Privacy Policy

My-Merch is a custom apparel and merchandise business in Southwest Missouri. This policy covers my-merch.com, our admin tools, and the data we handle when selling through marketplaces such as Amazon. Questions or requests: email us at the address in the footer.

• Customers: name, email, phone, billing and shipping addresses, order history, files you upload for quotes, and your Google account email if you sign in with Google.
• Payments: handled by PayPal. We keep payment references and amounts, never card numbers.
• Marketplace data: through Amazon's Selling Partner API we read and update our own product listings and read our own seller support cases. We do not request or store Amazon customers' personal information.
• Security records: IP addresses and browser details for sign-ins and rate limiting.

To make and ship your orders, send quotes and invoices, provide your account, manage our own marketplace listings and seller support, prevent fraud and abuse, and meet legal obligations. We don't sell personal data or use marketplace data for marketing.

• All traffic is encrypted with TLS (HTTPS), including connections to our database and storage.
• Data is stored with Neon (database) and Cloudflare R2 (files) in the United States, encrypted at rest with AES-256. Secrets are additionally encrypted by our application.
• Only our administrator can access customer and marketplace data, using multi-factor sign-in, and access to sensitive areas is logged.
• Amazon customer information that appears in our seller support cases is shown to our administrator on request and never saved.

Only service providers that run our business on our behalf: Vercel (hosting), Neon (database), Cloudflare (file storage), PayPal (payments), Resend (email), Google (sign-in) and shipping carriers (for delivery). Marketplace data is not shared with anyone. We disclose data if the law requires it.

• Customer accounts: until you ask us to delete them.
• Orders and invoices: as long as tax and accounting law requires.
• Amazon customer information: never stored.
• Security logs: 13 months. Encrypted backups: 90 days.

Email us to access, correct or delete your data. We delete account data within 30 days, except records we must keep by law. Deleted data leaves our backups within 90 days.

We follow a written incident response plan. If a breach affects your data, we will notify you, and the affected marketplace (for Amazon, within 24 hours), as required.