Privacy Policy

MerchandiserOS (“the Service”, “we”, “us”) is an operations platform for apparel factories and brands. This policy explains what personal information we collect, why, how we handle it, and your choices. For any privacy question or request, contact merchandiseros@merchandiseros.online.

It applies to (a) visitors who register interest on our website, (b) users of the MerchandiserOS application and the people whose business contact details our customers enter into it (for example a buyer or supplier contact), and (c) learners with a Merchandising Academy account (section 6). Our customers are businesses; the Service is intended for business use.

• Registration / early-access details — your name, email, phone or WhatsApp number, optionally your company and what would help you most.
• Account details — name, work email, role, and a securely hashed password (we never store passwords in readable form), or a Google sign-in identifier if you sign in with Google.
• Business data you enter or upload — orders, styles, tech packs and files, materials, suppliers, buyers, costs, production and quality records, messages, and similar operational data.
• Email data (only if you connect Gmail) — see section 5.
• Merchandising Academy account — your name, email, a securely hashed password, your progress through the courses, and any certificate issued to you. Academy accounts are separate from application accounts (section 6).
• Payment reference (Academy only) — if you buy the Academy plan, the reference number of the transfer you made, the name it was sent under, and the date. We never see, collect or store card numbers, bank credentials or wallet PINs (section 6).
• Technical data — basic logs needed to run and secure the Service (e.g. session cookies, IP address, error and access logs).

• To provide, operate, secure and improve the Service.
• To contact you about access, support, and important service notices.
• To generate the AI drafts and document extractions you ask for (section 7).
• To run the Merchandising Academy — your account, your progress, and your purchase (section 6).
• To meet legal, security and fraud-prevention obligations.

We do not sell your personal information, and we do not use it for advertising.

Connecting Gmail is optional. If you choose to, we request read-only access (the gmail.readonly scope) solely to read incoming messages you direct to the Service so it can recognise order-related emails and surface them for your review. We do not send, modify, label, or delete your email.

MerchandiserOS’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• We use Google user data only to provide and improve the features above.
• We do not transfer it to others except as needed to provide the Service, for security, or to comply with law.
• We do not use it for advertising, and we do not allow humans to read it except with your consent, for security, to comply with law, or where the data is aggregated/anonymised.
• You can disconnect Gmail at any time in Settings, or revoke access at your Google account permissions; we then stop accessing it and delete stored access tokens.

The Merchandising Academy is our course site. It has its own accounts, separate from application accounts — signing up for one does not create or affect the other, and the two hold their data separately.

The Academy sells one paid plan. Payment is arranged manually — you transfer the fee by InstaPay or mobile wallet and give us the payment reference. The site never asks for and never stores card numbers, bank login details or wallet PINs, and no card is charged by us. We grant access when you submit your payment reference, and we reconcile that reference against the received payment afterwards. We keep the reference and the details in section 3 as the record of your purchase, for as long as we need it for accounting and tax.

Some features (for example tech-pack extraction and draft messages) send the relevant content to our AI provider, Anthropic, to generate a result you review before use. This content is processed only to produce that result and is not used to train AI models.

AI can make mistakes. AI output is a draft suggestion and may be wrong or incomplete — check it before you rely on it. A human always reviews and decides before anything is sent or committed.

Some Academy lessons give you prompts to run in a third-party AI tool of your own choosing. When you do that, you are using that tool under its own terms and privacy policy, and whatever you paste into it goes to that provider, not to us. Do not paste anything confidential into a tool you have not checked.

We share data only with providers that help us run the Service, under appropriate confidentiality and data-protection terms:

• Vercel — application hosting.
• Turso — database hosting.
• Anthropic — AI processing for the features in section 6.
• Resend — transactional email delivery.
• Google — sign-in and, if you connect it, Gmail (section 5).

There is no card-payment processor in this list because we do not take card payments — the Academy plan is paid manually and reconciled by us (section 6).

Data is held with the providers above and may be processed in countries other than yours. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for international transfers.

We keep registration details while we are in touch about access; account and business data for as long as your account is active or as needed to provide the Service; and we delete or anonymise data when it is no longer needed, or on your verified request, subject to any legal retention obligations.

We protect data with measures including encrypted connections, hashed passwords, signed sessions, role-based access controls, and an isolated database per environment. No system is perfectly secure, but we work to keep your data safe.

Depending on your location (including under the EU/UK GDPR and applicable local law), you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any of these, email merchandiseros@merchandiseros.online and we will respond promptly. Where we process business-contact data on behalf of a customer, we will direct such requests to that customer.

We use only essential cookies needed to sign you in and keep your session secure. We do not use advertising or cross-site tracking cookies.

The Service is for business use and is not directed to children under 16. We do not knowingly collect their data.

We may update this policy; we will change the “Last updated” date above and, for material changes, give reasonable notice.

MerchandiserOS — merchandiseros@merchandiseros.online