Privacy & Cookies

What we collect

• Account details you provide: email, display name, and (optionally) a contact email, location, avatar, and tax details for your statements.
• Marketplace activity: your listings, offers, orders, order chat messages, reviews, and bookmarks.
• Sign-in & security: your password (stored only as a secure hash), any linked Google sign-in, registered passkeys, and your active sessions (with the browser/device they were opened on).
• Payments are handled by Stripe. We never see or store your full card or bank details.

Cookies

We use two cookies, both strictly necessary: a session cookie to keep you signed in, and a theme cookie that remembers whether you chose light or dark. The theme cookie stores nothing but that one word, and is set on our domain so your choice also applies on our documentation site. There are no advertising or third-party tracking cookies. Because both are essential to provide the service you asked for, they don’t require a consent banner. If we ever add optional cookies, we’ll ask first and update this page.

We measure traffic with Umami, which is cookieless: it counts page views, referrers and rough location by country, and does not set a cookie, build a profile, or follow you across other sites. It honours your browser’s Do Not Track setting. We exclude search terms from what’s recorded, so what you type into browse stays with us.

How we use & share it

We use your data to run the marketplace: your account, escrow and orders, order chat, notifications, and keeping the platform safe from fraud and abuse.

We do not sell or share your personal data for advertising. We rely on a few service providers who process data only on our instructions to make the product work:

• Stripe - payments, seller payouts, and identity/bank verification.
• SendGrid - transactional email (verification, security notices, order updates).
• Object storage - hosting the images you upload.
• A geocoding service - turning a place you search into a location on your listings.
• Umami - cookieless traffic measurement (page views and referrers, no profiles).

Your rights & choices

• Download your data - export a copy of your MerkatoHQ data from Settings → Account.
• Delete your account - permanently erase your account and personal data from Settings → Account. Completed orders and the reviews you exchanged are kept for the people you traded with, but no longer identify you.
• Notification preferences - choose what appears in your notification bell, and opt out of product news, in Settings → Notifications. Email about your money, your account and your security is always sent.
• Security - manage passkeys, linked accounts, and active sessions in Settings → Security.

We keep records of completed transactions and reviews for as long as needed to support the people you traded with and to meet legal and financial obligations; erased accounts are anonymized rather than removed from those records.

Photos attached to an order. Delivery-proof photos and images sent in order messages are kept for 180 days after that order finishes, even if you delete your account before then. They are the evidence the person you traded with would need to defend themselves if a dispute or payment chargeback is raised, and deleting them at one party’s request would remove the other party’s ability to do so. They are deleted automatically once the period ends, and are never kept while a dispute on the order is still open. Your profile photo and the photos on your listings are not covered by this and are deleted with your account.

Account statements you have generated. We keep a record of the figures on each statement PDF you download, so that anyone you hand one to can check it came from us. Erasing your account deletes those records too - which means a statement you gave an accountant will no longer verify.

Contact

Questions about your privacy, or want to exercise a right you can’t complete in-app? Email us at support@merkatohq.com.