Privacy Notice

1. Scope

This notice describes how MerchantReady ("we", "us") handles personal and business information collected through merchantready.org, the free Stripe readiness scan, the paid Stripe Risk Readiness Report, and related communications. By using the service, you agree to the practices described here.

2. Information we collect

2.1 You provide directly

• Email address (free scan and paid intake)
• Business name, website URL, country, business type, and product description
• Subscription, billing, refund, and shipping arrangements you describe
• Whether you have an existing Stripe account and any prior issues you choose to describe
• Payment status, checkout reference, and customer email for paid reports — processed by Creem or another payment provider shown at checkout, not stored card details
• Free-text fields you fill in (concerns, notes, supplementary context)

2.2 Collected automatically

• Public content of the website URL you submit (HTML, visible text, page metadata)
• IP address (hashed before storage for rate-limiting and abuse prevention)
• User agent string (hashed)
• Approximate geographic region (from IP, for analytics and routing)
• Aggregate, cookie-free analytics via Cloudflare Web Analytics

2.3 What we never collect

• Your Stripe Secret Key, password, or login credentials
• Your Stripe Dashboard data, transaction records, or balances
• Card numbers, CVCs, or card verification data
• Customer payment details from your business
• Government identification documents (in MVP scope)

3. How we use information

• To run the free readiness scan and produce a score
• To produce a draft and final paid readiness report for you
• To send you the report by email and respond to your questions
• To send a 30-day follow-up offering a fresh free scan (you can opt out at any time)
• To improve our scoring rules, prompts, and templates
• To prevent abuse (rate limiting), debug errors, and meet legal obligations

We do not sell personal information. We do not use your data to train third-party AI models.

4. Third-party processors

We rely on the following sub-processors to operate the service. Each receives only the data needed for their function.

• Cloudflare — DNS, CDN, Workers runtime, D1 database, R2 object storage, Browser Rendering, Web Analytics, and email sending infrastructure
• Creem — Checkout, payment processing, refund and chargeback handling for paid reports; we receive payment status and order references, not card numbers or CVC
• OpenAI-compatible API providers — AI draft generation and automated compliance review, using only the submitted public website context and intake data needed for the report

5. Cookies and tracking

MerchantReady does not set cookies for tracking, advertising, or analytics. Our primary analytics provider is Cloudflare Web Analytics, which is cookie-free and aggregates traffic at the network layer.

Functional cookies may be set for admin authentication on /admin/* paths. These are essential for the admin experience and are not used by public visitors.

6. Retention

• Free scan leads: 365 days from creation, then deleted unless converted to a paid report
• Paid audit requests and reports: 24 months from delivery, then archived; archived records anonymized after 36 months
• Email logs: 24 months (with recipient hashed after 6 months for compliance audits)
• Crawled website snapshots: deleted from active storage 90 days after report delivery

7. Your rights

Depending on where you live, you may have rights to access, correct, export, or delete personal information we hold about you. To exercise these rights, contact support@merchantready.org from the email associated with your account. We respond within 30 days.

You may opt out of follow-up emails at any time using the unsubscribe link in the email footer.

8. International transfers

Our infrastructure spans multiple regions. Data may be processed in the United States, the European Union, Singapore, and other jurisdictions where our sub-processors operate. Where required, we rely on Standard Contractual Clauses or other lawful transfer mechanisms.

9. Security

Production secrets are stored in encrypted secret managers and never committed to source control. Database access is restricted to server-side routes; client code does not hold database credentials. Customer report access is gated by an unpredictable token and HMAC signature with a configurable expiry.

No security model is perfect. If you discover a vulnerability, email security@merchantready.org and we will respond promptly.

10. Children

MerchantReady is a B2B service for online merchants. We do not knowingly collect information from anyone under 16.

11. Changes

We will post the effective date at the top of this notice when it changes. Material changes will be summarized in our footer or by email to paid customers.

12. Contact

Questions or requests: support@merchantready.org.