Privacy Policy

This policy describes how MerchGent Inc. (“MerchGent AI”, “we”) collects and uses information when you use the MerchGent AI service available at merchgent.com (the “Service”).

We collect only what we need to run the Service:

• Account data — your name, work email, password hash (held by our authentication provider — see Section 5), and the metadata of your subscription (status, billing period, payment method last-4 — never the full card number).
• Mailbox connection metadata— the email address of the mailbox you connect, the provider (Microsoft 365 / Outlook via OAuth, or any IMAP-speaking mailbox via app password — including Gmail, personal Outlook.com, Tencent Exmail, NetEase qiye, Alibaba Cloud Mail, Sina, Titan, iCloud, Yahoo, and arbitrary servers via the “Any IMAP mailbox” option which captures Zoho, Yandex, Fastmail, custom-domain mailboxes, ProtonMail Bridge, self-hosted Dovecot, etc.). All mailbox credentials — OAuth refresh tokens and IMAP app passwords alike — are encrypted at rest with AES-256-GCM (the same authenticated-encryption standard banks use to protect transactions) using a key held only in our infrastructure. For generic IMAP we additionally store the customer-supplied IMAP/SMTP host names + ports so the agent knows which server to connect to.
• Email content (transient) — when an agent run executes, we fetch the relevant inbox + sent items from your provider, process them in memory, and discard them at the end of the run. We do not persist raw email bodies in our database as a corpus.
• Draft history (limited) — for each reply the agent drafts, we keep a record containing the draft body, the original message identifier, and (if we later detect that you sent the message) the body you actually sent and a diff between the two. This draft log exists so the agent can learn from your edits and improve over time. The log is scoped to your account, used only to refine your voice profile, and deleted in line with Section 7. We do not log the bodies of any messages you did not reply to.
• Derived profiles (persistent) — the agent generates a voice profile, per-vendor and per-buyer cards, an executive business summary, and a register hint about which desk you sit at. These are refreshed weekly using your recent sent mail + draft edits. They are stored in our database for use by future runs, scoped to your account, and never shared between accounts or shown to anyone else.
• Operational logs — run timestamps, message counts, draft counts, lane breakdowns (must-reply / should-read / no-attention totals), error class names and similar metadata. Logs never contain the body text of your emails, and email addresses are redacted at the log layer (e.g. kis***@gmail.com).
• Web analytics — minimal first-party page-view counts from our hosting provider. We do not use third-party analytics scripts (Google Analytics etc.) on merchgent.com.

• To provide the Service — read your mailbox, classify messages, draft replies.
• To bill you and manage your subscription.
• To send transactional email (welcome, deep-study complete, daily digest).
• To improve the Service through aggregated operational metrics. We do not train models on your email content, our own or anyone else’s.
• To respond to legal process or comply with applicable law.

To classify your emails and draft replies in your voice, we send the email content and your derived voice profile to a third-party large language model (“LLM”) provider acting as our sub-processor. As of the date at the top of this page the named LLM provider is Alibaba Cloud Qwen (Alibaba Cloud Computing Ltd., Hangzhou, China) — primary; DeepSeek (DeepSeek AI Ltd., Hangzhou, China) — fallback. We chose them because their commercial API contract states that they do not use customer API inputs to train their models. We may change LLM providers in future with 30 days’ notice via email — see Section 5.

The data sent to each LLM call includes (a) the inbound email body or relevant historical messages, (b) your derived voice profile, (c) a short business summary, (d) up to three prior messages from the same conversation thread for context, and (e) for the weekly executive-report feature only, a list of recent draft subject lines (scrubbed of email addresses and counterpart names before transmission) plus aggregate counts. The provider returns the lane classification, drafted reply where appropriate, and the work-report narrative for the report feature. Neither MerchGent AInor the LLM provider retains the inputs beyond standard short-term operational logs (Alibaba Cloud’s published retention window for DashScope is 30 days; DeepSeek’s is also 30 days) needed for abuse prevention.

