Privacy Policy

This policy covers the MerchPPC Chrome extension and the merchppc.com website. It is written to be read, and the shortest true summary is this: your Merch and Amazon Ads data is read into a database inside your own browser, stays there, and is never stored on our servers. This website holds your account, your installations, your plan, and the operational records needed to run the service — and the table below is the whole of it, not a summary. The one thing that does pass through our servers is what you ask a connected assistant to read: it goes through our relay in transit, is not stored here, and is delivered to the assistant you connected (section 5).

1 · Who operates this site

MerchPPC.com is operated by Marco Aurélio Fernandes de Sousa, Unipessoal Limitada, Caminho das Passadinhas, 9, São Vicente, Portugal (tax number PT515039217), trading as MerchPPC, which is the controller of the personal data described here. Privacy requests go to privacy@merchppc.com and legal notices to legal@merchppc.com. This policy covers the website: accounts, beta access, extension installations, entitlements, billing, assistant integrations, support correspondence, and service operations. It also explains what the MerchPPC Chrome extension does not send here.

2 · What the extension processes, and where it stays

The extension reads your Merch and Amazon Ads data through the Amazon session already signed in to your browser, and writes it into a database on your own machine. It never asks for your Amazon password.

Your listings, designs, sales, royalties, campaigns, ad groups, targets, search terms and report rows are not uploaded. There is no copy of them on this website and no row anywhere for a product, a sale, a campaign or an amount of money. Neither are your Amazon cookies or credentials. What that buys and costs you is a page of its own.

If you choose a display currency in the extension's settings, it asks this site for the European Central Bank's daily reference rates. That request carries no account, no token and none of your figures; the conversion is done in your browser.

3 · What merchppc.com stores

Using the dashboards needs a free MerchPPC account, linked once after the first sync. An account exists for the things that involve our servers, and this is all of it — grouped by why it exists. Where a record is removed on a schedule, the schedule is stated; where it is not, it says so rather than implying one.

