LEGAL

Privacy Policy

Effective August 3, 2026

1. Data Controller

The data controller responsible for your personal data is Merkly Yazılım ve Teknoloji Anonim Şirketi, a company incorporated under the laws of the Republic of Turkey, with its registered office at Aydınevler Mah. Sanayi Cad. No:3, Centrum Plaza A Blok Z01, Maltepe, İstanbul (MERSİS No 0617093516800001) ("Merkly," "we," "us," or "our").

We operate the Merkly platform, a business-to-business software-as-a-service solution that provides AI-powered product image generation for e-commerce brands and retailers.

2. Data We Collect

We collect and process the following categories of personal data in connection with your use of the Merkly platform:

Account Information, Your full name, business email address, company name, and any other details you provide during registration or account management.
Usage Data, Server logs, feature-usage analytics, session identifiers, IP addresses, browser type, operating system, and referring URLs collected automatically when you interact with our platform.
Uploaded Content, Product images, swatch photographs, brand assets, and any other files you upload for AI-powered image generation. This content may include metadata embedded in the files.
Payment Data, Billing name, billing address, subscription tier, and transaction history. All payment processing is handled by Shopify, or by Polar as merchant of record for subscriptions bought directly from us. We do not store credit card numbers, CVVs, or full payment card details on our servers.

3. How We Use Your Data

We process your personal data for the following purposes:

Service Delivery, To create and maintain your account, authenticate your sessions, and provide the core functionality of the Merkly platform.
AI Image Processing, To transmit your uploaded product images and related assets to third-party AI models for the purpose of generating, editing, and enhancing product visuals on your behalf.
Billing and Invoicing, To manage your subscription, process payments through Shopify or Polar, and maintain accurate financial records.
Communications, To send transactional emails (account confirmations, password resets, billing receipts), service announcements, and, where you have opted in, marketing communications about new features or offers.
Security and Fraud Prevention, To monitor for suspicious activity, enforce our Terms of Service, prevent abuse, and protect the integrity and availability of the platform.
Analytics and Improvement, To understand how our platform is used, identify errors, and improve features, performance, and user experience.

The legal bases for these processing activities include performance of a contract, legitimate interests, compliance with legal obligations, and, where applicable, your consent.

4. Third-Party Processors

We engage the following third-party service providers ("sub-processors") to help deliver the Merkly platform. Each processor is contractually obligated to handle your data in accordance with applicable data protection laws:

Google (Gemini AI), AI image generation and content analysis. Data may be processed in the United States and the European Union.
OpenAI, AI text generation and vision analysis for product content and image processing. Data may be processed in the United States.
Anthropic (Claude), AI text generation and image analysis for product content, attributes and brand strategy. Data may be processed in the United States.
fal.ai, AI video generation from your product images, used only when you generate a video. The underlying model provider processes data outside the European Economic Area, including in China.
Resend, Transactional email such as password resets. Data may be processed in the United States.
Google Analytics, Measurement of our public website only. It is not loaded inside the Merkly app in your Shopify admin, so your activity in the app is never sent to Google Analytics. It collects standard web analytics data such as pages viewed, approximate location derived from IP address, device and browser type, and whether a visit led to our Shopify App Store listing. Data may be processed in the United States. For visitors in the EEA, the United Kingdom and Switzerland, analytics storage is denied by default under Google Consent Mode, so no analytics cookie or identifier is set.
Cloudflare (R2 Storage), Object storage for uploaded images and generated assets. Data is stored across Cloudflare's global network.
Upstash (Redis), In-memory data store used for job queuing, rate limiting, and caching. Data is processed in regions selected by our infrastructure configuration.
Fly.io, Application hosting and background job processing. Our servers run in Frankfurt, Germany.
Neon, Managed PostgreSQL database. This is where account, brand and product records are stored. Data is processed in the European Union.
Shopify, E-commerce platform integration for publishing generated images and product data to your online store. Processing occurs according to Shopify's data processing terms.
Shopify, Billing for merchants who install Merkly from the Shopify App Store. Shopify handles the charge; we never see card details.
Polar, Merchant of record for subscriptions bought directly from us rather than through Shopify. Polar handles payment and tax; we never see card details. Data may be processed in the United States and the European Union.

We maintain an up-to-date register of sub-processors. If we add a new sub-processor that materially changes how your data is handled, we will notify you in advance.

5. International Data Transfers

Merkly is operated from Turkey. Your personal data may be transferred to, and processed in, countries outside of Turkey, including the United States and the European Union. These countries may have data protection laws that differ from those in your jurisdiction.

