This policy explains what information we collect when you use MerchantPick, why we collect it, who we share it with, and the choices and rights you have. If you have questions or want to exercise a privacy right, use the contact form and mention "privacy" in your message.
Who we are
MerchantPick operates this independent directory of Shopify apps. For any privacy question or request, contact us through the contact page; we handle requests relating to your personal data through that channel.
Information we collect
Browsing data: when you visit the site we process basic technical data such as your IP address, browser and device type, referring page and the pages you view. This keeps the site running, secure and lets us understand which content is useful.
Analytics and session activity: with your consent, we collect product-analytics events (pages viewed, clicks) and session recordings that replay how pages were used. Text you type into forms is masked in recordings and is not captured.
Messages you send: if you use the contact form, we store the name, email and message you provide so we can respond. These messages are stored on our own systems and are not emailed onward.
Merchant accounts: if you claim an app listing or buy a paid promotion, we process the account and order data needed to verify ownership, deliver the promotion and take payment.
We do not require an account to browse, and we do not knowingly collect information from children.
Analytics and session recording
We use two analytics tools, and both run only after you accept the "analytics" category in the cookie banner: Google Analytics 4 (provided by Google) for aggregate traffic measurement, and PostHog, a product-analytics tool we host ourselves at posthog.voidsecurity.com, which also records anonymised session replays. Nothing is captured before you consent, and you can decline with "Essential only".
Session recordings capture on-screen interactions (mouse movement, clicks, scrolling and page content) to help us find usability problems. Form inputs are masked. We do not use these tools to build advertising profiles and we do not sell personal data.
Cookies and consent
We set strictly necessary cookies to run the site, and analytics cookies only after you consent. You control this through the cookie banner and your browser. See the Cookies policy for the specific cookies and categories.
Third parties we rely on
Google (Google Analytics 4) — aggregate analytics; may process data outside the EEA under appropriate safeguards.
Cloudflare — content delivery and security in front of the site.
PostHog — product analytics and session replay, hosted on our own infrastructure.
A payment processor — used only for merchants who purchase paid promotions.
Legal basis and retention
We rely on your consent for analytics and session recording, and on our legitimate interest (or, for merchant orders, performance of a contract) for security, running the service and responding to messages. You can withdraw consent at any time.
We keep personal data only as long as needed for the purpose it was collected: analytics data for the retention period configured in each tool, contact messages until your request is resolved and for a reasonable period afterwards, and merchant order records for as long as required for accounting and legal obligations.
Your rights
Depending on where you live, you may have the right to access, correct, delete or export the information we hold about you, to object to or restrict certain processing, and to withdraw consent. To make a request, use the contact form and mention "privacy". You also have the right to complain to your local data protection authority.
International transfers
Some providers, such as Google, may process data on servers outside your country, including outside the European Economic Area. Where that happens, transfers are made under appropriate legal safeguards.
Changes to this policy
We may update this policy as our practices or the law change. Material changes will be reflected on this page with an updated revision date.