What	Why	How long
Your account Email address, role, timestamps	To sign you in and to attach everything else to somebody	While the account exists
Sign-in links and codes The address the link was sent to, and a hash of the code — never the code itself	Passwordless sign-in; there is no password to store	A code stops working after 15 minutes. A session token stops working after 60 days without a visit; each visit after the first week replaces it. The record of the request is kept. No fixed schedule
Linked installations An identifier the extension mints itself, a label you choose, the browser name and extension version, link state, whether it is primary, whether it may accept assistant calls, two token hashes, and five timestamps. Also one short line saying what that computer can read designs with: whether reading is switched on, whether the word reader is ready, and whether Chrome's built-in AI is ready, downloadable, unavailable or too slow there. It is sent each time the browser connects and says nothing about any design	To know which browsers are yours, to route an assistant to one, and to show you what is linked. The design-reading line is only ever counted, to decide which readers are worth building	Until you revoke the installation or delete the account
Lookout slots For each Lookout you switch on, an opaque identifier the extension made and the marketplaces it watches. No name, condition, finding or amount	So the free plan's cap on Lookouts watching each marketplace can be counted	Until you switch the Lookout off or delete it, or delete the account
Merch account pin A one-way hash of your Amazon Merch on Demand account id — never the id itself — with the identifier of the browser that reported it and two timestamps	To keep one Merch account to one email, so one seller cannot hold two accounts. It is compared for equality and never displayed or listed	Until you delete the account, which releases it
Plan and capabilities Which capabilities are granted, where the grant came from, and its dates	To decide what the extension may do	While the account exists
Billing Processor customer and subscription identifiers, product, interval, plan price, currency, the discount code a subscription is on, the amount, tax and date of its last payment, status and entitlement dates	To grant or remove paid access, and for accounting	As long as tax and accounting obligations require. Raw webhook payloads are erased after 30 days
Trial offer The two discount codes issued to your account with its trial, one per plan, when they were issued, and whether each was used, expired or withdrawn	To apply the offer when you subscribe, and to answer questions about it	While the account exists. A code that was never used is deleted at Creem when it expires; one that was used stays part of Creem's own billing record, as payments do
Assistant integrations Your consent per provider, OAuth client and scope metadata, the selected installation, quota counters, and per-call metadata: tool name, outcome, duration, byte counts, correlation identifier	To honour your consent, enforce quotas, and diagnose failures	Per-call metadata after 90 days
Security events Sign-in attempts and revocations, the request id, and a one-way hash of the address the attempt came from	To detect and investigate unauthorised access	365 days
Where a signup came from Campaign tag, medium, source, content and term from the link you arrived on; the referring site's hostname; the path you landed on; and when	To know which channels bring people who stay	While the account exists. No fixed schedule
Which places accounts come from A country or a continent, and a number. Nothing else	To know where the product is being used, and where it is not	Indefinitely — it is a counter, about 195 rows at most, and no row points at anybody
Messages you send us Your name, email, topic and message, plus whether delivery succeeded and whether it has been answered	To answer you — and so a mail outage cannot lose your message, it is written down before delivery is attempted	Until answered and no longer needed. No fixed schedule
Administrator actions What was done, to which record, the outcome, and a whitelisted summary of the change	So that an operator changing your entitlements or access leaves a trace, including when the action was refused	Kept. No fixed schedule
Server errors The exception type, where it came from, how many times, its message truncated to 2,000 characters, and up to eight lines of the code path that failed, with the values passed to each function removed. Also a small context: the request's id, its method and the controller or screen that handled it (never the address it asked for), or for a background job its worker, id and attempt. Each time it happens, the moment and that same context are kept, at most 50 a fault per hour	So that a fault is noticed rather than going to a log nobody reads	The error until resolved and cleared. Each occurrence 30 days, then deleted
Rate-limit counters A one-way hash of the address, email or account a request came from, and a count	So that one source cannot exhaust sign-in, the API or the assistant relay for everybody else	Deleted when the window closes — minutes to a day
Email preferences Which kinds of email you agreed to, and where that agreement came from	So that consent is a record rather than a memory	While the account exists
Beta invitations That an invitation was issued to you, by which operator, and a hash of its token	So an invitation can be accepted once and traced afterwards	While the account exists
Feedback you send us Your own words — a summary, the detail you wrote, and which screen it came from	So a report about a wrong number can be answered	Kept. No fixed schedule
Bug reports from the extension Your own words, plus what the extension can say about itself: its version and build, your operating system as one word, your Chrome version, which screen you were on, whether your browser is connected, whether its sync is current, and any error it recorded. Never a product, a sale, a campaign or an amount of money. If you are not signed in you can add an email address so we can reply	So something broken can be found and fixed	180 days, then your words are deleted and the record kept
Files you attach to a bug report Screenshots or logs you choose and attach yourself. Nothing is ever captured from your screen — the extension cannot take a screenshot and asks for no permission that would let it	So a problem you can see can be seen by us	30 days after the report is answered or closed, 180 days at the outside
Roadmap requests you post The title and description you wrote, which part of the product it concerns, and when. Other members read it without your name or email	So members can see what is being asked for, and say which of it they want	While the account exists. If other members voted on it or commented on it, or the team took it up, it stays after you erase the account, with nothing linking it to you
Your roadmap votes and comments Which requests you voted for, how important you said each is to you, the plan you were on when you voted, and the comments you write. Other members read a comment under a label that is different on every request, never your name. Only we see the plan	So a request's conversation can be followed, and so we can count how many members — and how many paying ones — want something	While the account exists
Billing reconciliation A nightly check that the plan on your account matches the processor's, and what it found	So a subscription that stopped paying, or one that paid and was not credited, is noticed rather than discovered by you	Kept. No fixed schedule
Operational switches That an operator paused part of the service, which one, and the reason they gave	Because the reason is shown to you when something is switched off, and it should be attributable	Kept. No fixed schedule

Why we may process it. Where the GDPR applies, the legal basis is contract for your account, sign-in, linked installations, plan and capabilities, billing and assistant integrations — they are what you ask us for when you use the service. It is legitimate interests for security events, rate-limit counters, server errors, administrator actions, billing reconciliation, operational switches and the two records of where sign-ups come from — our interest in keeping the service secure, working and understood, and in preventing abuse. It is consent for anything you opt into: your email preferences, and the messages, feedback, bug reports and files you choose to send us, and the requests, votes and comments you put on the roadmap.

