Transparency You Can Trust
We take your privacy and data security seriously. Review our policies governing your use of MerchantFlow.
Data Retention Policy
Overview
This policy outlines how long MerchantFlow retains different categories of data and how data is handled upon account deletion or service termination. We retain your data only as long as necessary to provide the Service or as required by law.
Retention Schedule
| Data Category | Retention Period | Deletion |
|---|---|---|
Analytics snapshots Product performance, diagnostics, daily metrics | Duration of account | Deleted within 30 days of account termination |
Order data Synced orders, attribution, revenue data | Duration of account (up to 7 years for financial records) | Deleted within 30 days of account termination |
Customer.io tracking data Lifecycle events, user attributes, feature adoption metrics | Duration of account | User profile deleted from Customer.io on account termination |
System logs & audit trails API access logs, admin actions, security events | 90 days (rolling) | Automatically purged after retention period |
Error & performance logs PostHog error reports, performance traces | 30 days | Automatically purged by PostHog |
OAuth tokens Encrypted access & refresh tokens for integrations | Until disconnected or account terminated | Immediately deleted on disconnect |
Billing records Invoices, subscription history, payment metadata | 5 years as required by Australian tax law (Income Tax Assessment Act 1997) | Retained for tax and compliance per Australian law |
Account information Email, name, company, settings | Duration of account | Deleted within 30 days of account termination |
Backup data Encrypted database backups | 90 days (rolling) | Automatically purged after retention period |
Mobile device records Hashed device token and display prefix, device label, platform, timestamps | Duration of account, including expired and revoked devices, so your device list and its history remain available to you | Deleted with the user or workspace, within 30 days of account termination |
Mobile pairing codes Hashed one-time codes used to pair a device | Short-lived (currently 5 minutes); consumed on use | Deleted with the user or workspace |
Public demo stores A demo store built from what a store publishes (its name, products, prices, SKUs and images), with sample figures, and its sign-in, including the session's IP address, approximate country and browser type | Until the demo ends (currently 2 hours) | Deleted automatically within about 15 minutes after the demo ends |
Public demo visitor details Email address, a keyed hash of the visitor's network, and a hash of the sign-in claim | 30 days after the demo is deleted | Automatically cleared after the retention period. An email address sent to Customer.io with the visitor's marketing opt-in stays there until the visitor asks us to delete it; unsubscribing stops the emails |
Public demo rate limits Counters keyed by a hash of the visitor's network or email address | Up to 24 hours; one daily counter 2 days | Expire or are deleted automatically |
Public demo records The store's name and address, the products read from it, the demo's settings, when it ran, and whether the visitor opted in to marketing | Kept for our reference | Deleted on request |
Personalised preview stores A demo store built from a business's public store (its name, products, prices and images) with sample figures, and its sign-in, including each session's IP address, approximate country and browser type | Until the preview ends: by default 14 days after it is prepared for outreach and 7 days for any other preview, and never more than 90 days after it was prepared or last extended | Deleted automatically within about 15 minutes after the preview ends; a link's sign-in sessions within about 15 minutes after the link stops working |
Personalised preview links A one-way hash of each link (never the link itself), the email address it was sent to (optional), its campaign, who created it and when, and counts and times of opens, visits and button presses with the last device type and country | Email address, device type and country: until 30 days after the link stops working. Counts and times: 24 months after that | Cleared and then deleted automatically; the email address, device type and country are erased sooner on request |
Personalised preview visitor codes One-way, per-link codes of a visitor's network and device type | 30 days after the link stops working | Deleted automatically; erased sooner on request |
Outreach preview contacts The name and email address our team entered for the person an outreach preview was prepared for | 90 days after the preview ends | Cleared automatically; erased sooner on request |
Personalised preview records The store's name and address, the company name or label our team entered for the preview, the products read from it, the preview's settings and campaign, and when it ran | Kept for our reference | Deleted on request |
Preview button codes The random code behind the mf_pdi cookie | 7 days in the browser; deleted from our records 30 days after that | Deleted automatically; an unused code is erased sooner on request |
Preview conversions Which preview led to a new account, and when the account was created, a store connected, a trial started and the first payment was made | 24 months after the account was created; the link to a deleted account is removed when the account is deleted, and from our preview summaries shortly afterwards | Deleted automatically |
Outreach preview links For each preview link our team prepares before any visit: a one-way hash of the link (never the link itself), the store's address and a copy of its public details (name, logo, platform, currency, time zone and up to six products), the business contact details our team entered (optional), its campaign, one-way visitor codes, and counts and times of opens, demos and visits | Contact details, visitor codes and the link's hash: until 30 days after the link stops working. The rest: 24 months after that | Cleared and then deleted automatically; contact details are erased sooner on request |
Outreach preview demos A demo store built when someone chooses to explore the dashboard from an outreach preview link: the store's public products with sample figures, and its sign-in, including each session's IP address, approximate country and browser type | Until the demo ends (currently 2 hours after it is built) | Deleted automatically within about 15 minutes after the demo ends |
Outreach preview page-load counts How many times each outreach preview page was loaded, including by automated email scanners, per link and per campaign; no personal data | Per link: until 7 days after the link stops working. Per campaign: 120 days after the last load | Expire automatically; a link's counts are deleted sooner when it is revoked |
Outreach opt-out codes A one-way code made from an email address or a store's address, kept when someone asks us to stop contacting them, or to delete what we hold about them for a preview, so that we never prepare another outreach preview link for them | Until you ask us to remove it | Deleted on request |
Account Deletion
You can delete your account at any time via Settings → Delete Account, or by contacting [email protected]. This is also the route to use if you installed the mobile app - the app itself cannot create or delete accounts. Upon deletion:
- All OAuth connections are immediately revoked
- All paired mobile devices are removed and their access credentials stop working
- Account data, analytics, and integration data are deleted within 30 days
- Billing records are retained as required by Australian tax law
- Backup data is purged within 90 days as backups rotate
Data Export
Before deleting your account, you can export your data in CSV format from the dashboard. We also support data portability requests - contact [email protected] for a full export of your personal and business data.