Privacy Policy

1.Introduction

Sacatelle Holdings LLC ("Sacatelle," "Merch.com," "we," "us," or "our") is committed to safeguarding your privacy. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you visit our websites, sacatelle.com and merch.com, or engage with our products and services. By accessing or using our websites and services, you agree to the terms outlined in this policy.

2.Information We Collect

We collect and process various types of information depending on your interactions with us:

1. Business Information: Includes the name, address, and contact details of your business.
2. Personal Information: Includes your name, email address, phone number (including a number you provide for two-factor authentication), job title, and any other contact details you provide.
3. Account and Security Information: Login credentials (stored in hashed form), sign-in and authentication events, IP address, device and browser information, and the consents, authorizations, and agreements you record in the platform.
4. Order and Recipient Information: Details necessary for processing your orders, such as product selections, billing and shipping addresses, and, for campaign and gift shipments, the name, address, email address, and selections your recipients submit on a landing page.
5. Payment Information: Payment details are processed and securely stored by our third-party payment processor, Stripe. We receive and keep a payment token, the card brand, last four digits, issuing country, and the outcome of each charge, but not the full card or bank account number.
6. Communications: Emails you exchange with us, messages you send to our website chat assistant, support tickets, and recordings, transcripts, and summaries of meetings you attend with our team.
7. Design Content: Logos, brand assets, reference images, files, and design instructions you upload or provide.
8. Website and Marketing Data: Pages visited, referring site, campaign identifiers attached to the link you arrived from (such as a Google or Meta click id), and your interactions with our emails.

3.How We Collect Information

We collect information in the following ways:

1. Directly from You: When you submit inquiries, request quotes, place orders, chat with our website assistant, attend a meeting with us, or otherwise communicate with us via our websites, email, phone, or in person.
2. Automated Technologies: We use cookies, pixels, and similar technologies to operate our websites, keep them secure, measure how they are used, and measure the performance of our advertising. When you arrive from an ad or from a link in one of our emails, we record the campaign identifier carried by that link and, where you are already a known contact, associate the visit with your contact record so that your account representative can serve you. See Section 10 and our Cookie Policy.
3. From Our Customers and Your Integrations: Our customers provide recipient information when they send gifts or campaigns (see Section 12), and integration partners you choose to connect to your account (such as Shopify, Zapier, or a webhook endpoint) send us the data those integrations are designed to exchange.

4.How We Use Your Information

We use the information we collect to:

1. Order Fulfillment: Process, fulfill, and manage your orders efficiently.
2. Customer Support: Respond to your inquiries, provide assistance, and improve your overall experience with our services.
3. Marketing: Send you promotional offers and updates, provided you have opted in to receive such communications.
4. AI-Assisted Features: Provide features that use artificial intelligence, such as our website chat assistant, design generation and visualization, quote assistance, and meeting summaries (see Section 13).
5. Fraud Prevention and Security: Verify addresses, detect and prevent fraud, abuse, and security incidents, and apply risk scoring to orders and submissions before we fulfill them.
6. Advertising Measurement: Measure whether our advertising leads to inquiries and orders, and reach existing customers and contacts with relevant advertising on other platforms.
7. Records of Consent: Record and evidence the consents, authorizations, and agreements you give us, such as autopay authorizations and signed agreements.
8. Business Operations: Manage and enhance our internal processes, websites, and services.
9. Legal Compliance: Fulfill our legal obligations and comply with regulatory requirements.

5.How We Share Your Information

We do not sell your personal information for money and we do not rent it to third parties. The advertising cookies described in Section 10 do share website activity with advertising platforms, which some privacy laws treat as "sharing" for cross-context behavioral advertising; Section 7 explains how to opt out. Beyond that, we share your information only in the following situations:

