In short
- We collect only what we need to run scans and your account.
- We never sell personal data and use no advertising or analytics cookies.
- Scan data is deleted automatically after 180 days (evidence files after 90 days).
- You can request access to or deletion of your data at any time.
Who we are
MerchantLion (“we”) operates MerchantLion and is responsible for the personal data described here. Contact: support@merchantlion.com.
Data we collect
- Account data: email address, name, organisation name, role, and a securely hashed password (we never store your password in readable form).
- Scan inputs: the website address, settings, optional Merchant Center issue message, product feeds and diagnostics exports you upload.
- Scan results: content of the public web pages we inspect, screenshots, findings, scores and reports. These may incidentally include business contact details published on the scanned website.
- Payment data: when paid billing is enabled, Stripe processes your payment. We receive confirmation and the amount, never your full card number.
- Messages: what you send through our contact form or email.
- Security and technical data: session identifiers, IP address in security logs (e.g. failed sign-ins), and request logs needed to protect the Service.
How we use it
- To provide scans, reports, monitoring and support (performance of our contract with you).
- To secure the Service, prevent abuse and enforce our policies (legitimate interests).
- To process payments and keep accounting records (legal obligation).
- To answer your messages.
We do not use your data for advertising and we do not sell or rent it.
Service providers
- Stripe — payment processing (only when paid billing is enabled).
- Anthropic — if AI explanations are enabled for your workspace, structured findings (which may include short excerpts from scanned pages) are sent to generate plain-language summaries. Without it, summaries are generated on our own servers.
- Hosting and infrastructure providers that store data on our behalf under confidentiality obligations.
Retention
Audits, findings and reports are deleted automatically 180 days after creation; stored page snapshots and screenshots are deleted after 90 days. Workspace owners and admins can delete an audit at any time. Account data is kept while your account is active and deleted on request, except records we must keep by law (e.g. invoices).
Security
Passwords are hashed with scrypt; session tokens and API keys are stored only as hashes; data is separated per organisation; access to stored evidence requires authorisation; and our scanner is isolated from private networks. No system is perfectly secure, but we work to protect your data and will notify you of breaches as required by law.
Your rights
Depending on where you live, you may have rights to access, correct, delete, restrict or port your data and to object to processing. Email support@merchantlion.com from your account address; we respond within 30 days. You may also complain to your local data protection authority.
International transfers
We and our providers may process data in the United States and other countries. Where required, transfers are protected by appropriate safeguards such as standard contractual clauses.
Children
The Service is for businesses and is not directed to children under 16. We do not knowingly collect their data.
Changes
We will post updates here with a new date. Significant changes will be highlighted in the dashboard.
Contact
Questions? Email support@merchantlion.com, message us on WhatsApp (@italiano999) or write to MerchantLion, 5 Rue du Docteur Pierre Rouques, 95100 Argenteuil, France.