01. Who we are
Merle Studio is the trading name of MERLE LTD, registered in England and Wales with company number 17482332. Our registered office is 66 Paul Street, London, EC2A 4NA, United Kingdom. In this policy, “we”, “us” and “our” mean MERLE LTD. This policy applies to merle.studio, our support communications and Shopify apps that link to this policy.
We are the data controller for information we use to manage our website, merchant relationships, support and app usage analytics. When an app processes a store’s customer information to provide its features, the merchant is the controller and we act as a processor on the merchant’s instructions.
The information an app needs depends on its features and the permissions a merchant grants. Any app-specific privacy notice supplements this policy and explains that app’s particular data practices. A merchant’s own privacy policy governs their store and their relationship with customers.
02. Information we collect
Information you provide
If you contact us, we receive your email address, any name or business details you provide, and the contents of your message. This can include store details, screenshots and other information you choose to share for support. Please avoid sending passwords, payment card details or unnecessary customer information.
Information from Shopify
Installing an app authorises access to the Shopify data covered by its requested permissions. Depending on the app, this can include:
- Store and merchant information, such as store ID, domain, business contact details, time zone and app settings.
- App installation and account information, such as granted permissions, access tokens and subscription status.
- Store content needed for the app’s features, such as products, variants, collections, inventory and theme information.
- Order or customer information, only where required for the app’s features and authorised. This may include order IDs, purchased items and, where necessary, customer names, email addresses, telephone numbers or delivery addresses.
These categories do not mean every app accesses all of this information. We limit access to what the installed app needs. Permissions are shown by Shopify during installation and can be reviewed in your Shopify admin.
Technical information
Our hosting infrastructure processes technical information when you visit the website, including IP address, browser information, requested URL and request time. Apps may also process diagnostic information such as errors, feature usage and request logs to operate reliably and investigate support issues.
We send selected app events to PostHog for product analytics. Depending on the event, these may include an event name and time, feature interactions, app or subscription details, and an identifier associated with a merchant or store. These events help us understand app usage and improve our services. The exact properties depend on the app and the event being recorded.
03. How we use information
- Provide the website and the app features you request.
- Authenticate app access, maintain settings and administer subscriptions where applicable.
- Answer enquiries and provide merchant support.
- Investigate errors, maintain security and improve the reliability of our services.
- Analyse selected app events with PostHog to understand feature adoption and improve usability.
- Meet legal obligations and handle privacy requests or disputes.
Store customer information is processed to provide the app’s services to the merchant. It is not used to market our own products to a merchant’s customers.
04. Our legal bases
Where UK or European data protection law applies and we are the controller, we rely on the following grounds:
- Contract: providing services you request and managing our agreement with you.
- Legitimate interests: answering business enquiries, supporting merchants, understanding app usage and keeping our services secure and reliable, balanced against your rights. We obtain consent instead where required for analytics.
- Legal obligations: keeping required records and responding to lawful requests.
- Consent: where required for optional marketing or non-essential tracking. You can withdraw consent at any time.
Merchants are responsible for establishing a lawful basis for customer information they instruct us to process. If information needed to provide a feature is not supplied, that feature may not be available.
07. Retention and deletion
We keep personal information only for as long as it is needed for the purpose described in this policy. Retention depends on the duration of the merchant relationship, whether a support issue remains open, security needs, and any legal record-keeping or claims requirements. Information that is no longer needed is deleted or anonymised.
Uninstalling an app ends its access to new Shopify store data. Store and customer information held for that app is deleted in response to Shopify’s store deletion request, unless retention is legally required. Records held separately for accounting, legal obligations or an unresolved dispute are retained only for those purposes. Personal information held by providers on our behalf, including identifiable PostHog events, is included in applicable deletion requests.
Shopify provides processes for customers to request their data or its deletion through the store owner, and for store data to be deleted after uninstall. We complete these requests within 30 days of receipt, except where the law requires retention. You can also contact us to request access or deletion using the details below.
08. International transfers
We are established in the United Kingdom. Shopify, Cloudflare, PostHog and our support providers may process information in other countries, including outside the UK or European Economic Area. The location depends on the provider and the service region used for the relevant app.
Where a transfer requires safeguards under applicable data protection law, we use an appropriate transfer mechanism, such as an adequacy decision or approved contractual protections. You can contact us for information about the safeguards relevant to your data.
09. Keeping information safe
We use appropriate technical and organisational measures to protect information from unauthorised access, loss or misuse. Access is limited to the people and providers who need it to deliver and support our services. No method of transmission or storage can be guaranteed to be completely secure.
10. Your privacy rights
You can request access to, correction of or deletion of your personal information wherever you live. Depending on the law that applies to you, you may also have rights to request a portable copy, restrict processing or withdraw consent. These rights are subject to applicable legal exceptions.
You may also object to processing based on our legitimate interests, and to direct marketing at any time.
Email hello@merle.studio to make a request. We may need to verify your identity or authority to act for a store before responding. We respond within the time required by applicable law and do not discriminate against anyone for exercising their privacy rights.
If you are a customer of a Shopify store, contact the store owner first. They control your customer information and can pass your request to us. If you contact us directly about information we process for a merchant, we will help direct the request to them.
You can complain to your local data protection authority. In the UK, this is the Information Commissioner’s Office (ICO).
11. Changes to this policy
We may update this policy as our services or legal obligations change. The date at the top shows when it was last updated. Where a change materially affects how we use personal information, we will provide appropriate notice and obtain consent if required.
12. Contact us
For privacy questions, requests or concerns, contact MERLE LTD, trading as Merle Studio:
hello@merle.studio MERLE LTD66 Paul Street
London, EC2A 4NA
United Kingdom
Company number 17482332