Privacy Policy

1.Who is responsible

Cogenta B.V., Bagven Park 16, 4838 EH Breda, the Netherlands (Chamber of Commerce no. 42142544), operates Mercify.ai and is the data controller for the personal data you share with us through the website and the app. Privacy questions: hello@mercify.ai.

For the customers, orders and visitors of the Shopify store we build for you, you are the data controller. Mercify processes that data only on your instructions while building, transferring or supporting your store.

2.What we process and why

• Account data (name, email address, hashed password, login codes, team invitations): to create and secure your account, let you log in and grant team access. Legal basis: performance of a contract.
• Business and billing data (company name, address, VAT number, orders, payment status): to sell stores and credit, issue invoices and keep our accounts. Legal basis: contract and legal obligation (7-year retention).
• Intake and store content (niche, market, preferred name, style, colors, uploaded logo, designs, generated copy and images, Shopify store address): to prepare, build and transfer your store and show its progress. Legal basis: performance of a contract.
• Support messages and attachments: to help you and handle complaints and replacements. Legal basis: contract and legitimate interests.
• Contact form (name, email address, optionally your company or website, subject and message): to answer your question or partner request. We forward the message to our team by email and do not store it in a separate database. Legal basis: legitimate interest.
• Technical data (IP address, browser, timestamps, error reports): to run and secure the service and prevent fraud and misuse. Legal basis: legitimate interests.
• Visit statistics (pages viewed, the site or campaign that brought you to us, country, language and device type, and, once you sign in, which account the visit belongs to): to understand how people find Mercify and where the site and the ordering steps can be improved. Legal basis: legitimate interests.
• Partner referrals (the partner code you signed up with or the partner link you clicked, and which payments earn commission as a result): to pay the partner who referred you. The partner does not see your name or email address, only an anonymous identifier and what you purchased. Legal basis: legitimate interests.
• Partner data (name, email address, application, business and address details, VAT number, bank account number and, for private individuals and sole traders not charging VAT, Dutch citizen service number (BSN) and date of birth): to run the partner program, pay out commission and file the statutory report of amounts paid with the Dutch tax authority (Belastingdienst). We store the account number and BSN encrypted. Legal basis: contract and legal obligation.

We do not sell personal data or use it for advertising profiles. We do not make automated decisions about you that have legal effects; we use AI to create store content, not to assess you.

3.Artificial intelligence

Mercify uses AI models to suggest store names, write product titles and copy, select products and create logos and images. To do this, we send your intake (niche, market, style preferences, and any name and logo) and product information to our AI providers (currently Anthropic and OpenAI), under contracts that prohibit them from using the data to train their models. We never send your login or payment details to AI providers. The generated content is stored in your account as part of your store.

4.Chat on our website

On mercify.ai, an AI assistant answers questions on behalf of our team. Before the assistant answers your question, we ask for your email address. We store your email address, your messages and the replies, the language and page from which you chatted, any niche you looked up in the Nicheradar, and a brief assessment the assistant derives from the conversation (such as your dropshipping experience, your market and when you plan to start). This allows our team to follow up on your question personally and help you further by email. Legal basis: legitimate interests. We will not send you a newsletter unless you separately ask for one.

Your messages are sent to our AI provider Anthropic, which does not use them to train its models. To prevent abuse, we count messages per IP address; we do not store the IP address itself, only a code that cannot be traced back to you. We keep chat conversations for no more than 12 months after the last message. If you would like your conversation deleted sooner, please email hello@mercify.ai.

5.Mercify Autopilot (Shopify app)

If you install our Shopify app Mercify Autopilot, the app reads your store settings through Shopify (name, language, contact email, shipping countries, domain and policies) and your products with their cost prices, so it can show what your store still needs. When you ask the app to add products or update policies, it writes them to your store. We keep your store address, an encrypted access token, the result of the latest check and when you gave your consent. Legal basis: performance of the contract.