1. Service Providers: With companies that process information on our behalf and under our instructions, which are contractually obligated to protect it and to use it only for the services they provide to us. Our principal service providers, by category, are: payments and bank connections (Stripe); cloud hosting and infrastructure (Amazon Web Services, Vercel, MongoDB Atlas, Cloudflare); shipping carriers (such as USPS, UPS, FedEx, DHL, Royal Mail, and Australia Post), our warehouse partners and their systems (Extensiv, MintSoft, ShipStation), shipment tracking (17track), and address verification (Smarty); electronic signatures (Firma); accounting (Intuit QuickBooks); email delivery and internal communications (Amazon SES, Google Workspace, Slack); artificial intelligence model providers (OpenAI, Anthropic, Google, xAI); meeting recording and transcription (Recall.ai); and analytics and advertising measurement (Google, Meta, LinkedIn, Vibe). We update this list when our providers change.
2. Integrations You Connect: With third-party services you choose to connect to your account, such as Shopify, Zapier, or a webhook endpoint you configure, which receive the data those integrations are designed to exchange.
3. Our Customers: If you are the recipient of a gift or campaign, with the customer who sent it, as described in Section 12; and if you shop on a Merch Store, with the store's merchant, as described in Section 14.
4. Business Transfers: In connection with a merger, acquisition, financing, or sale of all or part of our business, subject to this policy.
5. Legal Requirements: If required by law or in response to valid legal processes, such as a subpoena, court order, or to protect our legal rights, we may disclose your information.

6.Data Security

We are committed to protecting your personal information through robust security measures, including:

1. Encryption: Sensitive data is encrypted during transmission and while stored.
2. Access Control: Access to personal data is restricted to authorized personnel who need it to perform their job duties.
3. Security Audits: Regular security audits are conducted to identify and mitigate vulnerabilities.

7.Your Rights and Choices

You have the following rights regarding your personal data:

1. Access: Request a copy of the personal data we hold about you.
2. Correction: Request corrections to any inaccurate or incomplete data.
3. Deletion: Request deletion of your personal data, subject to certain exceptions.
4. Opt-Out of Marketing: Opt out of receiving marketing communications at any time using the link in our emails or by contacting us.
5. Opt-Out of Sharing for Advertising: Ask us not to share your website activity with advertising platforms. You can block advertising cookies in your browser as described in our Cookie Policy, or contact us at the address below and we will apply the opt-out to the data we hold. We will not discriminate against you for exercising this right.
6. Data Portability: Request your data in a structured, commonly used, and machine-readable format for transfer to another service provider.

To exercise these rights, please contact us at info@merch.com. We will respond to your request within a reasonable timeframe and in accordance with applicable laws.

8.Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected or as required by law. Once the retention period has expired, we will securely delete or anonymize your data. In general:

1. Account, order, invoice, and payment records are kept for the life of your account and afterwards for as long as tax, accounting, and legal obligations require.
2. Consents, authorizations, and signed agreements are kept as evidence for as long as the related obligation could be disputed.
3. Website visit and campaign attribution data is kept for up to twelve months.
4. Fraud and risk decision logs are kept for up to six months.
5. Chat transcripts, support tickets, and meeting recordings are kept while the related account is active or until you ask us to delete them, whichever is sooner.

When an account or user is closed we deactivate it rather than immediately erase it, so that order, invoice, and audit records stay consistent. You may ask us to delete your personal data at any time; we will do so except where we must keep it for the reasons above, and data in backups is purged in the ordinary course.

9.International Transfers

If you are accessing our services from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States. We take appropriate measures to ensure that your information is handled securely and in accordance with this Privacy Policy.

10.Cookies and Similar Technologies

We use cookies and similar technologies on our websites for essential functions such as security, navigation, and remembering your preferences; for analytics that tell us how our websites are used; and for advertising measurement, which lets advertising platforms such as Google, Meta, LinkedIn, and Vibe confirm that an inquiry or order followed one of our ads and show our advertising to people who have visited our sites. We also store a first-touch attribution cookie that remembers how you first arrived. You can manage your cookie preferences through your browser settings, though this may affect the functionality of our sites. For details, see our Cookie Policy.

11.Browser Extensions

We publish the Merch.com Inbox browser extension for Google Chrome. This section explains what data the extension accesses, how it is used, and how you can stop it.

What the extension accesses.

When you install and use the Merch.com Inbox extension, it accesses the following data:

• Active Gmail thread participants. When the extension is open and you have a Gmail thread in view, the extension reads the names and email addresses displayed in the thread's participant chips. It uses this information to pre-fill the recipient of a merch send. The extension does not read message bodies, attachments, or any other Gmail content.
• Your authentication cookie. The extension reads the authentication cookie (token) set on .merch.com so you do not have to sign in twice. If no cookie is present, the extension asks you to sign in with your existing Merch.com credentials, and stores the resulting authentication token locally in the browser.
• Your active campaign selection. The extension stores your most-recently-used campaign locally in the browser, so it can pre-select it the next time you open the panel.
• Content you insert into Gmail. When you choose to insert an invite link or templated email into an open Gmail compose draft, the extension writes that content into the draft. It does not send the draft on your behalf — you review and send it yourself.

