Privacy policy

Last updated 29 October 2026

Who we are

Merchella is run by Northstar Ridge Ltd, a company registered in England and Wales (company number [COMPANY NUMBER]), at [REGISTERED ADDRESS].

For privacy questions, email privacy@merchella.com.

Our two roles

Under the UK GDPR and the Data Protection Act 2018, we have two different roles depending on whose data it is.

Controller: We decide how and why data is used. We are the controller for data about merchants (people who sign up for Merchella), their team members, and visitors to merchella.com.
Processor: We handle data only on someone else's instructions. We are a processor for data about shoppers who buy from merchants' shops. The merchant is the controller.

This policy mainly covers data we control. If you shopped at a shop built on our platform, please read that shop's own privacy notice and contact the shop first. Our Data processing agreement sets out how we handle shopper data for merchants.

What we collect

About merchants and their team members:

Name, email address, phone number and business details.
Sign-in details, including 2-step sign-in settings.
Billing details such as plan, invoices and payment status. Card or PayPal details are handled by the payment provider, not stored by us in full.
Messages you send us and notes from support conversations.
How you use the Command admin area, such as sign-in times, settings changes and technical logs.
Text you enter into our AI writing help, and the text it returns.

About visitors to merchella.com:

Technical data such as IP address, browser type and pages requested, kept in server logs for security and to keep the site running.
Visit counts: the page you viewed, the domain of the website that sent you (for example google.com, not the full address), and a visitor code. See "How we count visits" below.
Anything you choose to send us, for example through a contact form or by email.

About shoppers (as a processor for merchants):

Names, addresses, email addresses and phone numbers given at checkout.
Orders, baskets, delivery details and tracking information.
Reviews, questions and messages sent to the merchant.
Browsing activity in the shop, such as pages viewed and items in the basket, and where a visit came from.
Marketing preferences.

How we use data and our lawful bases

We only use personal data when the law gives us a reason (a lawful basis). Here is what we do and why:

Running your account: Setting up your shop, signing you in, providing the features of your plan. Basis: contract.
Billing: Taking subscription payments, sending invoices and dealing with failed payments. Basis: contract and legal obligation (keeping tax records).
Support: Answering your questions and fixing problems. Basis: contract and legitimate interests (helping our customers).
Service emails: Telling you about your account, security, changes to terms and prices. Basis: contract and legitimate interests.
Security and fraud prevention: Protecting accounts, spotting misuse and keeping logs. Basis: legitimate interests and, where required, legal obligation.
Counting visits to merchella.com: Knowing which pages are read and which websites send us visitors, so we can improve our website. Basis: legitimate interests.
Improving the service: Understanding how features are used so we can fix and improve them. Basis: legitimate interests.
Product news: Occasional emails about new features. Basis: legitimate interests for existing customers, with an easy way to opt out in every email; consent where the law requires it.
Legal matters: Meeting our legal duties, and making or defending legal claims. Basis: legal obligation and legitimate interests.

Where we rely on legitimate interests, we have weighed our interests against your rights. You can ask us for more detail.

We do not sell personal data, and we do not use shopper data for our own marketing.

How we count visits

We count visits to merchella.com ourselves, without cookies or local storage and without any third-party analytics service. When a page loads, a small beacon sends us:

the page you viewed;
the domain of the website that sent you, if any; and
a visitor code.

The visitor code is made by putting your IP address and browser details through a one-way hash that changes every day. We do not store your IP address for this, the code cannot be turned back into your IP address, and because it changes daily it cannot be used to link your visits across different days. It only lets us count one visitor once per day.

We use this for our legitimate interests in understanding and improving our website. We keep these visit records for 13 months, then delete them. If you would rather not be counted, you can block the beacon with a browser setting or content blocker; the site will still work.

We use trusted service providers (processors and sub-processors) to run the service. They may only use the data to provide their service to us. By category:

Hosting: Sevalla hosts our website, the Command admin area and merchants' shops, including the databases behind them.
Payments: PayPal handles shoppers' payments at checkout under the merchant's own PayPal account. Payment providers also handle our subscription billing.
Email delivery: An email delivery provider sends account emails, and the order and marketing emails merchants set up.
AI writing help: When a merchant uses the AI writing button, the text they enter is sent to an AI provider to produce a suggestion. This only happens when the feature is used.

We may also share data:

with services a merchant chooses to connect, such as their warehouse, Google or Microsoft advertising accounts, on that merchant's instructions;
with professional advisers such as accountants and lawyers;
with police, regulators or courts where the law requires it; and
with a buyer if our business, or part of it, is sold. We will tell you if this happens.

International transfers

Some of our providers may store or access data outside the UK. When that happens, we make sure the data is protected by an appropriate safeguard, such as:

a country the UK has approved as having adequate data protection;
the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses; or
another safeguard allowed under UK law.

You can ask for more information about transfers at privacy@merchella.com.

How long we keep data

We keep personal data only as long as we need it. In general:

Account data is kept while your account is open, and for a limited time after it closes so you can come back or export your data.
Billing records are kept for as long as tax and accounting law requires, which in the UK is usually six years.
Support messages are kept while they are useful for helping you, then deleted.
Server and security logs are kept for a short period, then deleted or anonymised.
Visit counts for merchella.com are kept for 13 months, then deleted.
Shopper data is kept on the merchant's instructions, and deleted after the merchant's account is closed, as set out in our Data processing agreement.

How we keep data safe

Connections to our website and shops are encrypted.
Everyone signing in to the Command admin area uses 2-step sign-in.
Merchants choose what each team member can see.
Access to data within our team is limited to people who need it.

No system is completely secure, but we work to protect your data and we will tell you and the ICO about a serious breach where the law requires it.

Your rights

Under UK data protection law you have the right to:

ask for a copy of your personal data;
have inaccurate data corrected;
have your data deleted in some cases;
restrict or object to how we use it in some cases, including objecting to direct marketing at any time;
receive your data in a portable format in some cases; and
withdraw consent at any time, where we rely on consent.

To use any of these rights, email privacy@merchella.com. We will reply within one month. We may need to check your identity first.

If you are a shopper, please contact the shop you bought from. They control your data. If you contact us, we will pass your request to them.

Complaints

If you are unhappy with how we have handled your data, please tell us first at privacy@merchella.com. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk or on 0303 123 1113.

Cookies

Our Cookie policy explains the cookies used on merchella.com. Merchants control the cookie settings on their own shops.

Children

Merchella is a service for businesses and is not aimed at children. Merchants must be at least 18.

Changes to this policy

We may update this policy. The date at the top shows when it last changed. If we make a significant change, we will tell merchants by email.