Privacy Policy

• Account information — the email address you use to sign in via magic link, and your agency profile (agency name and logo) that you provide for white-labeling reports.
• Connected store data — when you connect a Shopify store through Shopify Partner OAuth, we access read-only performance data such as revenue, order counts, average order value, and product performance. We do NOT receive or store your clients' Shopify admin credentials or passwords.
• Report configuration — the recipients, schedule, and copy you set for the weekly reports we send on your behalf.
• Payment information — handled entirely by Lemon Squeezy, our Merchant of Record. We receive confirmation of your subscription status but never see or store your card details.
• Basic usage and diagnostic data — standard logs needed to operate, secure, and debug the service.

We use the information we collect only to provide and improve the service:

• To authenticate you and keep your account secure.
• To render your multi-store dashboard and generate agency-branded reports.
• To email those reports to the client recipients you configure, on your behalf.
• To manage your subscription and communicate with you about the service.

We do not sell your data, and we do not use your clients' store data for advertising or for training any machine-learning model.

MerchantPilot is built on trusted third-party infrastructure. We share data with these providers only to the extent needed to run the service:

• Supabase — authentication and database (stores your account, agency profile, and connected-store data).
• Vercel — application hosting.
• Resend — transactional and report email delivery.
• Lemon Squeezy — subscription billing and payment processing (Merchant of Record).
• Shopify — source of the read-only store data, accessed via Shopify Partner OAuth with your authorization.

Each provider processes data under its own security and privacy commitments. We do not share your data with any other third parties except where required by law.

We retain your account and store data for as long as your account is active, so we can generate ongoing reports. Access is protected by row-level security so that each account can only reach its own data. Connections use encrypted transport (HTTPS).

When you delete your account or disconnect a store, the associated data is removed from our active systems; residual copies in encrypted backups age out on our providers' standard cycles.

• Access & export — you can request a copy of the data associated with your account at any time.
• Disconnect — you can disconnect any client store, which stops further data collection for that store.
• Deletion — you can request hard deletion of your account and associated data by emailing us.
• Correction — you can update your agency profile and report settings from within the app.

To exercise any of these rights, email thoopring@gmail.com.

MerchantPilot is a business tool intended for use by adults operating agencies. It is not directed to children, and we do not knowingly collect data from anyone under 18.

We may update this Privacy Policy as the service evolves. Material changes will be reflected in the 'Last updated' date above and, where appropriate, communicated to active subscribers.

If you have any questions about your privacy, contact thoopring@gmail.com.