How the data is used.

All recipient data and campaign actions you initiate in the extension are transmitted directly to the Merch.com API and used solely to fulfill the action you requested (creating an invite, generating an invite link, or creating a fulfillment order). No data accessed by the extension is sold, transferred, or used for advertising, third-party analytics, or any purpose unrelated to the service you have signed up for.

Where the data is stored.

• Authentication tokens and the active campaign selection are stored locally in your browser and persist until you sign out or uninstall the extension.
• Recipient data you submit through the extension is stored on Merch.com's servers under the same data-handling and retention practices described elsewhere in this policy.
• The extension does not maintain its own server, database, or analytics pipeline.

Permissions the extension requests.

The extension declares the following Chrome permissions, each used only for the purpose listed: access to mail.google.com pages (to read the participants of your active Gmail thread and, when you ask, insert content into your open compose draft); access to Merch.com pages (to detect your existing sign-in via cookie and send requests to the Merch.com API); cookies (to read the Merch.com authentication cookie so you do not have to sign in twice); storage (to remember your authentication token and active campaign across sessions); side panel and active tab (to display the extension UI alongside whatever page you are on); and clipboard write (to copy an invite link to your clipboard when you ask the extension to do so).

Stopping the extension.

You can stop the extension from accessing any data by closing the extension's side panel (it does not run in the background while closed), signing out from the extension's settings menu (which clears the locally stored authentication token), or removing the extension at chrome://extensions.

Merch.com Workspace Inbox (staff extension).

We also publish the Merch.com Workspace Inbox extension for Google Chrome. It is for our own staff and works only with an active Merch.com staff account. When a staff member opens it alongside a Gmail thread, the extension reads the participants, subject, and message text of the thread displayed on the page in order to identify the customer account and contact the thread belongs to, to save contact details found in an email signature (such as company, job title, phone number, and LinkedIn address) to that contact's record, and to log that an email was sent or received (subject, participants, date, and a link to the thread, never the message body) in the account's activity history. The message text itself is processed in the browser and is not transmitted or stored; only the signature details drawn from it are saved. The extension signs the staff member in with their Google account email through Google sign-in, stores only the resulting Merch.com session token locally, and communicates only with Merch.com servers, Google sign-in, and our asset network. If your correspondence with us is handled by a staff member using this extension, the information logged is the same information we already keep about that correspondence in our customer records.

12.Gift and Campaign Recipients

If you received a gift, invitation, or shipment through a campaign run by one of our customers, that customer decided to send it and either provided your information to us or collected it from you on a landing page we host for them. We process your information on the customer's behalf, as their service provider, to fulfill the shipment, send you delivery notices, and prevent fraud. We do not use recipient information for our own marketing. For questions about why you were included, contact the company that sent the gift. To exercise the rights in Section 7 you may contact either that company or us, and we will act on the customer's instructions or as the law requires.

13.Chat, AI Features, and Meeting Recordings

Website chat. The chat assistant on our websites and in the customer portal is automated and uses artificial intelligence; members of our team can join or take over a conversation. We keep chat transcripts, together with the visitor's approximate location and device information, to answer your request, follow up on it, and improve the assistant.

AI features. Content you submit to an AI-assisted feature, such as chat messages, design instructions, brand assets, and reference images, is sent to the AI model providers listed in Section 5 so that they can generate a response. They act as our service providers and are permitted to process your content only to provide the service to us. We do not use your confidential content to train models that are made available to other customers.

Meeting recordings. Meetings with our team may be recorded and transcribed by a notetaking assistant that joins as a visible participant, and the recording may be summarized using AI. If you do not want a meeting recorded, tell the host at the start and we will not record. Recordings and transcripts are kept as described in Section 8.

14.Shoppers on Merch Stores

Some of our customers run online stores hosted on our platform. When you shop on such a store, the store's merchant is the seller and decides how your information is used, and the store's own privacy policy, linked in its footer, governs. We act as the merchant's service provider: we host the store, process the checkout through Stripe, fulfill and ship the order, and send order notifications. Each store shows a cookie banner that lets you accept or reject analytics and advertising cookies, and we honor Global Privacy Control signals on those stores. We do not use shopper information for our own marketing. Requests about your data on a store should go to the merchant; you may also contact us and we will act on the merchant's instructions or as the law requires.

15.Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. Any changes will be posted on this page, and we will update the "Effective Date" at the top of the policy. We encourage you to review this page periodically to stay informed about how we protect your information.

16.Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact: