Privacy Policy

1. Who is responsible

NovaMerch is operated by Ranch Technologies, which is responsible for the personal information described here. Contact: hello@novamerch.net.

2. What we collect

When you buy

• Your name, email address, and shipping address (for physical items).
• What you ordered, the price paid, and the order's status, tracking, and download history.
• Payment details are entered on Stripe's secure page and handled by Stripe. We receive confirmation of payment and limited details such as the card brand, but never your full card number.

When you open a creator store

• Your email address (used to sign you in), store name, handle, bio, photos, and social links.
• The designs, photos, and files you upload, and your products and prices.
• For items you ship yourself: your ship-from address, phone, and email, which appear on shipping labels.
• For payouts: payout and tax details, collected and stored by our payment provider.

Automatically

• Basic technical information such as IP address, browser type, and pages visited, kept in our hosting provider's logs for security and troubleshooting.
• Visit statistics without cookies, such as page views and where visitors came from, if analytics are on.

3. Cookies and storage on your device

• Sign-in cookies keep creators signed in to their Studio. They are essential and are not used for advertising.
• Your cart is saved in your own browser so it's still there when you come back. It isn't sent to us until you check out.
• We don't use advertising or cross-site tracking cookies.

4. How we use it

• To process payments, make and ship orders, deliver downloads, and send order and sign-in emails.
• To run creator stores, calculate earnings, and pay creators.
• To provide support, handle refunds and returns, and prevent fraud and abuse.
• To keep the site secure and working, and to understand how it's used so we can improve it.
• To meet legal, tax, and accounting obligations.

For visitors in the UK and EU, our legal bases are: performing our contract with you (orders, stores), our legitimate interests (security, fraud prevention, improving the site), and legal obligations (tax and accounting records).

5. Who we share it with

We share personal information only as needed to provide the service:

• The creator whose store you bought from sees your name, the items you ordered, and, for items they ship themselves, your shipping address, so they can send your order.
• Stripe, to take payments, prevent fraud, and pay creators.
• Printful, our print partner, receives your name, shipping address, and email to make and ship printed items.
• Shippo receives shipping addresses to create labels for creator-shipped items.
• Resend sends our sign-in and notification emails.
• Supabase stores our database, sign-in accounts, and uploaded files.
• Vercel hosts the website, and Cloudflare provides our domain and DNS.
• Authorities or others when required by law, or to protect our rights, users, or the public.
• A buyer or successor if NovaMerch is ever sold or merged, under this same policy.

These providers may process data in the United States and other countries. We do not sell or rent your personal information, and we don't share it for cross-context behavioral advertising.

6. How long we keep it

• Order and payment records: as long as needed for tax and accounting rules, usually up to 7 years.
• Creator accounts and content: while your store is open, then deleted or anonymized within 90 days of closing, apart from order records.
• Server logs: for a short period, typically no more than 30 days.

7. Your choices and rights

Wherever you live, you can ask us to show you, correct, export, or delete your personal information by emailing hello@novamerch.net. We may need to keep some records the law requires, such as order history for tax purposes, and we'll verify your identity before acting on a request.

• California residents have the right to know, access, correct, and delete personal information, and not to be discriminated against for using these rights. We don't sell or "share" personal information as those terms are defined in California law.
• UK and EU residents can also object to or restrict certain processing and complain to their local data protection authority.
• You can unsubscribe from any non-essential emails using the link in the email.

8. Security

We use encrypted connections (HTTPS), keep payment details with Stripe, store downloads privately, and limit who can access data. No system is perfectly secure, but we'll let you know without undue delay if a breach affects your personal information, as the law requires.

9. Children

NovaMerch is not directed to children under 13, and we don't knowingly collect their personal information. If you believe a child has given us personal information, contact us and we'll delete it.

10. Changes

We'll update this policy as NovaMerch changes and show the new date at the top. For important changes, we'll let creators know by email. See also our Terms of Service.