Public demo route. The /demo classifier accepts a single inbound-style email pasted by the visitor and returns a triage. Inputs are processed by the same LLM sub-processor named above. We retain a per-IP rate-limit counter for seven days; we do not retain the demo input beyond the immediate response.

Where the data goes physically. Both Alibaba Cloud DashScope (Qwen) and DeepSeek host their production APIs in mainland China. Email content sent to either model therefore transits to and is processed in PRC infrastructure. Customers based outside China should be aware of this routing and consult their own internal data-handling policies before connecting a mailbox. Alibaba Cloud offers non-PRC regional deployments (e.g. Singapore) that we are evaluating for customers requiring non-PRC processing — please contact us at hello@merchgent.com if this is relevant to your organisation.

By default, no human at MerchGent AI reads your email. The pipeline is automated end-to-end and the agent runtime is the only place mailbox content is decrypted. The narrow, named exceptions where a team member may view specific content are:

• You ask us to. When you open a support ticket and share a specific message or draft so we can debug it, we view only what you forward to us and discard it after the ticket closes.
• Security incident response. If we detect or are notified of suspected unauthorised access to a mailbox, an on-call engineer may inspect the minimum scope necessary (typically connection metadata, error logs, and recent draft IDs) to contain the incident. We document each instance and notify the account holder.
• Legal compulsion. A court order or law-enforcement request, to the extent we are legally required to comply. We notify you if we are permitted to do so.

Outside those situations, production access is limited to operational metadata and encrypted-credential blobs that no one on the team holds the key to read in plaintext outside the agent runtime.

We rely on a small set of named sub-processors. Each is selected for a specific function and contractually limited to that function. As of the date at the top of this page:

• Cloud hosting — Vercel Inc. (US). Hosts the merchgent.com web app and runs HTTP edge functions.
• Database — Neon Inc. (US, EU regions). Stores subscription state, mailbox connection metadata, derived profiles, and operational logs.
• Authentication — Clerk Inc. (US). Holds your account credentials. We never see your password.
• Payments — Stripe Inc. (US). Processes payments and stores billing details. We never see your full card number.
• Transactional email — Resend Inc. (US). Sends welcome emails, bootstrap-complete notifications, and the daily digest.
• LLM provider — Alibaba Cloud Qwen (Alibaba Cloud Computing Ltd., Hangzhou, China) — primary; DeepSeek (DeepSeek AI Ltd., Hangzhou, China) — fallback. Performs classification and drafting on the email content of a single run, then discards it (subject to the provider’s own short retention window for abuse prevention).
• DNS + edge — Cloudflare Inc. (US). Provides DNS for merchgent.com + merchgentai.com, and forwarding of *@merchgentai.com to our hello@merchgent.com inbox (Email Routing).
• Business mailbox hosting — Zoho Corporation Pvt. Ltd. (India / US). Hosts the inbound mailboxes for merchgent.com (e.g. hello@, support@) used for customer support correspondence. Storage of any email the customer sends us as part of a support request is governed by Zoho’s privacy policy.
• Mailbox APIs — Microsoft Corporation (Microsoft Graph), Google LLC (Gmail API), and the IMAP provider your mailbox lives on (e.g. Tencent, NetEase, Alibaba, Sina, Titan, Apple, Yahoo). These are not sub-processors in the usual sense — they are the source systems we read from and write drafts back to, under permission you granted at connect time.
• Continuous integration + agent runtime — GitHub Inc. (US). The hourly agent runs as a scheduled job on GitHub Actions. Only operational secrets reach this environment; mailbox content is fetched, processed, and discarded within each scheduled run.

We may add or change sub-processors with 30 days’ notice via email to the address on file. Continued use of the Service after a change constitutes acceptance. To request the current list of sub-processors at any time, email hello@merchgent.com.

Our web app and database run in cloud regions in the United States and the European Union. Mailbox tokens and derived profiles are stored in our Neon Postgres instance in those regions. The hourly agent runs as a scheduled job in the GitHub Actions environment.

