Privacy Policy

1. Who we are

Merchables (“Merchables”, “we”, “us” or “our”) runs the Merchables mobile app and the website merchables.io (together, the “service”). We are the controller of the personal information described in this policy.

If you have a question about privacy or want to use your rights, contact us at communicate@merchables.io.

2. Who can use Merchables

Merchables is for people aged 13 and over. When you create an account, we ask for your date of birth to check your age. If you are under 13, you cannot create an account.

If we learn that an account belongs to someone under 13, we will close the account and delete its personal information. If you think a child under 13 is using Merchables, please tell us at communicate@merchables.io.

Accounts of people aged 13 to 17 are teen accounts and get extra protections. Section 11 explains them.

3. Information we collect

Information you give us

• Account details: your email address, name, username, password (we store it only in a securely hashed form) and date of birth.
• Profile: your profile photo and any bio or other details you choose to add.
• Posts and comments: the designs, photos and videos you upload, their captions, hashtags and tags, the comments you write, and a place name if you add one to a post.
• Activity with others: the posts you like and save, the accounts you follow, the accounts you block and the reports you make.
• Merch settings: whether you make a post available as merch, and the product previews we create from it.
• AI video requests: if you ask us to make a video from your design with AI, the images and instructions you submit.
• Orders: the delivery name, address, email address and phone number you give us, what you ordered, and its payment, printing and delivery status. Card and bank details go directly to our payment providers. We do not see or store full card numbers.
• Creator payouts: when payouts are available, the details we need to pay you and to meet tax and anti-fraud rules.
• Messages to us: what you send when you contact us, and your contact details.

Information we collect automatically

• Device and log information: your IP address, device type, operating system, app version, browser type, the screens and pages you use, and the date and time of each request. We use it to run, secure and fix the service.
• Posts you view: when you are signed in, the app records which posts you look at in your feed and in Reels, and when you last looked at each one. A post counts when most of it stays on your screen for about a second. We use this record only to order your own feed, so that you do not keep seeing the same posts. We keep it for 30 days after you last viewed the post. We do not show it to anyone. When you are signed in, we also record each Pulse post you view. We use this Pulse view record to count your view of a post only once. When you are not signed in, we keep the same record under a one-way code made from your device’s app identifier, never the identifier itself. We keep a Pulse view record for 90 days after the view.
• Error and crash reports: when the app or the website fails, it sends a report about the fault to our error-reporting provider, Sentry. Section 7 explains what a report shows. We use these reports only to find and fix faults.
• Location: Merchables does not track your location. If you add a place to a post, you can type it, or you can ask the app to suggest nearby place names. The suggestion uses your device’s location only after you give permission, and only at that moment. Your device turns the position into place names. We save only the place name you choose, and we show it publicly with that post. We do not store your precise coordinates. A post shows a place name only when you choose to add one.
• Photo data: a photo file can hold where it was taken (GPS location) and details of the camera or phone. We remove this data from your photos when we store them.
• Push notifications: if you allow notifications, your device or browser gives us an address to send them to: a push token in the app, or a push subscription on the website. We link it to your sign-in on that device. We use it only to send the notifications you choose in the app’s Settings or in Account → Notifications on the website. We delete it when you sign out on that device, when that sign-in ends, or when the push service tells us that it no longer works. You can turn notifications off at any time there, or in your device’s or browser’s settings.
• Cookies and similar technologies: see section 13.
• Ads: when we show ads from Google, Google collects information to show them. Section 14 explains what it collects and the choices you have.

Information from others

• Other users may mention you, comment on your posts, or report your content or your account.
• Our service providers tell us about the status of orders, deliveries and payments.

4. How we use your information

We use personal information only when the law allows it. For each purpose, the legal basis is in brackets.

