Privacy

This page describes what Holm IT AB collects when you use merchantcure.com, why, and what you can do about it. It is written to be read rather than to be exhaustive; if something you care about is not covered, ask and we will answer and then add it here.

Who is responsible

Holm IT AB, company registration number 556980-7307, Bolmensvägen 13, 120 50 Årsta, Sweden. Contact: hello@merchantcure.com. We are the data controller for everything described here.

MerchantCure is a trading name of Holm IT AB, a company registered in Sweden (reg. no. 556980-7307, VAT SE556980730701). Holm IT AB is the seller and the contracting party, and issues every invoice.

What we collect, and why

When you send a Quick Scan request

Your shop URL

So we can fetch and examine the shop. This is the entire purpose of the form.

The suspension reason you selected

To decide where to look first, and whether we can help at all.

Your email address

To send you the answer. Not added to any mailing list, and not used to contact you about anything else unless you ask us to.

Anything you write in the notes field

Only what you choose to put there.

The form is processed by Netlify, which hosts this site, and the submission is emailed to us. Netlify acts as our processor for that.

When we examine your shop

We fetch public pages of the storefront you gave us and store a snapshot so the analysis can be run repeatedly without fetching your server again. That snapshot contains page content that is already public.

• We fetch politely: a pause between requests, a cap on how many pages, and robots.txt obeyed.
• Cart and checkout pages are never fetched. A request there can create an order.
• We never log in to your shop, and we never touch your Merchant Center or Google Ads account. Where you have connected a shop API key and approved a specific text change, we write that one change and log the value that was there before. Prices, stock and visibility are never written.

When you create an account and sign in

An account exists so that your diagnosis is yours and not merely reachable by anyone holding a link. What it holds:

• Your email address. It is the account — there is no username and no password, because a password is a secret we would have to store, reset and answer for.
• The shops you have connected to it, by domain, and the scans belonging to them.
• Whether a diagnosis has been paid for, and which one.

You sign in with a link sent to that address. We store only a SHA-256 hash of the link’s token, never the token itself; it is valid for 15 minutes and is consumed the first time it is used.

The session cookie. Signing in sets one cookie, mc_session. It is signed and carries your user id and an expiry — nothing else, and no server-side session record. It cannot be revoked before it expires. Signing out stops your browser sending it, but a copy of the string would keep working until it lapses. That is the honest cost of not keeping a session table, and the counterweight is a short life: 14 days, after which it stops working on its own. It is described again on the cookie page.

Ask us to delete your account and the account row, its login tokens and its shop connections go with it. What we keep is what accounting law requires us to keep about a purchase that was made — see below.

When you pay

Payment is handled by Stripe, who act as our payment processor. You are sent to Stripe’s own payment page to pay, and you come back afterwards.

No card details reach us. We never see, receive or store a card number — our database holds a Stripe session id and a payment id, the amount, the currency, the product count the tier was chosen on, and the date you asked us to begin work. Stripe processes your card data as their own controller under their privacy policy.

Order and invoice records are kept for as long as accounting law requires — that obligation outlives a deletion request, and it is the one place where we cannot simply erase on demand. We will say so plainly if you ask.

When you just read the site

Our server logs are handled by Netlify as part of hosting. Advertising cookies are set only if you actively accept them — see the cookie page for what is active right now, and for every host this site may contact.

How long we keep it

If we do not take your case

The crawl snapshot is deleted. Your email is kept only as long as the correspondence is open.

If we do take your case

The material is kept for the duration of the engagement and for as long afterwards as accounting law requires us to keep the associated records.

Form submissions

Kept in the inbox and in Netlify's form store until deleted.

Your account

Kept while the account exists. Ask us to delete it and the account, its login tokens and its shop connections go. Login tokens expire on their own after 15 minutes; the session cookie after 14 days.

Shop API keys you connected

Kept encrypted until you delete the connection. Deletion removes the stored credential rather than marking it inactive. You can also revoke the key in your own shop at any time.

Orders and invoices

Kept for as long as accounting law requires. This is the one category a deletion request cannot clear, because the obligation is not ours to waive.

What we never do

• Sell or rent your data.
• Use it to train anything.
• Name you publicly. Anything we publish about classes of fault is aggregated and anonymised, and no shop, domain, brand or product is identified. Look at What we find: those are real cases, and you cannot tell whose.
• Contact your competitors, your suppliers or Google about you.

Two roles, and which one applies when

For your own details — your email, your company, your order — we are the controller. That is everything described above.

For what is inside your shop we are a processor acting for you. Product texts can contain personal data, and the API key you connect reaches more than we read. You remain the controller of that material, and the terms below apply to it. They are the commitments Article 28 requires, written out rather than referenced.

1. Only on your instruction. We read what a diagnosis needs and write only changes you approve one at a time. There is no processing for our own purposes.
2. Confidentiality. Everyone with access is bound to it, and access exists only where the work requires it.
3. Security. Shop credentials are stored encrypted, never in plain text, and are never written to a log or returned by an API.
4. Sub-processors are named. They are the ones listed under “Who else handles your data” below. We will tell you before adding one that touches shop data.
5. Deletion at the end. Credentials are deleted when the engagement ends, at the latest thirty days after the last verification pass. Crawled material is deleted with the case unless you ask us to keep it.
6. Help with requests. If someone exercises a right against you and the answer is in material we hold, we will help you answer, at no charge.

If your own compliance work needs this as a separate signed document rather than a page, write to us and we will sign one. The commitments will be these.

Your rights

Under the GDPR you can ask for a copy of what we hold, ask us to correct it, ask us to delete it, object to processing, or ask for it in a portable format. Email hello@merchantcure.com and we will act within 30 days. You do not need to give a reason for a deletion request.

If you think we have handled your data badly you can complain to the Swedish Authority for Privacy Protection (IMY), or to the supervisory authority in your own country.

Who else handles your data

These are every service that touches it, what each one sees, and whether it processes outside the EU. Several are US-based and do so under standard contractual clauses and the EU–US Data Privacy Framework; where we have not established a provider’s processing location, we say that rather than assume.

Netlify

Hosting and the contact form store. Sees server logs and what you submit in the form.

Stripe

Payment processing. Sees your card details and billing information as their own controller; we never receive them.

ImprovMX

Forwards mail sent to hello@merchantcure.com to a mailbox we read. It handles the messages you send to that address in transit. We use it to receive, never to send. We have not established where it processes, so we do not claim it either way.

Resend

Sends the sign-in link to your email address. Sees the address and the link itself. We do not use it for newsletters, because there are none.

Cloudflare

Web Analytics, only if measurement is switched on. It is cookieless and counts page views without identifying you. It is not active today — see the cookie page for what is.

Google

Ads conversion measurement, only if you actively accept advertising cookies. Nothing is loaded and nothing is sent before that. We do not otherwise use Google as a processor.

We do not transfer your data anywhere else.

Changes

If this page changes materially, the date at the top changes and the old version is available on request. We will not quietly rewrite it.