Data controller

The data controller is MERCHLY, a French SAS with share capital of €1,000, registered with the Paris Trade and Companies Register under number 994 997 880 (SIRET 994 997 880 00012).

For personal data enquiries, email studio@merchly.fr or write to MERCHLY, 59 rue de Ponthieu, 75008 Paris, France. Further company information appears in the legal notice.

Information we collect

You can browse the website and catalogue freely. An account, accessed with an email code, lets you save projects and retrieve quote requests. We process the details you supply: first and last name, email, optional telephone number, company, product selections, quantities, branding, deadlines, project brief and attachments.

Your name identifies who we are replying to. Your company or artist name identifies the project you represent. Your email lets us reply. Your telephone number is optional and is used if you would like a call back. Your message supplies the project context.

We do not request sensitive personal data as defined in Article 9 of the GDPR. Please do not include it in your message. These details are not used for profiling or automated decisions.

To limit automated sign-in attempts, the server keeps temporary counters linked to a fingerprint of the email and IP address. These counters are cleared after 24 hours.

Why we process this information

We use your project and contact details to respond to your enquiry, call you back, prepare a quote and discuss your project. These contact details are not used for other purposes.

The legal basis is taking steps at your request before entering a contract (GDPR Article 6(1)(b)) for project and quote enquiries, and MERCHLY’s legitimate interest in answering enquiries and managing its commercial relationships (Article 6(1)(f)) for other requests.

We do not use these contact details for unsolicited bulk marketing. They are not sold, rented or disclosed to third parties for marketing purposes.

Who can access your data

Access is restricted to the MERCHLY team members responsible for customer relationships and quotes, and the technical processors acting on MERCHLY’s instructions:

  • Resend delivers the sign-in codes you request. It processes your email address and the contents of the sign-in email.
  • Vercel Inc. hosts the website and runs the functions needed for the catalogue, sign-in and quote requests.
  • Supabase hosts customer accounts, projects and files in a dedicated storefront environment in the European Union, separate from the internal Studio.
  • Intercom operates the live chat. It processes messages, files and contact details you choose to share in the conversation. Chat loads only when you open it. Your account details, briefs and files are not automatically sent to chat.

Some providers may operate partly or wholly outside the European Union. Where applicable, transfers are covered by the European Commission’s standard contractual clauses or another mechanism provided for in Chapter V of the GDPR. Data may also be disclosed to an administrative or judicial authority when required by law.

How long we keep your data

Quote requests and commercial correspondence are retained for three years from the last contact with you. You can request deletion of your account, drafts and data by emailing studio@merchly.fr, subject to applicable retention obligations.

If a commercial relationship begins, accounting and contractual documents, including signed quotes and invoices, are retained for the period required by applicable legal and tax obligations.

Cookies and measurement

Before sign-in, your selection and logo can remain in your browser for 24 hours so you can resume your creation. The logo is uploaded after sign-in when the project is saved. Necessary cookies maintain your project session and protect exchanges. The internal Studio and customer accounts use separate sessions.

A functional language cookie remembers your choice of French or English for one year. On the first visit to the homepage, the browser language and, where needed, the country supplied by the hosting provider determine the initial language. No precise GPS location is requested. You can switch languages at any time.

With your consent, Google Analytics 4 measures pages viewed, progress through the catalogue and quote journey, scrolling and contact clicks. Google Ads measures successfully saved quote requests from our campaigns. These tools do not load before your choice. You can accept, reject or customise analytics, advertising measurement and personalised advertising separately, and withdraw consent using “Cookie preferences” in the footer. Rejecting cookies does not block the website.

Your consent choice is kept for six months. Visit attribution, including the campaign, landing page, referring website and, with advertising consent, click identifier, may be kept for 30 days and then associated with your request for commercial follow-up. Analytics cookies are configured to last 90 days. Tab-local navigation counters expire after 30 minutes of inactivity. Merchly retargeting audiences retain members for 30 days, or 60 days for quote requests used as an exclusion.

Navigation data does not include names, emails, phone numbers, brief text, logos or files sent to the Studio. With your separate consent, Google Ads uses your visits and interactions to show you relevant Merchly ads after your visit. Audiences distinguish engaged visitors, selections started and quotes already requested. Our tag keeps Google Signals disabled. We do not record videos of your sessions.

With separate consent for “Facebook & Instagram ads · Meta”, the Meta pixel measures public page visits, products viewed and added to a selection, engagement and contact clicks to prepare Merchly advertising audiences. Meta receives the public page URL, product identifiers, browser information and IP address. No Meta pixel loads on account, sign-in, brief or private project pages. Automatic form-field collection and advanced matching are disabled; we do not send contact details, briefs or logos. Meta first-party cookies are removed from the website when you withdraw consent. Previous cookie choices do not authorise Meta. Some processing may take place outside the EU. See Meta’s privacy policy.

Google provides the measurement tools; some processing may take place outside the EU under the safeguards in its data processing terms. See Google’s privacy policy. Intercom chat loads only when you open it to contact the team.

Your rights

Under the GDPR, you have the following rights:

  • Access: confirmation of whether your personal data is processed and a copy of it.
  • Rectification: correction of inaccurate or incomplete information.
  • Erasure: deletion, subject to legal retention obligations.
  • Objection: object to processing based on legitimate interests, on grounds relating to your particular situation.
  • Restriction: temporarily limit processing while a dispute is examined.
  • Portability: receive the data you supplied in a structured, machine-readable format.
  • Post-mortem instructions: specify how your personal data should be handled after your death.

To exercise these rights, email studio@merchly.fr and describe your request. We respond within one month of receipt. If there is reasonable doubt about your identity, we may ask for supporting identification.

Complaints to the CNIL

If you believe your rights have not been respected after contacting us, you can complain to the French supervisory authority, the Commission Nationale de l’Informatique et des Libertés (CNIL), via cnil.fr.

Security

MERCHLY uses appropriate technical and organisational measures to protect your data, including HTTPS encryption, restricted authenticated access to internal tools, separation of production partner access and a limited number of authorised people.

Policy updates

This policy may change to reflect legal, technical or organisational developments. Please check the update date and review it periodically.

Last updated: 21 September 2026.