One transfer is worth naming on its own. If you generate a video, the product images for that video are processed by a model provider operating in China, which is not covered by an adequacy decision. This happens only when you generate a video, and only with the images for that product. If you would rather your images were never processed there, do not use video generation, and contact us if you would like it disabled for your account.

Where personal data is transferred outside of Turkey or the European Economic Area, we rely on appropriate safeguards, including:

Standard Contractual Clauses (SCCs), We execute EU-approved Standard Contractual Clauses with our sub-processors to ensure an adequate level of data protection for international transfers.
Adequacy Decisions, Where available, we rely on adequacy decisions issued by the European Commission or the Turkish Personal Data Protection Authority (KVKK Board).
Additional Safeguards, We implement supplementary technical and organizational measures, including encryption and access controls, to protect data during and after transfer.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Account Data, Retained for the duration of your active account. If you request account deletion, or if your store uninstalls the app, the personal data we hold about you, including your name and email address, is deleted within 30 days. That deletion is not optional and does not depend on you asking for it.
Uploaded Content and Generated Images, Retained while your account is active. If you uninstall the app or stop using it, we do not automatically delete your products, uploads or generated images, so that you can pick up where you left off if you come back. We do not guarantee that we will keep them, and we may remove them at any time without notice or liability. You can ask us to delete them at any point and we will, and you can choose to have them deleted as part of deleting your account.
Your Business Record, The name, website and store address of the business we provided the service to are kept after an uninstall, so a returning merchant can be reconnected to their own work. This identifies a business rather than a person. If you ask us to delete your account, this goes with it.
Usage and Analytics Data, Retained for as long as your account is active, and deleted or anonymized within 30 days of an account deletion request. Google Analytics data about our public website is retained by Google for 14 months.
Operational Cost Records, We keep a record of what each AI generation cost us, which is how our credit pricing is set. On account deletion these are anonymized rather than erased: the link to your brand is removed and only the cost figures remain, so nothing identifying you is kept.
Billing Records, Retained for the period required by applicable tax and commercial law (typically 10 years under Turkish commercial legislation).

8. Your Rights Under CCPA

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) grant you the following rights:

Right to Know, You may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of that information, our business purposes for collecting it, and the categories of third parties with whom we share it.
Right to Delete, You may request that we delete the personal information we have collected from you, subject to certain exceptions permitted by law.
Right to Opt-Out, You may opt out of the "sale" or "sharing" of your personal information. Merkly does not sell personal information. If we engage in activities that constitute "sharing" under the CCPA, we will provide a clear opt-out mechanism.
Right to Non-Discrimination, We will not discriminate against you for exercising any of your CCPA rights. You will not receive different pricing, quality of service, or access as a result of your privacy choices.

To submit a CCPA request, please email privacy@getmerkly.com. We will verify your identity before processing your request and respond within 45 days.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:

Encryption in Transit, All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher. API communications with third-party processors are similarly encrypted.
Encryption at Rest, Uploaded images, generated assets, and database contents are encrypted at rest using AES-256 or equivalent encryption standards provided by our infrastructure providers.
Access Controls, Access to personal data is restricted to authorized personnel on a need-to-know basis. Authentication is enforced for all administrative and API access.
Regular Reviews, We conduct periodic reviews of our security practices, access permissions, and sub-processor compliance to identify and address potential vulnerabilities.

While we strive to protect your personal data, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, but we are committed to promptly notifying affected users and relevant authorities in the event of a data breach, as required by applicable law.

10. Children's Privacy

Merkly is a business-to-business platform designed for use by companies and professionals. Our services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16.

If we become aware that we have inadvertently collected personal data from a child under 16, we will take prompt steps to delete that information. If you believe that a child under 16 has provided us with personal data, please contact us at privacy@getmerkly.com.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. If we make material changes, we will provide at least 30 days' prior notice by email to the address associated with your account and by posting a prominent notice on the Merkly platform.

Your continued use of the platform after the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms. We encourage you to review this page periodically for the latest information on our privacy practices.

12. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, you may contact us through the following channels:

Privacy Inquiries - privacy@getmerkly.com
Data Protection Officer (DPO) - dpo@getmerkly.com
Postal Address, Merkly Yazılım ve Teknoloji Anonim Şirketi, Aydınevler Mah. Sanayi Cad. No:3, Centrum Plaza A Blok Z01, Maltepe, İstanbul, Türkiye

We will acknowledge receipt of your inquiry within 5 business days and aim to provide a substantive response within 30 days.