This Privacy Policy explains how 2751629 ALBERTA INC., doing business as MerchLoom ("MerchLoom", "we", "us", or "our"), collects, uses, and protects your information when you use our websites, applications, and AI-powered image processing services (the "Service").
By using the Service, you agree to the collection and use of information in accordance with this Policy.
Our Privacy Officer is responsible for overseeing compliance with this Policy and applicable privacy legislation, including Alberta's Personal Information Protection Act (PIPA) and the Personal Information Protection and Electronic Documents Act (PIPEDA). You may contact the Privacy Officer at privacy@merchloom.ai for any privacy-related inquiries, access requests, or complaints.
1. Information We Collect
1.1 Account Information
- Email address
- Full name (optional)
- Password (stored as secure hash, never in plain text)
- Account creation date
1.2 Billing Information
- Payment method details (processed by Stripe; we do not store full card numbers)
- Purchase history (credits, transactions)
- Credit balance
1.3 Image & Processing Data
- Images you upload for processing
- Processed output images
- Processing settings and preferences
- Job history (operations performed, timestamps, status)
1.4 Ready-Made Projects & Ratings
- Photos you add to a ready-made project, in place of its example images, are stored privately in your account and used only to run that project for you
- If you rate a project: your star rating, whether you ran the project, and the optional comment (up to 500 characters) and display name (up to 40 characters) you choose to add. Comments and display names are shown publicly on the project page
- To limit repeated or fake ratings, we store a one-way hash of your network (the first three parts of an IPv4 address, or the first 48 bits of an IPv6 address), made with a key that changes every day, so ratings can be linked through it only within the same day. We do not store your IP address with your rating
2. How We Use Your Information
2.1 To Provide the Service
- Process your images using AI models
- Deliver processed results for download
- Maintain and secure the Service
- Provide customer support
2.2 To Manage Your Account
- Authenticate logins
- Process payments via Stripe
- Send transactional emails (receipts, security alerts, important notices)
2.3 To Improve the Service
- Monitor infrastructure and error rates
- Diagnose and fix bugs
- Optimize performance
2.4 To Comply with Law
- Maintain records for accounting and tax purposes
- Respond to lawful requests from authorities
What We Do NOT Do
- We do NOT use your images to train our own AI models
- We do NOT sell your personal data
- We do NOT share your images publicly
- We do NOT use your images for marketing
3. Data Retention & Deletion
Our goal is ephemeral processing:
- Uploaded images: Deleted within 30 days after processing
- Processed output: Available for download for 90 days, then auto-deleted
- Verification codes: Expire after 5 minutes
- Account data: Until you delete your account
- Unused project photos: Deleted after 7 days
- Rating network hash: Erased after 30 days
- Ratings: Until you delete your account (or ask us to remove a rating). When you delete your account, your comments, display name and network hash are removed from your ratings; only the anonymous star rating remains
- Payment records: 7 years (tax/legal requirement)
You may request deletion of your account and associated data at any time by contacting us at support@merchloom.ai.
4. Information Sharing
We do NOT sell your personal data.
We may share information with:
4.1 Service Providers
- Cloud Infrastructure (United States): For secure image storage and delivery
- Payment Processing (United States): Stripe, for processing payment transactions
- Email Services: For transactional emails
- AI Processing (United States): Third-party AI providers for image processing operations including background removal, upscaling, and enhancement
These providers process data on our behalf under contracts requiring data protection. Your information may be transferred to and processed in the United States through these service providers.
4.2 Business Transfers
In connection with a merger, acquisition, or sale of business assets. We will require the receiving party to respect this Policy.
4.3 Legal Requirements
- To comply with law, regulation, or lawful requests
- To protect rights, property, or safety of MerchLoom, users, or the public
4.4 With Your Consent
When you explicitly ask us to share, such as through integrations with third-party tools.
5. Cookies & Tracking
5.1 Essential Cookies
Required for login sessions, security (CSRF protection), and basic functionality. Cannot be disabled.
5.2 Analytics Cookies
Help us understand how the Service is used (page views, usage patterns). Optional with your consent.
5.3 Marketing Cookies
Used for relevant advertising. Optional with your consent.
You can manage cookie preferences via the cookie banner or in your browser settings. We display a consent banner for non-essential cookies.
6. Your Rights
Depending on your jurisdiction, you may have these rights:
- Access: Request a copy of your personal data
- Rectification: Request correction of inaccurate data
- Erasure: Request deletion of your data ("right to be forgotten")
- Portability: Request a portable copy of your data
- Objection: Object to or restrict certain processing
How to Exercise Your Rights
To exercise any of these rights, including data export, account deletion, or profile updates, please contact us at support@merchloom.ai.
For EU/UK and similar jurisdictions, we handle requests in line with GDPR standards.
Your California Privacy Rights (CCPA/CPRA)
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the following rights regarding your personal information:
- Right to Know: Request the categories and specific pieces of personal information we have collected about you, the sources, the business purpose for collecting it, and the categories of third parties with whom we share it.
- Right to Delete: Request deletion of personal information we have collected from you, subject to legal exceptions.
- Right to Correct: Request correction of inaccurate personal information.
- Right to Opt Out of Sale or Sharing: Direct us not to sell or share your personal information. We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
- Right to Limit Use of Sensitive Personal Information: Where we use sensitive personal information beyond what is necessary to provide the Service, you may direct us to limit that use. We do not use sensitive personal information for any purpose other than providing and securing the Service.
- Right to Non-Discrimination: We will not discriminate against you for exercising any of these rights.
To exercise these rights, contact us at privacy@merchloom.ai. You may use an authorized agent to submit a request on your behalf. We will verify your identity before acting on a request. We do not knowingly sell or share the personal information of consumers under 16 years of age.
7. Security
We use reasonable technical and organizational measures to protect your information:
- Encrypted connections (HTTPS/TLS) for all data in transit
- Secure password hashing (bcrypt)
- CSRF protection on all state-changing operations
- Rate limiting to prevent abuse
- Access controls and least-privilege policies
- Regular security reviews
However, no system is perfectly secure. We cannot guarantee absolute security.
Data Breach Notification
If we become aware of a security breach that compromises your personal information and creates a real risk of significant harm, we will notify you and the relevant supervisory authorities without undue delay, as required by applicable law (including PIPEDA in Canada and the GDPR in the EU/UK). Our notice will describe, to the extent known, the nature of the breach, the information involved, the steps we are taking, and what you can do to protect yourself. We maintain internal procedures for detecting, assessing, and responding to such incidents.
8. International Data Transfers
We may process and store information on servers in different countries (United States, European Union). Your information may be transferred outside your country of residence.
For users in the EU/UK, we rely on appropriate safeguards such as Standard Contractual Clauses for cross-border transfers.
9. Children's Privacy
The Service is not intended for anyone under 18 years of age (or the age of legal majority where you live). We do not knowingly collect personal data from minors. If you are a parent or guardian and you believe your child has provided us data, please contact us at support@merchloom.ai so we can delete it.
10. Changes to This Policy
We may update this Policy from time to time. We will post the updated version and update the "Last updated" date. For material changes, we may notify you by email or within the Service.
Continued use after changes means you accept the updated Policy.
11. Contact Us
If you have questions about this Privacy Policy or our data practices, contact our Privacy Officer at privacy@merchloom.ai. If you are not satisfied with our response, you may escalate your complaint to your local data protection authority or privacy commissioner.
