Privacy Policy

MerchantDesk runs MerchantDesk, a customer support platform for online stores. Our address is 30 N Gould St, Ste R, Sheridan, WY 82801, United States.

We handle personal data in two different roles:

• As a controller for data about our own customers (merchants and their team members) and visitors to merchantdesk.ai.
• As a processor for data about our merchants' customers, for example the shoppers who chat with a store's AI Agent. The merchant decides why that data is collected, and we process it on their instructions.

When you create and use a MerchantDesk account:

• Your name, email address, phone number (if you add one) and password. Passwords are stored as a secure hash, never in plain text. If you sign in with Google, we receive your name, email and profile picture from Google.
• Your store details, and data from the platforms you connect, such as products, orders and customer contact details from Shopify, which the AI Agent needs to answer order questions.
• The content you add: training material, FAQs, saved replies, labels and settings.
• Billing details: your plan, invoices and payment status. Card details are handled by Stripe or Shopify. We never see or store your full card number.
• Security information: the IP address, approximate location and device used when you sign in, so we can spot suspicious logins.

When your customers talk to your store through MerchantDesk:

• The messages, voice notes and images they send, and the replies from your AI Agent and team.
• Anything they choose to share, such as their name, email, phone number or order number.
• Basic technical details from the chat widget: a random visitor ID stored in their browser, the page they were on, and their device type.

When you visit merchantdesk.ai: the pages you view, how you arrived, your device and browser, and an approximate location based on your IP address. We use this to understand which pages are useful. We don't use advertising trackers.

• To provide MerchantDesk: running the AI Agent, delivering messages, showing your inbox and reports.
• To bill you and keep track of AI credit usage.
• To keep accounts and the platform secure, and to prevent fraud and abuse.
• To support you when you contact us.
• To send service emails, such as login codes, receipts and important changes. Marketing emails are only sent if you've agreed to them, and you can unsubscribe at any time.
• To improve MerchantDesk using aggregated usage information. We don't use your customers' conversations to train AI models.

• Contract: to provide the service you signed up for and bill you for it.
• Legitimate interests: to keep the platform secure, prevent abuse, and understand how our website and product are used. We balance these against your rights.
• Consent: for optional things like marketing emails. You can withdraw consent at any time.
• Legal obligation: to keep tax and accounting records and respond to lawful requests.

To write a reply, we send the customer's message, recent conversation history and the relevant store knowledge to an AI model provider. On our platform these are OpenAI, Anthropic and Google. We use their business API services. Under those providers' API terms, data sent through the API is not used to train their models.

If a merchant connects their own AI provider key, the messages are processed under that merchant's own agreement with the provider.

We don't use AI to make decisions about people that have legal or similarly significant effects. More detail is on our GDPR & EU AI Act page.

We don't sell personal data. We share it only with service providers that help us run MerchantDesk, under contracts that require them to protect it:

• Hosting and storage: our cloud hosting and database providers, and Cloudflare R2 or Backblaze B2 for media files such as voice notes and images.
• AI providers: OpenAI, Anthropic and Google, to generate replies, summaries and transcripts.
• Payments: Stripe, and Shopify for merchants billed through the Shopify App Store.
• Email delivery: Cloudflare Email and Resend, for service emails such as login codes and receipts.
• Channels you connect: Shopify, Meta (WhatsApp, Facebook, Instagram) and your own email provider, to receive and send your messages.

We may also share data if the law requires it, to protect people's safety, or as part of a merger or sale of our business, in which case we'll tell you first.

We're based in the United States and our providers may process data in the US and other countries. When we transfer personal data from the EU, EEA or UK, we rely on safeguards such as the European Commission's Standard Contractual Clauses or our providers' certification under the EU-U.S. Data Privacy Framework.

• Account and store data: while your account is open. After you close it, we delete it within a reasonable time, normally within 30 days.
• Conversations: for as long as the merchant keeps them. Merchants can delete conversations and contacts from their portal.
• Detailed AI usage logs: about 13 months. Monthly totals are kept for billing history.
• Email delivery logs: 30 days.
• Invoices and payment records: as long as tax law requires, usually up to 7 years.

• All traffic to MerchantDesk is encrypted with HTTPS.
• Access tokens and keys for your connected services (Shopify, WhatsApp, email, AI provider keys) are encrypted at rest with AES-256.
• Passwords are hashed, and new or unusual sign-ins can require a one-time code.
• Team members only get the permissions their role needs.

Depending on where you live, you can ask us to:

• show you the personal data we hold about you and give you a copy
• correct data that is wrong
• delete your data
• limit or object to how we use it
• move your data to another service
• withdraw consent you gave earlier

California residents also have the right to know what we collect and to not be discriminated against for using their privacy rights. We don't sell or “share” personal information for cross-context advertising.

To use any of these rights, email support@merchantdesk.ai. We'll reply within 30 days. You can also complain to your local data protection authority.

MerchantDesk is a business tool and isn't meant for children. We don't knowingly collect data from anyone under 16. If you think a child has given us their data, contact us and we'll delete it.

We use a small number of cookies and browser storage to keep you signed in and make the chat widget work. Details are in our Cookie Policy.

We'll update this policy when our practices change. If the change is significant, we'll let you know by email or in the portal before it takes effect. The date at the top shows when it was last updated.

For any privacy question or request, email support@merchantdesk.ai or write to MerchantDesk, 30 N Gould St, Ste R, Sheridan, WY 82801, United States.