Privacy Policy

Last updated: 2026-10-26

This policy explains what information Merch Maker (“Merch Maker”, “we”, “us”) collects when you use merchmaker.ai, our web app, and Merch Maker inside AI assistants such as ChatGPT, Claude and Grok (together, the “Service”), how we use and share it, how long we keep it, and the choices you have.

Information we collect

Information you give us

Account details: your phone number if you sign in with a texted code, or your email address and name, and, if you sign in with Google, your Google account’s email and name. A phone number is used to sign you in. We keep it on your account, and a scrambled (hashed) form of it for up to 48 hours to limit how many codes can be sent to one number.
What you ask us to make: the descriptions of the merchandise you want (for example “a pouch with a sun on it for a beach weekend”), the company name and website you mention when you want company merchandise, and pictures, sketches or logos you upload or attach.
Your designs and lists: the designs we draw for you, the ones you choose, your saved searches, shortlists and group orders.
Orders: the products, sizes, quantities and prices you choose; the name, shipping address, email and phone number you give at checkout; and messages you send us about an order.

Information from AI assistants

When you connect Merch Maker to an AI assistant, the assistant sends us only what is needed to carry out the request it is making for you: for example, a short description of what you want, the product type, a company name, or a picture you attached to that request. We do not receive your conversation history, and we never ask the assistant for it. We keep a record of each request an assistant makes to Merch Maker for you, including the chat on merchmaker.ai, with what it sent and what we answered, to understand and improve how assistants use the Service. This record is not sent to our analytics provider. From it we also keep a de-identified record of how assistants used the Service: the steps they took and how each one ended, without anything you wrote. The assistant provider’s own privacy policy covers what you share with the assistant itself.

Information collected automatically

Device and log information: IP address, browser type, the pages and actions you request, and timestamps, used to run and secure the Service.
Product analytics: the pages you view and the steps you take in the Service, such as starting a chat, getting a round of designs, choosing one, starting checkout and paying, along with which assistant you used, how long a step took, order amounts and quantities, your browser, operating system, device type and screen size, and an approximate location (city or region). PostHog receives your IP address to work out that location and stores it with the analytics events. Before a page address is recorded, we remove the private part of shared links and anything you typed into it, such as a chat request. We do not record the text of your chats, your uploads, your designs, your payment details, or your contact details for analytics. When you are signed in, analytics is tied to your account; when you are not, to a random identifier, held in one analytics cookie in your browser.
Cookies: we use the cookies needed to keep you signed in, protect your sign-in and connect an assistant, and one analytics cookie, mm_aid, which holds only a random identifier, lasts up to one year, and is removed when you sign out. If your browser sends a Global Privacy Control signal, we do not set the analytics cookie, we remove one already set, and we do not collect analytics in your browser. We do not use advertising cookies or cross-site trackers.

Information from others

Payments: Stripe processes your card payment. We receive the payment’s status, never your full card number.
Company logos: when you ask for merchandise for a company, a brand-data service retrieves that company’s public logo from the website you or the assistant gave us.

We do not knowingly collect government ID numbers, health information, precise location, or payment card numbers.

How we use information

To provide the Service: draw and refine designs, show them on products we can make, price and take orders, produce and ship them, and send you order updates.
To check designs before we offer them, for example that text reads correctly, that a design can be made with the chosen method, and that a name doesn’t closely match a real business without saying so.
To support you and answer your messages.
To keep the Service safe: prevent fraud and abuse, enforce our Terms, and secure accounts and connections.
To improve the Service: to understand how it is used, for example where people get stuck or leave, using aggregated or de-identified information where we can.
To meet legal obligations, such as tax and accounting records.

We do not sell your personal information, and we do not use it for advertising. We do not use your uploads, designs or requests to train AI models.

We share information only as needed to run the Service:

AI model providers (such as OpenAI and Google, directly or through a model gateway) that draw designs and check images, receiving the request text and images needed for that task.
A brand-data service that retrieves a company’s public logo from the website you name, receiving that website address.
A web search service that checks whether a design’s name closely matches a real business, receiving the name and short design text.
Payment processing: Stripe.
Production and shipping partners that print, embroider or otherwise make your order and ship it, receiving the design, order details and shipping information.
Infrastructure providers: hosting and storage (Google Cloud), sign-in (Google, if you use it), email delivery (Resend) and text messages for sign-in codes (Twilio, which receives your phone number to text it a code, checks the code you type, and passes the text to mobile carriers, under its own privacy notice).
Product analytics: PostHog, which stores and analyzes the product analytics described above for us, in the United States.
People you choose to share with: when you share a shortlist or start a group order, the people with the link see what you chose to share.
Legal and safety: when required by law, or to protect the rights, safety and property of our users, the public or Merch Maker.
Business transfers: if Merch Maker is involved in a merger, acquisition or sale of assets, under this policy’s protections.

How long we keep information

Account details: while your account is open, and up to 30 days after you ask us to close it.
Uploads, designs, shortlists and saved searches: while your account is open, unless you delete them sooner or ask us to.
Orders: for as long as tax, accounting and consumer-protection law requires, generally seven years.
Requests from AI assistants: until you ask us to delete your information. A request made through the chat on merchmaker.ai while you were signed out is not tied to you, so we cannot find it to delete it. The de-identified record of how assistants used the Service does not identify you and is kept indefinitely.
Logs: generally up to 90 days, longer only when needed to investigate a security incident.
Product analytics: in PostHog until we delete it, or until PostHog’s retention limit for our account removes it. We delete analytics tied to your account when you ask.

Your choices and rights

Disconnect an assistant at any time at merchmaker.ai/mcp/oauth/connections. Disconnecting stops the assistant from acting for you and revokes its access.
Turn off analytics in your browser by turning on Global Privacy Control. Clearing the mm_aid cookie does not turn analytics off; it only gives you a new random identifier. Global Privacy Control does not stop the steps our servers record, such as getting designs, checking out and paying: these are still recorded for your account if you are signed in, and otherwise under a random identifier. To have analytics tied to your account deleted, email hello@merchmaker.ai.
Access, correct or delete your information, or close your account, by emailing hello@merchmaker.ai. We answer within 30 days.
Depending on where you live (for example California, the EU or the UK), you may have further rights, such as to object to or restrict processing, or to receive a copy of your information. Email us to use them. You will not be treated differently for using them.

Children

The Service is not directed to children under 13, and we do not knowingly collect information from them. If you believe a child under 13 has given us information, email hello@merchmaker.ai and we will delete it.

Security

We protect information with encryption in transit, access controls and monitoring. No system is perfectly secure. To report a security problem, email hello@merchmaker.ai.

International transfers

We are based in the United States and process information there. When we transfer information from other countries, we use the safeguards the law requires.

Changes

We will post any change to this policy on this page and update the date above. If a change is significant, we will tell you by email or in the Service before it takes effect.

Contact

Merch Maker, 970 McIntire St, Boulder, CO 80303, USA. Email: hello@merchmaker.ai.