1. Who we are
Merchanlty(“we”, “us”, “our”) operates this multi-vendor marketplace. This policy explains what data we collect, why, and how we protect it. Questions go to support@merchantly.store.
2. What we collect
- Account information — email, username, hashed password, phone, profession, age, country.
- Identity verification — government-issued ID images uploaded for store approval (KYC). These are stored with auth-gated access only.
- Transaction data — orders, targets, withdrawals, deposits, wallet addresses you supply, and (where relevant) on-chain transaction hashes.
- Operational metadata — IP address, user-agent, session cookies for authentication. We do not run third-party trackers.
3. How we use it
- To operate your account, store, orders, and balance.
- To process withdrawals and deposits, including KYC compliance.
- To send you transactional notices (orders, approvals, system messages).
- To prevent fraud and abuse and to enforce our Terms of Service.
We never sell your personal data. We don't share KYC documents with other merchants or admins outside the strict approval flow.
4. Cookies & sessions
We use HTTP-only, SameSite cookies for authentication (ml_access and ml_refresh). They expire automatically; signing out revokes the refresh token server-side.
5. Data retention
Account data is retained for as long as your account is active. On deletion, your personal data is removed; transactional records may be retained in aggregated/anonymized form for fraud prevention and accounting.
6. Your rights
You can request a copy of your data, correction of inaccuracies, or deletion of your account at any time. Reach out to support@merchantly.store.
7. Security
Passwords are hashed with bcrypt. Tokens are stored only as hashes. NIC uploads are auth-gated and not publicly indexable. Transport is TLS end-to-end.
8. Changes
We may update this policy. Material changes will be announced via a system notice on your dashboard.