Legal
Privacy policy
Last updated: March 25, 2026
1. Who we are
merqori.com is a service of merqori B.V., based in the Netherlands. We are the controller under the General Data Protection Regulation (GDPR) for the personal data we process.
- Legal name: merqori B.V.
- KvK: [KvK: INVULLEN]
- BTW: [BTW: INVULLEN]
- Registered address: [Vestigingsadres: INVULLEN]
Contact: privacy@merqori.com
We have not appointed a mandatory Data Protection Officer (DPO). For privacy questions you can contact: [DPO/Contactpersoon: INVULLEN]
2. What data we process
We process the following categories of personal data:
- Account data: name, business email address, password (encrypted), company name, role
- Financial transaction data: order data, marketplace payouts, commissions, returns and discounts you upload
- Usage data: login history, audit logs of actions in the application
- Technical data: IP address (for security and rate limiting), session token
We process no special categories of personal data (such as health data or citizen service numbers).
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Account management and authentication | Performance of a contract (Art. 6(1)(b)) |
| Providing the analysis service | Performance of a contract (Art. 6(1)(b)) |
| Billing and payment processing (via Stripe) | Performance of a contract (Art. 6(1)(b)) |
| Security and fraud prevention | Legitimate interests (Art. 6(1)(f)) |
| Statutory retention of financial data (7 years) | Legal obligation (Art. 6(1)(c)) |
| Sending transactional emails (password reset, welcome) | Performance of a contract (Art. 6(1)(b)) |
| Product analytics via PostHog (usage statistics to improve the service) | Consent (Art. 6(1)(a)) |
| Error monitoring via Sentry (detecting and resolving technical errors) | Legitimate interests (Art. 6(1)(f)) |
| AI-assisted analysis of uploaded exports via Anthropic | Performance of a contract (Art. 6(1)(b)) |
4. Subprocessors
We use the following subprocessors. We have a data processing agreement with each of them:
| Provider | Purpose | Location |
|---|---|---|
| Neon Inc. | Database hosting (PostgreSQL) | USA (us-east-2, SCCs apply) |
| Vercel Inc. | Application hosting | US (SCCs apply) |
| Stripe Inc. | Payment processing | US (SCCs apply) |
| Resend Inc. | Transactional email | US (SCCs apply) |
| Anthropic PBC | AI-assisted analysis of exports | US (SCCs apply) |
| PostHog Inc. | Product analytics (only with consent) | US (SCCs apply) |
| Functional Software Inc. (Sentry) | Error monitoring | US (SCCs apply) |
Transfers outside the EEA
Part of your data is stored and processed in the United States (our database at Neon in region us-east-2, and the services of Stripe, Resend, Anthropic, PostHog, Sentry and Vercel). For this transfer to a third country we rely on the Standard Contractual Clauses (SCCs) adopted by the European Commission, supplemented with appropriate additional measures. You can request a copy of the safeguards in place via privacy@merqori.com.
5. Retention periods
- Account data: while your account is active, plus 30 days after deletion
- Financial transaction data (orders, settlements, fees): 7 years after processing (statutory retention)
- Audit logs: 2 years
- Password reset tokens: automatically invalidated after use or expiry (1 hour)
- IP addresses (rate limiting): up to 1 hour in memory, not persisted
6. Your rights
Under the GDPR, you have the following rights:
- Right of access (Art. 15): You can request the data we process about you via Settings → Export my data, or via privacy@merqori.com
- Right to rectification (Art. 16): You can change your name and email address in settings
- Right to erasure (Art. 17): You can delete your account and associated data via Settings → Delete account. Financial data subject to statutory retention cannot be deleted early.
- Right to data portability (Art. 20): Download all your data as JSON via Settings → Export my data
- Right to restriction of processing (Art. 18): You can ask us to temporarily restrict the processing of your data, for example while the accuracy of data is being verified
- Right to object (Art. 21): You can object to processing based on legitimate interests
- Right to withdraw consent (Art. 7(3)): Where we process data based on your consent (such as product analytics via PostHog), you can withdraw that consent at any time. This does not affect the lawfulness of processing before withdrawal.
Submit requests via privacy@merqori.com. We respond within 30 days. You also have the right to complain to the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).
7. Security
We take appropriate technical and organizational measures, including:
- Encryption of data in transit (TLS/HTTPS)
- Encryption of sensitive configuration data at rest (AES-256-GCM)
- Passwords stored as bcrypt hashes (unreadable)
- Strict access control per organization (tenant isolation)
- Audit logging of all relevant actions
- Rate limiting on authentication and upload endpoints
8. Cookies
We only use strictly necessary cookies. We do not set analytics or marketing cookies without your consent. See our cookie policy for details.
9. Source of data about third parties
The financial files our customers upload (orders, payouts, returns) may contain personal data of third parties, for example the name or address details of end customers who placed an order. We therefore do not receive this data directly from the data subject, but via our customer.
With regard to this data, merqori acts as a processor on behalf of the customer, who is itself the controller. The customer is responsible for a lawful basis (usually performance of a sales contract or legitimate interest, Art. 6(1)(b) or (f)) and for the duty to inform its end customers. We use this data solely to perform the reconciliation service for the customer.
10. Automated decision-making
We do not take decisions with legal effects or similarly significant effects based solely on automated processing, including profiling (Art. 22 GDPR). The service detects discrepancies as a tool; you make the decisions about them yourself.
11. Changes
We may update this privacy policy periodically. We notify you of material changes by email or an in-app notice. The date at the top indicates when the policy was last updated.