Skip to content

Last Updated: April 16, 2026

Privacy Policy

Introduction

MerchYak is a service operated by RHR Wave, LLC, a Washington limited liability company ("MerchYak," "we," "our," or "us"). We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered product content management service.

By using MerchYak, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our service.

Information We Collect

Account Information

When you sign up via OAuth (Google), we collect:

  • Email address
  • Display name
  • Profile image URL
  • OAuth provider identifiers

Product Content

To provide our content generation service, we collect:

  • Product Images: Images you upload for analysis and content generation
  • Questionnaire Responses: Product details you provide (dimensions, materials, features, target audience, etc.)
  • Generation Preferences: Your selected tone, length, and format settings

AI-Generated Content

We store the content our AI generates for you, including:

  • Product descriptions
  • Product titles
  • Search tags and keywords
  • FAQ content
  • Social media posts
  • Image alt text

Usage Data

We automatically collect certain information when you use our service:

  • Session information and login activity
  • Feature usage patterns
  • Error logs and performance data
  • Browser type and device information

Email Communications

In addition to the email address collected through your OAuth login, we may collect email addresses through:

  • Newsletter signup forms on our website
  • Waitlist registrations
  • Other opt-in forms

These email addresses are collected with your explicit consent and are used for the purposes described at the time of collection.

How We Use Your Information

We use the information we collect to:

  • Provide Our Service: Generate AI-powered product content based on your images and inputs
  • Authenticate Users: Verify your identity and manage your account
  • Display Content: Show your projects, generated content, and history within the application
  • Improve Service Quality: Analyze anonymized usage patterns to enhance our service and user experience. We do not use your content to train or fine-tune AI models. Your data is only sent to third-party AI providers for the purpose of generating your requested content.
  • Communicate: Send service-related notifications and respond to your inquiries
  • Marketing Communications: Send promotional content, product updates, newsletters, and other marketing materials to users who have opted in. You can unsubscribe from marketing emails at any time using the unsubscribe link in each email or through your account settings.
  • Content Safety and Policy Compliance: We analyze uploaded images using AI and scan user-provided text using automated filters to detect content that may violate our Terms of Service. This processing is necessary to maintain a safe platform and is performed as part of our legitimate interest in preventing misuse of our Service. For more details, see "Content Moderation Data" below.
  • Ensure Security: Detect and prevent fraud, abuse, and security issues

Data Retention

We retain your data according to the following policies:

Image Storage

Original product images you upload are stored on our cloud infrastructure for a limited period:

  • Active accounts: Original images are retained for up to 180 days after upload. After this period, original images are replaced with placeholder images. The AI-generated content derived from your images (alt text, detected features) is retained for as long as your account or project remains active.
  • After project deletion: Original images and associated data are permanently deleted within 90 days.
  • After account deletion: All images, projects, and associated data are permanently deleted within 90 days.

You may delete images manually at any time through the application.

Account Data

Your account information is retained until you request account deletion. Upon deletion, your personal data will be removed within 30 days, except where we are required by law to retain certain records.

Generated Content

AI-generated content is retained until you delete the associated project or your account. You may delete individual projects at any time.

Usage Logs

Anonymous usage analytics may be retained indefinitely to improve our service. Identifiable session logs are retained for up to 12 months.

DMCA and Legal Correspondence

Correspondence related to copyright takedown notices (DMCA) and counter-notices, including the personal information contained therein, may be retained for as long as necessary to comply with legal obligations, resolve disputes, and enforce our policies. This retention may extend beyond account deletion where required by law.

Email and Marketing Data

If you subscribe to our newsletter or join a waitlist without creating an account, your email address is retained until you unsubscribe. For registered users, marketing preferences are retained as part of your account data and deleted when your account is deleted.

Content Moderation Data

When our automated content moderation systems flag user content, we collect and store the following data in a moderation audit log:

  • User identifier — which account triggered the flag
  • Project identifier — which project the flagged content belongs to (if applicable)
  • Flagged terms or content category — the specific terms or image assessment reason that triggered the flag
  • Input field — which field was flagged (e.g., project name, image, questionnaire answer)
  • Action taken — whether the flag was overridden by the user or remained in place
  • Timestamp — when the flag event occurred

This data is collected to:

  • Maintain platform safety and prevent misuse
  • Improve our content filters and reduce false positives
  • Comply with potential legal obligations related to content moderation

Content moderation audit logs are retained for as long as your account is active, plus up to 12 months after account deletion to comply with potential legal obligations. This data is not shared with third parties except where required by law.

Third-Party Services

We use the following third-party services to operate MerchYak. Each has their own privacy policy governing data handling:

Authentication

Cloud Storage

  • Cloudflare R2: Used for secure storage of uploaded product images in Cloudflare's Western North America (WNAM) region. Images are encrypted in transit and at rest. See our data retention section for details on how long images are stored. See Cloudflare Privacy Policy

AI Content Generation

  • Third-party AI providers: Used for AI-powered content generation and image analysis. Your product images, questionnaire responses, and product information are processed by these services to generate content. We select providers that meet our standards for data security and privacy. Provider-specific privacy policies govern their handling of data processed through their services.

Payment Processing

  • Stripe: Will be used for payment processing. Payment card data is handled directly by Stripe and never stored on our servers. See Stripe Privacy Policy

Your Rights (GDPR - EU Users)

If you are located in the European Economic Area (EEA), you have certain data protection rights under the General Data Protection Regulation (GDPR).