4 · Three things worth saying plainly

An error message can contain a value. Server errors are grouped by a hash of the fault's type and origin, never of its text — but the message itself is stored so it can be read, and an exception message sometimes carries an interpolated value such as a record identifier. It is truncated at 2,000 characters. What a crashed process was holding, its last message, the values a function was called with, and the address, query or body of a request are cut before anything is written. This is the one place where something unpredictable can end up in a record, and saying otherwise would be more comfortable than true.

An administrator's audit trail deliberately drops things. The summary of a change is built from a whitelist, and any field whose name contains amazon, token, secret or password is discarded before the record is written.

Your address is looked at once and never written down. The first time an account signs in, the request's headers are read to work out a country — or, where nothing in front of this site can tell us one, the continent of the datacentre that answered. That place is added to a counter. The address itself is not stored, not raw and not hashed, and the counter has no column that could point back at you: it holds a place and a number, so nobody with the database can tell which account is the one in Portugal.

Reading this site quietly gives you nothing to carry. A visitor who arrives with no campaign tag and no external referrer is given no session and no cookie at all. A session is created only when there is something to remember — arriving on a tagged link, or signing in. The exceptions are the advertising tags of Meta, Google and Reddit, described in section 7: where they are allowed to run, they set cookies of their own. Google Analytics, also described in section 7, sets cookies of its own where it is allowed to run.

An affiliate link is remembered for 180 days. Arriving through a partner's link carries an opaque token from Creem, our payment provider, that identifies the click and not you. It is kept in a cookie of its own, _merch_ppc_ref, never in our database or on your account, and added to the checkout address if you subscribe from that browser, so Creem can credit the partner. It lasts 180 days, as Creem's own does, and signing out does not remove it; a later partner link replaces it, and clearing this site's cookies forgets it.

5 · The assistant relay

Connecting Claude (Anthropic) or ChatGPT (OpenAI) requires your own account with that provider, and they process your conversation under their own terms. MerchPPC passes the result of one specific tool request between your assistant and your own extension. It does not give either provider access to your computer, your browser, your Amazon cookies or your credentials.

What a tool returns is passed to your assistant. The result of a tool call — figures, product names, search terms — is delivered to the assistant you connected, Anthropic's Claude or OpenAI's ChatGPT, as part of your conversation, and that provider handles it under its own terms. MerchPPC relays it in transit and does not store it.

Each assistant is a separate grant — consenting to one never grants the other — revocable at Account → Assistants, and rate-limited to 30 calls a minute and 300 a day, shared across assistants.

Relayed payloads are never stored here — not the prompt, not the tool arguments, not the result, not the Amazon data that answered it. Only the metadata in the table above is kept.

If you separately authorise proposals, a tool may ask your extension to write an advertising change into the Publish queue inside your own browser. That row is stored by your extension, not by us, and it reaches Amazon only after you approve it.

If you authorise the batch permission, a tool may ask your extension for a small preview of a design you have not published yet — a few hundred pixels, never the print file — with a few colour measurements taken from it. For an assistant that cannot receive pictures from an app, ChatGPT among them, the same design also goes as a smaller picture, at most 256 pixels, written out as text for it to decode and look at. If you also switch on reading on this computer in the batch panel, your extension reads each of those designs in your own browser, with a small text reader downloaded once from merchppc.com and, where you agree to it, the AI model built into Chrome; no picture is sent anywhere to be read. A tool may then receive a short text description of each design: the words printed on it and a sentence about what it shows. These pass through the relay like any other result and are not stored here, and your extension's privacy mode withholds all of them.

6 · Email

Signing in is transactional and does not opt you into anything. Product updates and marketing are a separate preference you can change without losing access to your account. Sign-in emails contain a private link and may contain a six-digit code — do not forward either.

7 · Cookies

The site uses cookies for authentication, security and CSRF protection, and for the attribution cases described above. The affiliate cookie, _merch_ppc_ref, is set only when you arrive through a partner's link and lasts 180 days. The sign-in cookie lasts 60 days from your last visit, so closing the browser does not sign you out; "Sign out" or "Sign out everywhere" on the account page does. Some interface preferences are kept in your browser's local storage. None of it is used to build a profile or sold to anybody.