If you connect your own CJ Dropshipping account, the app passes the shopper's name, delivery address, phone number and email address to your CJ account for each paid order assigned to CJ, so that CJ can ship it. The app does not store these details; we only keep the order number, the CJ order number, the status and the tracking number. On your store's “Track your order” page, shoppers look up their order using their order number and email address; the app uses these solely to retrieve the status from Shopify and CJ and does not store them. When you uninstall the app, we delete the access tokens straight away; 48 hours later Shopify asks us to delete all data about your store, and we do. You remain the controller of your store's customer data; Mercify acts as your processor in this respect.

6.Service providers

We work with the following providers, each under a data processing agreement or equivalent contractual safeguards:

• Supabase (database, authentication and file storage) and Vercel (hosting, EU region) run the platform.
• Mollie processes payments. Mollie receives your name, email address, the amount and the order reference, and processes your payment details as an independent payment institution under its own privacy policy.
• Shopify hosts the store we build. On transfer, we share your name and email address with Shopify; your use of Shopify is governed by Shopify's terms and privacy policy.
• Product suppliers (such as CJ Dropshipping) provide product data and images; we do not share personal data with them unless you connect your own supplier account.
• Apify provides search and market data for the Nicheradar; we send it search terms only, no personal data.
• Anthropic and OpenAI provide AI models (see above).
• Resend sends our emails (login codes, confirmations, invoices, support). MoneyBird stores our invoices and accounting records.
• Yesim (Genesis Group AG, Switzerland) provides the verification numbers. Text messages sent to your number reach us through Yesim and are forwarded straight to your email; we do not store their content, only how many arrive and when.
• Namecheap, Inc. (United States) registers the domains you buy through us. For this, we pass the registrant details (your name, company name, address, phone number and email address) to Namecheap and, through Namecheap, to the registry for the extension, because ICANN and the registry require them. WHOIS privacy is switched on, so these details are not published. Legal basis: performance of the contract.

Some providers process data outside the European Economic Area, mainly in the United States. For these transfers we rely on the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses.

7.How long we keep data

We keep your account, intake and store content for as long as your account exists. You can delete designs, uploaded files and your account in the app; we then erase your account data within 30 days, and backups held by our providers expire under their policies (no more than 30 days later).

We keep orders, invoices and payment records, as well as partner payouts and self-billed invoices, for 7 years as required by Dutch tax law, where possible separated from the deleted account. We keep technical logs for no more than 90 days; login codes expire after a few minutes. Stores already transferred to your Shopify account belong to you and remain in place if you delete your Mercify account.

8.Cookies

mercify.ai uses only strictly necessary cookies and similar storage: a session cookie to keep you logged in, security tokens, a cookie that remembers the language you choose, and browser storage that remembers choices you make before you have an account (such as your niche and style). We show the site in the language that matches your location; for this we use the country our hosting provider derives from your IP address, without storing it.

We don't use analytics or advertising cookies, so we don't ask for your consent. We count visits without cookies and without storing anything on your device: we don't keep your IP address, only a code that changes every day and cannot be traced back to you. We keep these visit statistics for no longer than 25 months. If we ever start using analytics or advertising cookies, we will ask for your consent first and update this policy.

If you arrive through a partner's link, we first ask whether we may remember that. Only if you agree do we set a cookie containing that partner's code, for no more than 90 days, so the partner receives commission if you sign up. If you decline, we set nothing and you can enter the code yourself when you sign up.

9.Your rights

You can access, correct, export (as JSON) and delete your data, object to processing based on legitimate interests and ask us to restrict processing. You can do most of this yourself in your account; for anything else, email hello@mercify.ai. We respond within one month.

You can also lodge a complaint with the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority) or with the data protection authority in your own country.

10.Security

Data is encrypted in transit (TLS) and at rest with our providers. Only team members who need access to production data have it, protected by strong authentication. We store Shopify access tokens encrypted and never display them in the app. If a data breach affects you, we will inform you and the supervisory authority as required by law.

11.Changes

We update this policy when our processing changes and will notify you of material changes in the app or by email. The date at the top shows the version in force.