Legal Basis for Processing

We process your personal data based on:

  • Consent: You have given consent for processing your data for specific purposes
  • Contract Performance: Processing is necessary to provide the service you requested
  • Legitimate Interests: Processing is necessary for our legitimate business interests, such as improving our service and preventing fraud, including content moderation and platform safety

Your GDPR Rights

Under GDPR, you have the right to:

  • Access: Request a copy of your personal data
  • Rectification: Request correction of inaccurate personal data
  • Erasure: Request deletion of your personal data ("right to be forgotten")
  • Data Portability: Receive your data in a structured, machine-readable format
  • Restriction: Request restriction of processing in certain circumstances
  • Objection: Object to processing based on legitimate interests
  • Withdraw Consent: Withdraw consent at any time where processing is based on consent

Exercising Your Rights

To exercise any of these rights, you may:

  • Use the data export and account deletion features in your Account Settings
  • Contact us at support@merchyak.com

We will respond to your request within 30 days.

Data Controller

MerchYak is the data controller responsible for your personal data. For GDPR inquiries, contact us at support@merchyak.com.

Supervisory Authority

If you believe we have not addressed your concerns adequately, you have the right to lodge a complaint with a supervisory authority in your EU member state of residence.

Your Rights (CCPA - California Users)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

Right to Know

You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the business purpose for collecting it, and the categories of third parties with whom we share it.

Right to Delete

You have the right to request deletion of your personal information, subject to certain exceptions (such as legal obligations or completing a transaction you requested).

Right to Opt Out of Sale or Sharing

MerchYak does not sell your personal information. We do not share your personal information for cross-context behavioral advertising. If this changes in the future, we will provide a clear opt-out mechanism and update this policy.

Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. You will not receive a different level of service or pricing for exercising your privacy rights.

Exercising Your CCPA Rights

To exercise your rights, contact us at support@merchyak.com. We will verify your identity before processing your request and respond within 45 days.

Your Rights (All Users)

Regardless of your location, you have the following rights:

Access Your Data

You can view all your data directly within the MerchYak application, including your projects, generated content, and account information.

Export Your Data

You can export your generated content (descriptions, titles, tags, FAQs, and social posts) in CSV, PDF, or JSON format for your records. You can also download a full export of all your personal data in a machine-readable JSON format from your Account Settings.

Delete Your Data

You can delete individual projects at any time. To delete all your data, you may delete your account from the Account Settings page. This will permanently remove your account and all associated data.

Opt-Out

You may opt out of marketing and promotional communications at any time by:

  • Clicking the "unsubscribe" link in any marketing email
  • Updating your communication preferences in your Account Settings
  • Contacting us at support@merchyak.com

Opting out of marketing emails will not affect service-related communications (such as account notifications, billing receipts, and security alerts), which are necessary for operating your account.

Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include:

  • Encryption of data in transit (HTTPS/TLS)
  • Encrypted storage for sensitive data
  • Secure authentication via OAuth providers
  • Regular security assessments and updates
  • Access controls limiting employee data access
  • Image metadata removal: We automatically strip EXIF metadata (which may contain GPS coordinates, device information, and other sensitive data) from uploaded images before processing. This is a privacy-protective measure — the original image metadata is not stored or logged.

While we strive to protect your personal information, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

Data Breach Notification

In the event of a data breach that affects your personal information, we will:

  • Notify affected users within 72 hours of discovering the breach
  • Provide details about the nature of the breach and the data affected
  • Describe the measures we are taking to address the breach and mitigate potential harm
  • Provide guidance on steps you can take to protect yourself

Where required by law, we will also notify relevant supervisory authorities within the applicable timeframe.

Cookies and Tracking Technologies

Essential Cookies

MerchYak uses essential cookies required for the service to function:

  • Session cookies: Used to maintain your authenticated session after login. These are strictly necessary and cannot be disabled.
  • Security cookies: Used to prevent cross-site request forgery and protect your account.

Analytics and Performance

We use Umami, a self-hosted, privacy-focused analytics tool, to understand how users interact with our service. All analytics data is stored on our own infrastructure and never shared with third parties.

Umami is cookieless — it does not use cookies, browser fingerprinting, or personal identifiers of any kind. The following anonymous, aggregate data is collected:

  • Page views and navigation paths
  • Referrer sources (how you arrived at our site)
  • Browser type and operating system
  • Device type (desktop, mobile, tablet)
  • Approximate country based on request origin

No IP addresses are stored, no personal data is collected, and no cross-site tracking occurs. Because Umami does not use cookies or collect personal identifiers, no cookie consent is required for analytics under GDPR or similar regulations.

Your Choices

Essential cookies (session and security cookies) cannot be disabled as they are required for the service to function. Our analytics tool (Umami) does not use cookies or collect personal identifiers, so no consent or opt-out mechanism is required. If you still wish to block analytics requests, you may do so using a browser extension or content blocker such as uBlock Origin.

International Data Transfers

MerchYak operates using service providers that may be located in various countries. Your personal data may be transferred to and processed in countries other than your country of residence, including the United States. These countries may have data protection laws that differ from those in your jurisdiction.

When we transfer data internationally, we take steps to ensure your data receives an adequate level of protection, including:

  • Using service providers that maintain appropriate security measures
  • Ensuring data is encrypted in transit and at rest
  • Limiting data sharing to what is necessary for providing the Service

If you are located in the European Economic Area (EEA), we rely on appropriate legal mechanisms for cross-border data transfers, such as Standard Contractual Clauses where applicable.

Children's Privacy

MerchYak is not intended for use by children under the age of 18. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at support@merchyak.com.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. For significant changes, we may also send you an email notification.

Your continued use of the service after any changes constitutes acceptance of the updated Privacy Policy.

Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

We aim to respond to all inquiries within 5 business days.