• To create and run your account, show your profile and posts, and let you follow, like, comment, save, share and block (to perform our contract with you, which is our Terms of Service).
• To order your feed, so that posts you have not seen yet come first (our legitimate interests).
• To check your age and apply the protections for teen accounts (to comply with the law, and our legitimate interest in keeping young people safe).
• To moderate content, handle reports, prevent abuse, fraud and spam, and keep the service secure (our legitimate interests and, where the law requires it, to comply with the law).
• To create product previews of designs that their creators make available as merch, and to make and deliver orders (to perform our contract with you).
• To make an AI video when you ask for one (to perform our contract with you).
• To take payments, pay creators, and keep financial records (to perform our contract with you and to comply with tax and other laws).
• To send you service messages, such as security alerts, order updates and changes to our terms (to perform our contract with you, and our legitimate interests).
• To understand how the service is used, fix problems and improve it, using combined or de-identified information where we can (our legitimate interests).
• To meet legal obligations, respond to lawful requests, and establish or defend legal claims (to comply with the law, and our legitimate interests).
• To show ads from Google in some feeds, when we show them, to keep them suitable for teens, and to handle the ads you report (our legitimate interests). Google personalises ads only as section 14 explains, and with your consent where the law requires it.

When we rely on legitimate interests, we have weighed them against your rights, and you can object (see section 10). When we rely on your consent, you can withdraw it at any time.

We do not sell your personal information. We do not use it to target advertising at you, and we never give advertisers your name, email address, date of birth or messages. When we show ads from Google, Google may personalise them only for adults who allow it, as section 14 explains. Ads for teens are never personalised.

5. What other people can see

Your username, name, profile photo and bio, your posts, your comments, and the place name on a post are public. Anyone with a link can see them, including people who do not use Merchables. When you or someone else shares a post, the link preview can show the post’s image, caption and your username.

If your account is private, only the followers you approve can see your posts, and the photos and videos in them open only through links that stop working after about an hour. Accounts of people under 18 are private when they are created.

Your date of birth, email address, the posts you view, the accounts you block and the reports you make are not public. We do not tell people who reported them.

6. Moderation, reports and safety

We review content to keep Merchables safe. We use human review and, where we use them, automated tools to find content that breaks our rules, such as nudity, sexual content, or content that may infringe someone else’s rights. A design must be approved before it can be sold as merch.

You can report a post, comment or account in the app, and you can block any account. When you block someone, they can no longer view your profile and posts or interact with you in the app, and you no longer see their content. Public posts can still be seen by people who are not signed in.

When we remove content because of a report, we may keep a copy in restricted storage for up to one year. We do this so we can handle appeals and respond to lawful requests from the police or regulators. We then delete it.

If we find content that may show the sexual abuse or exploitation of a child, we remove it, keep the evidence the law requires, and report it to the relevant authorities.

7. Who we share information with

We share personal information only as described here. Our service providers process it under contract, only on our instructions and only for the purposes below.

• Amazon Web Services (AWS) hosts the service, its databases and your uploads. We store uploaded media in AWS’s London region (eu-west-2).
• Cloudinary stores, resizes and delivers images and videos.
• Prodigi prints and delivers merch orders. Prodigi receives the print file of the design, the products ordered, and the delivery name, address and contact details.
• Higgsfield generates AI videos, and only when you ask us to make one. Higgsfield receives the images and instructions you submit.
• Sentry receives error and crash reports from the app, the website and our servers, so we can find and fix faults. A report shows what failed and where, and the app or browser version. It can also show details of the device, such as its model, operating system, language and time zone, and the steps just before the fault, such as the screens or pages you opened. We remove email addresses and sign-in tokens before a report is sent, and we do not send your name or account ID. Sentry does not keep your IP address. It keeps reports for 30 days, in the United States.
• Push notification services deliver notifications to your device. The app’s notifications go through Expo, which passes them to Apple (iPhone) or Google (Android). The website’s notifications go to your browser’s push service: Google (for example, Chrome), Mozilla (Firefox), Apple (Safari) or Microsoft (Edge). A notification holds its short text (for example, “@ada liked your post”), a link and your number of unread notifications. A website notification is encrypted so that only your browser can read it.
• Google (AdSense on the website, AdMob in the app) shows the ads described in section 14, when we show them. Google is a separate controller of the information it collects for ads, under its own privacy policy.
• Stripe processes payments and payouts. It receives the payment and order details it needs. For some purposes, such as fraud prevention and meeting financial regulations, it acts under its own privacy policy.

We may also share personal information:

• with other users and the public, as described in section 5;
• with the police, regulators, courts or other authorities when the law requires it, or when it is necessary to protect someone’s safety, prevent fraud or enforce our terms;
• with a buyer or successor if Merchables is involved in a merger, sale or reorganisation. The new owner must protect your information as this policy describes.

