your account and provide customer support (performance of a contract; legitimate interests).
  • To secure the Service, authenticate users, and detect and prevent fraud and abuse (legitimate interests; legal obligation).
  • To send service-related communications such as security alerts, billing notices, and material changes to our terms (performance of a contract; legitimate interests).
  • To analyze usage, develop, maintain, and improve the Service (legitimate interests; consent where required).
  • To send marketing communications, which you can opt out of at any time (consent; legitimate interests, as applicable).
  • To respond to enquiries, prepare proposals, and communicate with prospective clients (steps taken at your request before entering a contract; legitimate interests).
  • To deliver, manage, invoice for, and support our Professional Services engagements (performance of a contract; legitimate interests).
  • To process, fulfil, ship, and support orders you place through the Shop, including handling returns and related enquiries (performance of a contract).
  • To comply with law and enforce our agreements (legal obligation; legitimate interests).

We do not sell your personal information, and we do not use your financial transaction data for advertising.

4. Bank and Payment Account Connections

We use one or more Connection Providers - currently Plaid and Teller, and potentially PayPal - to connect your financial accounts to the App and to retrieve the account and transaction data described in Section 2.2.

By choosing to connect an account, you authorize the Company and the relevant Connection Provider the right, power, and authority to act on your behalf to access and transmit your personal and financial information from your financial institution, and you acknowledge and agree that this information will be transferred to, stored by, and processed by that Connection Provider in accordance with its end user privacy policy. The Plaid End User Privacy Policy is available at https://plaid.com/legal/#end-user-privacy-policy. We identify the Connection Provider handling your connection, and link to its policy, at the point of connection.

You may disconnect a linked account at any time in the MerchFace app settings menu. You can also review and manage the access you have granted directly with the Connection Provider: through Plaid Portal (my.plaid.com) for Plaid connections.

4A. Automated Processing and Artificial Intelligence

Parts of the Service operate automatically. We use rules-based logic and machine learning to import, match, and categorize transactions, to detect duplicates and likely errors, and to generate reports, summaries, and insights about your finances. These features are conveniences: you can review, correct, and override any automated categorization or suggestion, and we do not use automated processing alone to make decisions that produce legal effects concerning you or that similarly significantly affect you, such as decisions about credit, employment, insurance, or access to essential services.

We do not use your financial account or transaction data to train generalized artificial intelligence or machine learning models, and we do not permit our vendors to do so. All automated categorization described above is performed within our own systems, and your transaction data is not transmitted to any third-party artificial intelligence provider.

If you are in the EEA, the UK, or Switzerland, you may object to processing carried out on the basis of our legitimate interests, including any profiling described in this Section, and you may request human review of automated processing that significantly affects you. If you are a resident of a US state whose law provides a right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, you may exercise that right by contacting us at privacy@merchface.com. See Section 9 for how to make a request.

5. How We Share Information

  • Service providers. We share information with vendors that process it on our behalf and under contract, including cloud hosting and infrastructure providers, our Connection Providers (Plaid, Teller, PayPal), our payment processors (we currently use Stripe, Square, and Shopify), analytics providers (Google Analytics), email delivery, customer support tooling, and, for merchandise orders, our print, fulfilment, and shipping partners. Additional subprocessors currently include Cloudflare, Akamai/Linode, Github, Postmark, and Supabase.
  • Legal reasons. We disclose information only where required by law or valid legal process.
  • Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to appropriate confidentiality protections and applicable law.
  • At your direction. Data exported by you is outside our control and should be protected by you.
  • Aggregated or de-identified data. We may use and share data that cannot reasonably be used to identify you.

6. Cookies and Similar Technologies

We use cookies, browser local storage and similar technologies in three categories: (a) essential cookies and similar technologies required for authentication, session management, and security, which are always active; (b) analytics cookies that help us understand how the Service is used; and (c) marketing cookies, if any.