One advertising pixel: Meta's. We use the Meta Pixel to measure whether our ads on Facebook and Instagram bring people to this site and become customers. It runs on this website's public pages and on two pages of your account, the overview and Billing. It sends Meta these events and nothing more: that a public page was viewed; that an account was created; and, once each, that the account linked its first browser, started its free trial, or made its first payment for Pro — the last with the plan's price and currency. With each, your browser sends what any request to Meta carries — the page address, your IP address, your browser's details and Meta's own cookies (_fbp, and _fbc when you arrive from one of our ads). We send no e-mail address, no name and no account identifier, and nothing about your Merch listings, sales or campaigns. The other tags are described below, Google Analytics among them; there is no tag manager.

Google's advertising tag. We use Google's tag to measure whether our Google ads bring people to this site and become customers, and to show our ads again to people who have visited it. It runs on this website's public pages and on two pages of your account, the overview and Billing. It sends Google these events and nothing more: that a public page was viewed; that an account was created; and, once each, that the account linked its first browser or made its first payment for Pro — the last with the plan's price and currency. With each, your browser sends what any request to Google carries — the page address, your IP address, your browser's details and Google's own advertising cookies (such as _gcl_au, and _gcl_aw when you arrive from one of our ads). We send no e-mail address, no name and no account identifier, enhanced conversions are off, and nothing about your Merch listings, sales or campaigns goes with it. The same tag also carries Google Analytics, described next.

Google Analytics. We use Google Analytics to count how people find and use this website: which public pages are read, where visitors arrive from, and how many go on to create an account. It runs on this website's public pages and on two pages of your account, the overview and Billing, where it sends no page view. It sends Google these events and nothing more: that a public page was viewed; that an account was created; and, once each, that the account linked its first browser or made its first payment for Pro — the last with the plan's price and currency. With each, your browser sends what any request to Google carries — the page address, your IP address, your browser's details and Analytics' own cookies (_ga and _ga_*). We send no e-mail address, no name and no account identifier, Google signals are off, and nothing about your Merch listings, sales or campaigns goes with it. Google keeps these events for no longer than 14 months.

Reddit's advertising pixel. We use the Reddit Pixel to measure whether our ads on Reddit bring people to this site and become customers, and to show our ads again to people who have visited it. It runs on this website's public pages and on two pages of your account, the overview and Billing. It sends Reddit these events and nothing more: that a public page was visited; that an account was created; and, once each, that the account linked its first browser or made its first payment for Pro — the last with the plan's price and currency. With each, your browser sends what any request to Reddit carries — the page address, your IP address, your browser's details and Reddit's own advertising cookies (such as _rdt_uuid). We send no e-mail address, no name and no account identifier, advanced matching is off, and nothing about your Merch listings, sales or campaigns goes with it.

Where the law asks for your consent first, they wait for it. If your device's time zone places you in the European Economic Area, the United Kingdom or Switzerland, or we cannot tell where it places you, none of these tags loads until you press "Accept" on the banner, which covers every tag named above, and "No thanks" keeps them all off. Elsewhere they load unless you have declined them, and a browser that sends the Global Privacy Control signal is treated as having declined. Your choice is kept for six months in a cookie of ours, mppc_ads, and "Cookie settings" at the foot of every public page lets you change it at any time; declining stops the tags from the next page on. A short-lived cookie, mppc_reg, holds the sign-up event for one day until the next page can send it, and is removed once sent or declined. Another, mppc_px, lists which of those once-only events this browser has already sent, so that reloading a page does not send them again.

The extension never loads them. These tags are part of this website only. Nothing in the MerchPPC extension loads them, talks to Meta, Google or Reddit for them, or reads anything from the database in your browser for them.

Four service providers process personal data on our behalf. Fly.io hosts the website and its database, both in Fly.io's iad region, in the United States. Postmark sends transactional email, such as sign-in links. Cloudflare runs Turnstile on the contact form, a check that the message is sent by a person; it sees your IP address and browser, not what you write. Google Ireland Limited runs Google Analytics where it is allowed to run (section 7), and receives the events listed there. Where any of them processes personal data outside the European Economic Area, it does so under its data-processing terms. Nothing is charged unless you subscribe, and until then no payment details are collected. For a subscription, payments are handled by Creem, our merchant of record: it runs the checkout, holds the card details, and issues invoices and receipts as the seller of record, under its own privacy notice — MerchPPC never sees a full card number. Its payment notifications to us carry the buyer's name, country and e-mail address along with the subscription's state; we keep the subscription state as the billing record described above, and the notifications themselves for 30 days.