8. International transfers

We keep most personal information in the United Kingdom. Some of our service providers process information in other countries, including the United States, countries in the European Economic Area, and Nigeria.

When we transfer personal information out of the United Kingdom or Nigeria, we use the protections the law requires. These include adequacy decisions, the UK International Data Transfer Agreement or Addendum, standard contractual clauses, and the other transfer grounds in the Nigeria Data Protection Act 2023. You can ask us for more information at communicate@merchables.io.

9. How long we keep information

• Your account: we keep your account information while your account is open. When you delete your account, your profile, posts and comments disappear for everyone at once, and you are signed out on every device. For 30 days you can restore your account by signing in again. After 30 days we erase your name, email address, date of birth, profile, posts, comments, photos, likes, saves, follows and blocks, and your email address and username become free again. If an order of yours is still on its way, we wait until it arrives, because we need the address to deliver it. The information described below is kept.
• Posts you view: we delete the record of a post you viewed 30 days after you last viewed it. When you delete your account, we delete your whole record of viewed posts straight away.
• Pulse view records: we delete the record of a Pulse post you viewed 90 days after the view.
• Notifications: we delete a notification 90 days after you read it. We delete an unread notification 365 days after it arrives. A follow request stays until it is answered or withdrawn.
• Backups and copies: erased information stays in our secure database backups for about 30 days, until the backups are deleted automatically. The photos and videos of an erased account are removed from our storage within 60 days of the deletion, and the last stored copy within 90 days.
• Reports and moderation: we keep reports and our decisions for as long as we need them for safety and legal reasons. Content removed after a report is kept for up to one year, as described in section 6. When we erase an account, we remove its details from the reports about it one year after each report is resolved.
• Orders and payments: we keep order and payment records for six years after the order, to meet tax and accounting rules. When we erase an account, we keep its orders without the name, street address, postcode or phone number. We keep only the delivery country and region, which tax rules need. Credit purchases and the credits used stay in our records; unused credits are lost. We keep the print file of an ordered design for as long as we need it to make, deliver, replace or refund the order, or to deal with a legal claim.
• Logs: we keep security and access logs only for as long as we need them to protect the service.
• Error and crash reports: Sentry deletes each report 30 days after it arrives.
• Our service providers: when we erase an account, Stripe and Prodigi keep the payment and delivery details of past orders under their own legal duties. We do not send them your profile or posts.

10. Your rights

Under UK data protection law (the UK GDPR and the Data Protection Act 2018) and the Nigeria Data Protection Act 2023, you have the right to:

• be told how we use your personal information (this policy does that);
• get a copy of your personal information;
• correct information that is wrong or incomplete;
• ask us to delete your information, including by deleting your account;
• ask us to restrict how we use your information;
• object to our use of your information, including use based on our legitimate interests;
• receive information you gave us in a portable format, or ask us to send it to another organisation;
• withdraw your consent at any time, where we rely on consent;
• not be subject to a decision based only on automated processing that has legal or similarly significant effects on you.

To use any of these rights, or to delete your account, email communicate@merchables.io from the email address on your account. We may ask you to confirm your identity. We reply within one month. If your request is complex, we may need up to two more months, and we will tell you if so. We do not usually charge a fee.

If you are unhappy with how we handle your information, please contact us first so we can try to help. You can also complain to a regulator:

• in the United Kingdom, the Information Commissioner’s Office (ICO): ico.org.uk;
• in Nigeria, the Nigeria Data Protection Commission (NDPC): ndpc.gov.ng.

11. Teens on Merchables

If you are 13 to 17, your account is a teen account. We design teen accounts to protect you:

• We use your date of birth to apply teen protections. You cannot change it to appear older.
• We do not use your personal information to target advertising, and we never sell it.
• When we show ads from Google (section 14), we tell Google to treat ads for teen accounts as teen ads: never personalised, with Google’s teen protections.
• Content we mark as 18+, such as content about alcohol and nightlife, is not shown to teen accounts.
• You can block and report anyone, and we review reports about teen accounts with priority.
• Creators under 18 can receive payouts only through a parent’s or guardian’s account.

We follow the UK Age Appropriate Design Code when we design features that teens use. If you are a parent or guardian and have a concern about a teen’s account, contact us at communicate@merchables.io.

