Who we are
Merchant Guard is provided by Merchant Guard (“we”, “us”). We are the data controller for the personal data described in this policy. If you have any question about privacy, email support@merchant-guard.co.uk.
Merchant Guard is an independent product. It is not made, endorsed or sponsored by Google.
What we collect
| Data | Where it comes from | Why we need it |
|---|---|---|
| Your email address, Google account ID and name | Google sign-in | To create your account and recognise you when you sign in |
| Plan, billing status and Stripe customer ID | Stripe | To give you the features you pay for. We never see or store your card details. |
| Assistant conversations, including product details the assistant looked up and fixes it suggested | You, and your Merchant Center account when the assistant reads it | To answer your questions and keep your conversation history |
| Assistant memories (short facts about your store) | Your conversations, only if memory is on | So you don’t have to repeat yourself. You can view, delete or turn these off. |
| Monitoring summaries: health score, issue counts and the main issues found | Your Merchant Center account, if you turn on 24/7 monitoring | To detect new problems, send alerts and show your score over time |
| Encrypted access tokens for Google monitoring and Shopify | Google and Shopify, when you connect them | To check your account on schedule and read your Shopify products when you ask |
| Fix statistics: issue type, attribute, value source and whether the fix worked | The extension, when you apply a fix | To learn which fixes work best. These don’t include product names, prices or other values. |
| Feedback on answers, and the conversation excerpt if you choose to share it | You | To improve the assistant |
| Daily usage counts | Our servers | To apply your plan’s daily limits and keep costs fair |
| Messages you send us | The contact form or email | To reply to you |
| IP address and request logs | Your browser | To keep the service secure and prevent abuse. IP addresses are used for rate limiting in memory and appear in short-lived server logs. |
Data that stays on your computer
When you scan your store, the extension reads your products and issues directly from Google into your browser. Your fix history, recent scan results and settings are stored in your browser’s extension storage. Spreadsheets and Shopify CSV files you import are read on your computer and aren’t uploaded to us.
Data we process but don’t keep
Some features send limited data to our servers to do their job, then discard it: product page addresses for the page checker, the product titles and attributes you ask the AI to draft values for, and Shopify product data fetched for a fix.
Google user data
With your permission, Merchant Guard accesses your Google Merchant Center account through Google’s Merchant API, using the “Manage your product listings and accounts for Google Shopping” permission, plus your email address and basic profile for sign-in.
We use this access only to provide and improve the features you use: showing your account and product issues, explaining them, checking your product data, applying fixes you approve, and monitoring your account if you turn that on. We don’t use Google user data for advertising, we don’t sell it, and we don’t allow humans to read it except with your permission (for example when you ask for support), for security purposes, or where the law requires.
Merchant Guard’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to develop, improve or train generalised artificial intelligence or machine learning models.
You can remove Merchant Guard’s access at any time from your Google account’s third-party access page.
The AI assistant
The assistant is powered by Claude, provided by Anthropic. When you ask a question, we send Anthropic your message, the relevant parts of your conversation, and the store data the assistant needs to answer (for example the issues on the products you’re asking about). Anthropic processes this to generate the answer and doesn’t use it to train its models. When web search is used, the assistant searches public sources such as Google’s help pages; your store data isn’t included in search queries.
The assistant’s “learning” works in two ways. Memories are facts about your own store, visible and deletable by you, and never used for anyone else. General lessons are written by our team from feedback you choose to share, and from anonymous fix statistics, with all store details removed before anything is used to improve answers for other customers.
Our legal bases
- Contract: to provide Merchant Guard to you, including your account, scans, fixes, the assistant, monitoring and billing.
- Legitimate interests: to keep the service secure, prevent abuse, and improve it using anonymous statistics. We’ve balanced these against your rights and kept the data involved to a minimum.
- Consent: to remember facts about your store and to use conversation excerpts you choose to share with feedback. You can withdraw consent at any time in your account.
- Legal obligation: to keep billing records for tax and accounting.
Who we share data with
We use these service providers to run Merchant Guard. Each processes data only on our instructions and under a data processing agreement.
| Provider | What for | Location |
|---|---|---|
| Anthropic, PBC | Powers the AI assistant and AI-drafted values | USA |
| Stripe (Stripe Payments UK, Ltd. and its affiliates) | Payments, subscriptions and invoices | UK, Ireland and USA |
| Resend (Plus Five Five, Inc.) | Sending alert, trial and support emails | USA |
| Render Services, Inc. (servers in Frankfurt, Germany) | Hosting our servers and database | See provider |
We also exchange data with services you connect: Google (sign-in and Merchant Center) and, if you connect it, Shopify. Their own privacy policies apply to the data they hold.
We may disclose data if required by law, or to protect the rights, property or safety of our customers or others. If Merchant Guard is ever sold or merged, your data would transfer under this policy and we’d tell you first.
International transfers
Some providers process data outside the UK. Where they do, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified) or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
How long we keep data
| Data | Kept for |
|---|---|
| Your account | Until you delete it. Free accounts that never subscribed are deleted after two years without a sign-in. |
| Assistant conversations | 12 months after the last message, or until you delete them |
| Assistant memories | Until you delete them, turn memory off and clear them, or delete your account |
| Monitoring summaries | The latest 120 checks for each account, and never more than 13 months |
| Fix statistics (anonymous) | 3 years |
| Feedback | 12 months after it’s been reviewed |
| Messages you send us | 2 years |
| Security and audit logs | 2 years |
| Billing records | Held by Stripe, and kept for 6 years where tax law requires |
When you delete your account, we delete your account data straight away, cancel any subscription and revoke our Google monitoring and Shopify access. Fix statistics already recorded are kept without any link to you. Backups are overwritten within 30 days.
How we protect data
All traffic is encrypted with HTTPS. Google and Shopify tokens are encrypted at rest with AES-256-GCM. Access to production systems is restricted to the people who run Merchant Guard. Read more in our security overview.
Cookies
The website sets two cookies, both only when you sign in: mg_session keeps you signed in, and mg_signed_in lets the page show “Your account” in the menu. Both are strictly necessary. We don’t use analytics, advertising or tracking cookies, and we don’t embed third-party trackers.
Your rights
Under UK data protection law you can ask to access, correct, delete or move your data, to restrict or object to how we use it, and to withdraw consent. Most of this you can do yourself in your account: download your data, delete memories and conversations, or delete your account. For anything else, email support@merchant-guard.co.uk and we’ll respond within one month.
If you’re unhappy with how we’ve handled your data, please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk.
Children
Merchant Guard is a business tool for people aged 18 and over. We don’t knowingly collect data from children.
Changes to this policy
If we make a significant change, we’ll email account holders and show a notice in the extension before it takes effect. The date at the top shows when this policy last changed.