Where the advertising pixel is allowed to run (section 7), your browser sends the events listed there to Meta Platforms Ireland Ltd., which processes them under its own privacy policy and its business terms, as a joint controller with us for that collection.

Where Google's advertising tag is allowed to run (section 7), your browser sends the events listed there to Google Ireland Limited, which processes them under its own privacy policy and the Google Ads terms.

Where Reddit's advertising pixel is allowed to run (section 7), your browser sends the events listed there to Reddit, Inc., which processes them under its own privacy policy and its advertising terms.

Links to Amazon lead to a service with its own policies. We do not control how that platform processes what you do there. And we would disclose account records if the law genuinely required it.

9 · What we do not do

We do not sell your data. We do not use it to make automated decisions about you. We do not ask for your Amazon password anywhere on this website. And we cannot look at your sales, royalties or campaigns — not as a policy but as a fact of where they are stored. The one exception is what you ask a connected assistant to read: that passes through our relay in transit, is not stored here, and is delivered to the assistant you connected (section 5).

10 · Deleting things

You can ask for a copy of what is connected to your account, correction of anything inaccurate, or deletion. Depending on where you live you may also have rights to restrict, port, or object to processing. Requests go to privacy@merchppc.com.

You can also complain to a data-protection supervisory authority: in Portugal, the Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt), or the authority in the country where you live.

Some records may survive a deletion request where they are needed for security, dispute handling, tax, accounting or legal reasons — billing records are the usual case.

The database in your browser is yours to delete without asking. Uninstall the extension, or clear its storage, and it is gone. Nothing of it exists anywhere else; a re-install syncs it again from Amazon.

What deletion actually does, exactly. Asking us to erase your account starts a seven-day countdown, and nothing is destroyed until it runs out. It can be cancelled at any point before then, and cancelling leaves nothing behind. When it runs, every record that is attached to your account is deleted — the account itself, your installations, your plan and grants, your assistant grants and their call history, your security events, your email preferences, your beta invitation, your feedback, your bug reports, your roadmap votes and comments, and the roadmap requests nobody else has taken up.

Some things do not go, and it is fairer to name them than to let you assume otherwise. Every one of them is here because it is not attached to your account in the first place, or because removing it would destroy a record about somebody else.

The record of what an operator did keeps its rows and loses its link to you: a log saying somebody erased an account, which vanishes when they erase the account, is not a record of anything.
The count of accounts per country stays as it is, because it holds only a place and a number — there is no row in it that is yours, which is the same property that stops anybody here working out which account is the one in Portugal.
A message you sent us through the old contact form is not attached to an account and is not removed by deleting one. It carries the name, address and text you typed. Ask and it goes.
The record that a sign-in code was requested for an address outlives the account, because it is keyed by the address rather than by the account — the same reason it works before an account exists. It holds the address and a hash, not a working code.
A roadmap request other members voted on or commented on, or that the team took up, stays, with your account taken off it, because deleting it would delete every vote and comment they put on it. What stays is the title and description you wrote, which other members were already reading without your name; your own votes and comments are deleted. The title of a request that was merged into another stays in that one's history.

The first two cannot be used to identify you. The last three can — the roadmap request only if you wrote something in it that does — which is why they are named rather than counted, and why the address given above reaches somebody who can remove them by hand.

11 · Security

HTTPS in production, secure session cookies, access controls, CSRF protection, hashed sign-in codes and hashed installation tokens. No internet service can promise absolute security, and this one does not.

12 · Children

MerchPPC is for adults running or learning about Amazon Merch on Demand and Amazon Ads. It is not directed to children.

13 · Amazon

MerchPPC is not affiliated with, endorsed by, or connected to Amazon. "Amazon", "Merch on Demand" and related marks belong to Amazon.com, Inc. The extension acts as your browser, under your session, at your direction — it reads the same pages and reports your session could already open, at a rate-limited pace with backoff.

We never ask for your Amazon password. The extension has no way to accept one and nowhere to put it. If anything ever asks you for it, it is not us.

14 · Changes to this policy

Signed-in users are told before a change takes effect, and the date at the top of this page is when it last changed. Where a change affects what is collected or who processes it, this page is updated before the change takes effect.

15 · Reaching us

Questions about privacy go to privacy@merchppc.com. Anything else, including billing, goes to support@merchppc.com. We answer within 2 business days.