Where required by law, including for visitors from the EEA and UK, we only set non-essential cookies after you consent through our cookie banner. You can change your choices at any time through the link on our website, and most browsers also let you block or delete cookies.

Opt-out preference signals. Some browsers and extensions can transmit a Global Privacy Control (“GPC”) signal indicating that you wish to opt out of the sale or sharing of your personal information and of targeted advertising. We treat a GPC signal we receive as a valid opt-out request for the browser or device that sends it. Because the signal is tied to a browser or device rather than to you, applying it to your other browsers and devices, or associating it with your account, may require you to enable the signal there as well or to contact us at privacy@merchface.com. As described in Section 3, we do not sell personal information, but we honor GPC signals regardless.

Do Not Track. Some browsers offer a “Do Not Track” (“DNT”) setting. There is no common industry or legal standard for how services should interpret DNT signals, and we do not currently respond to them. We do honor the GPC signal described above.

7. Data Retention

We retain account information for as long as your account is active. If you delete your account, we delete or de-identify your personal information within 90 days, except where a longer period is required for legal, tax, accounting, security, or dispute-resolution purposes. Financial transaction data associated with a disconnected account is deleted within 30 days of disconnection unless you ask us to retain it as part of your accounting records. Residual copies in encrypted backups are purged on a rolling 30-day cycle.

8. Security

We implement administrative, technical, and organizational safeguards designed to protect personal information, including encryption in transit (TLS) and at rest, least-privilege access controls, multi-factor authentication on administrative systems, and logging and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your Rights and Choices

9.1 All users

You can access and update your account information in the Service, disconnect linked financial accounts at any time, unsubscribe from marketing emails using the link in each message, and delete your account by contacting us. To exercise this or any right described in this Section contact us at privacy@merchface.com. We may need to verify your identity before acting on a request, and we will respond within the timeframe required by applicable law.

9.2 European Economic Area, United Kingdom, and Switzerland

You have the right to request access to, rectification of, or erasure of your personal information; to restrict or object to certain processing; and to data portability. Where processing is based on consent, you may withdraw consent at any time without affecting processing that occurred before withdrawal. You also have the right to lodge a complaint with your local supervisory authority.

9.3 California

If you are a California resident, you have the right to know what personal information we collect, use, and disclose; to request deletion or correction; to receive your information in a portable format; to opt out of the "sale" or "sharing" of personal information (as noted above, we do not sell personal information); to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights. You may submit requests at privacy@merchface.com, including through an authorized agent. You may also exercise your opt-out by enabling a Global Privacy Control signal in your browser, as described in Section 6.

9.4 Other US states

Residents of other states with comprehensive privacy laws (such as Virginia, Colorado, Connecticut, and Texas) may have similar rights of access, correction, deletion, portability, and opt-out, as well as the right to appeal a refusal. We honor these rights as required by the law of your state.

10. International Data Transfers

We are based in the United States, and the information we collect is processed and stored in the United States, where privacy laws may differ from those in your jurisdiction. Where required, we rely on appropriate transfer mechanisms such as the European Commission's Standard Contractual Clauses (or their UK or Swiss equivalents), together with supplementary safeguards where appropriate.

10A. Third-Party Sites and Services

The Service may contain links to websites, applications, and services that we do not operate, including your financial institution, our Connection Providers, our payment processor, any store platform, and any integration you choose to enable. This Policy does not apply to those third parties, and we are not responsible for their privacy or security practices. When you follow a link to a third party or connect an integration, the information you provide is governed by that party’s own privacy policy and terms, and we encourage you to review them before you share information.

11. Children

The Service is intended for adults. It is not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us personal information, please contact us at privacy@merchface.com and we will delete it.

12. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will notify you by email or through the Service before the changes take effect and update the effective date above. Your continued use of the Service after the effective date constitutes acceptance of the updated Policy to the extent permitted by law.

13. Contact Us

If you have questions or requests regarding this Policy or our privacy practices, contact us at:

MerchFace Inc.
privacy@merchface.com