Privacy Policy
MerchantBuilt is a hosted e-commerce platform. Merchants run their online stores on it, and each store is administered by one or more named people ("store administrators") through the MerchantBuilt console. This policy explains what MerchantBuilt collects from store administrators, why, and how it is handled. It is written for the platform's own relationship with the people who administer stores; the shoppers who buy from a merchant's store are covered by that merchant's own privacy policy, not this one.
What we collect from store administrators
- Account details — your name, email address, and the password and two-factor credentials you set for your console sign-in. Passwords are stored only as salted hashes; two-factor secrets are encrypted at rest.
- Contact preferences — an optional mobile phone number, and your per-notification choices for which operational messages reach you by email, by SMS, or through the console.
- Sign-in and security records — the time and network address of sign-ins and failed attempts, the browser used, and the outcome of security checks. These records exist so that you and we can answer "who signed in, from where, and when" when it matters.
- Store configuration — the settings, content, and catalogue you enter to run your store. This is your business data; we process it to operate the store you asked us to host.
Why we collect it
- To provide the service: hosting your store, signing you in, and keeping your account secure.
- To send operational account notifications — scheduled maintenance, security actions required on your account, and service warnings — through the channels you have chosen.
- To keep an accurate record of administrative actions on your account, which protects you as much as it protects us.
Mobile phone numbers and SMS consent
Mobile phone numbers and SMS opt-in consent are used solely to deliver operational account notifications to the store administrator who provided them. They are never shared with, sold to, or rented to third parties or affiliates for marketing or promotional purposes. SMS is off by default for every notification type; you choose, in the console, which types may reach you by text, and you can withdraw that consent at any time by changing the setting or by replying STOP to any message. The full terms of the messaging program are at merchantbuilt.com/sms-terms.
Who we share information with
We share administrator information only with the service providers that carry it on our behalf — the cloud provider that hosts the platform, the email delivery service, and the SMS carrier network — and only to the extent needed to deliver the service or the message you asked for. Those providers may not use it for their own purposes. We do not sell administrator information to anyone, and we disclose it beyond this only when the law requires it or to protect the platform and the people using it.
How long we keep it
Account details and contact preferences are kept for as long as your account exists. Sign-in and security records are kept for the period needed to investigate account security questions and are then removed. Store configuration is kept for as long as the store is hosted. When an account is closed, its details are removed except where a record must be retained for security, legal, or accounting reasons.
Your choices
- You can review and change your contact details and notification preferences in the console at any time.
- You can remove your mobile number from your account, or reply STOP to any text, and SMS notifications will end.
- You can ask us what information we hold about your account, ask us to correct it, or ask us to close the account, using the contact below.
Security
Console access requires a password and, once enrolled, a second factor. Administrative changes to accounts are recorded. Credentials are never written to logs. We do not store payment card details for store administrators.
Contact
Questions about this policy or about your account: support@merchantbuilt.com.
Changes to this policy
If this policy changes, the date at the top of this page changes with it, and material changes are announced to store administrators through the console.