12. Security

We protect personal information with measures such as encryption in transit, access controls, and hashed passwords. Photos and videos from private accounts, and media marked 18+, open only through signed links that stop working after about an hour. No system is completely secure. If a security breach is likely to put your rights at risk, we will tell you and the relevant regulators as the law requires.

13. Cookies and the website

merchables.io sets no cookies of its own, and it uses no analytics cookies. The pages load images and videos from our media providers, Cloudinary and AWS.

Advertising cookies come only with ads from Google (section 14). When we show Google ads on the website, Google’s scripts run only on the web app’s pages (merchables.io/feed), and nowhere else on merchables.io. There, Google stores your consent choice in a cookie on merchables.io. Google also stores advertising cookies, which it uses to show, measure and personalise ads and to stop fraud. In the UK, the European Economic Area and Switzerland, it does this only if you choose Consent. If you choose Do not consent, Google keeps only your choice and shows limited ads. While we show no Google ads on the website, no page sets these cookies.

You can change your choice at any time with “Privacy and cookie settings” at the foot of the web app’s pages, or in Account → Preferences. The link is there while we show Google ads.

When a page fails, your browser sends an error report to Sentry (see section 7). Error reports use no cookies and store nothing in your browser. Merchables post cards on other websites never send error reports from your browser.

When the web feed is available and you sign in on the website, your browser keeps your sign-in in local storage, so you stay signed in after you close the tab. Log Out removes it. We need it to keep you signed in. A sign-in on the website ends after 30 days without use.

With each sign-in we keep the name of the device or browser (for example “iPhone · iOS 26” or “Chrome on Mac”) and when it was last used. You can see them in the app under Settings → Password and sign-in. We delete them with the sign-in record, 30 days after the sign-in ends.

14. Advertising

We may show ads from Google in some feeds: on the app’s Home and Culture feeds, and on the website’s creator feed and Culture feed. An ad shows between posts and is labelled “Ad” in the app or “Advertisements” on the website. We never show ads on product, checkout, account, sign-in or legal pages, or in messages.

What Google receives

When we show an ad, Google decides how it uses the information it collects, so Google is a separate controller of that information. Google receives your IP address and the approximate location worked out from it, details of your device and app or your browser, which ads you see and tap, and the address of the page or post next to the ad. It receives cookies on the website, or your device’s advertising identifier in the app, only where you allow them. We do not give Google your name, email address, date of birth or messages.

Google uses this information to show ads, to measure them and to stop fraud. It personalises ads (chooses them from your activity) only as described below. Google explains its own use in How Google uses information from sites or apps that use our services.

Your choices

• Adults in the UK, the European Economic Area and Switzerland see Google’s consent message first. If you choose Consent, Google may show you personalised ads. If you choose Do not consent, Google shows limited ads: they use no cookies and no advertising identifiers, and they are not personalised. Google keeps a record of your choice for us.
• Adults elsewhere may get personalised ads. In the app, you can turn them off in Settings → Ad choices → Personalised ads. In some US states, Google’s message on the website also lets you opt out.
• Teen accounts, people who are not signed in, and accounts without a date of birth never get personalised ads. We tell Google to treat their ads as teen ads, with Google’s teen protections. The app shows them no consent message. On the website, Google’s consent message can still appear, because it also covers cookies.
• On iPhone, the app asks Apple’s permission to track before Google can use your device’s advertising identifier. If you choose Ask App Not to Track, Google does not get it. You can change this in your iPhone’s Settings.
• On Android, Google may use your device’s advertising ID. You can reset or delete it in Android’s settings.

To change your choice later: in the app, go to Settings → Ad choices; on the website, use “Privacy and cookie settings” at the foot of the web app’s pages or in Account → Preferences. Your new choice applies to the next ad.

Reporting an ad

In the app, you can report an ad with “Report this ad”. We keep the reason, where the ad appeared, the ad’s words and its Google reference when the app can read them, and whether you were signed in. The report does not say who sent it. We check reports and ask Google to block ads that break our rules. On the website, use the AdChoices mark that Google shows on the ad: the report goes to Google.

15. Changes to this policy

We will post any changes on this page and update the “Last updated” date. If a change is significant, we will tell you in the app or by email before it takes effect.

16. Contact us

Questions, requests or complaints about privacy: communicate@merchables.io.