Email content sent to the LLM provider transits to mainland China. As disclosed in Section 4, our current LLM provider is DeepSeek, whose API is hosted in the PRC. If your organisation has a policy against PRC data routing, do not connect a mailbox until we offer an alternative provider in your region. Email hello@merchgent.com if this is a constraint.

Cross-border transfer mechanism.For EU / UK / Swiss customers transferring personal data to the PRC through DeepSeek, the lawful basis we rely on is the customer’s explicit consent to the specific transfer per GDPR Article 49(1)(a) (and the equivalent UK / Swiss provisions). By connecting a mailbox you provide that consent, having been informed in this Policy that the destination jurisdiction (PRC) is not subject to a European Commission adequacy decision and may not offer equivalent data-protection rights. You can withdraw consent at any time by cancelling your subscription — see Section 7 on deletion. If you require Standard Contractual Clauses (SCCs) or a different transfer mechanism, contact us before subscribing.

We do not knowingly process special-category personal data (health, biometrics, religion, political affiliation), children’s data, or government-issued identification numbers. If you discover such data in your mailbox is being processed because of our Service, contact us and we will work with you to scope it out.

• Raw email content — fetched into memory at the start of each agent run, processed, and discarded at the end of that run. Never persisted in our database as a corpus.
• Mailbox OAuth tokens + IMAP authorization codes — AES-256-GCM encrypted at rest, kept while your subscription is active. Deleted within seven (7) days of cancellation.
• Draft log entries (the sent_match learning loop) — when the agent drafts a reply, we keep the draft body and the original message id for up to ninety (90) days so we can detect whether you sent the draft and, if so, compute the diff between what we wrote and what you sent. Sent bodies and edit diffs that have been incorporated into the next weekly voice-profile refresh are then purged. Anything not matched within 90 days is deleted regardless. All of this is deleted within seven (7) days of cancellation.
• Derived profiles — voice profile, vendor / buyer cards, business summary, role + register hint. Refreshed weekly. Deleted within seven (7) days of cancellation.
• Operational logs + run statistics — retained for ninety (90) days for debugging, billing accuracy, and abuse prevention. Email addresses inside log lines are redacted at write time.
• Account + billing records — retained for the period required by tax and accounting law (typically seven years for US tax purposes), then deleted.
• Work-report config — the recipient email address you nominate for the weekly work report, the cadence, and the timestamp of the most recent send. Retained while your subscription is active. Deleted within seven (7) days of cancellation.
• Waitlist entries — pre-payment sign-ups (email + optional company + notes) collected from the home page. Retained for up to 24 months while we evaluate market demand, then deleted. You can request earlier deletion via hello@merchgent.com.
• Public demo rate-limit data — per-IP and global daily counters from the /demo classifier. Retained for seven (7) days for abuse prevention. Reaped daily.

We use industry-standard safeguards:

• AES-256-GCM encryption for all mailbox tokens and IMAP authorization codes at rest.
• TLS for every connection — to your mailbox provider, to the LLM provider, between our servers, and from your browser to the web app.
• The strictest minimum OAuth scopes available. For Microsoft we request Mail.ReadWrite + MailboxSettings.ReadWrite — never Mail.Send. For Gmail we request only read + draft + modify scopes — never gmail.send. The send permission is not in any of our connect flows.
• IMAP providers:the password / app-specific code you give us when connecting a Chinese mail provider (Tencent ExMail, NetEase Qiye, Aliyun Mail, Sina, etc.), iCloud, Titan, or Yahoo grants both IMAP (read) and SMTP (send) capability — there is no protocol-level way to scope down to read-only. We deliberately never wire up an SMTP client: drafts are placed in the provider’s Drafts folder over IMAP (APPEND to the drafts mailbox) so the customer reviews + sends from their own client. You can verify this by grepping the open-sourced agent for any SMTP call — there is none.
• HTTP responses include a strict Content-Security-Policy, X-Frame-Options: DENY, Permissions-Policy, and HSTS with preload.
• The public demo classifier rate-limits per-IP and globally per-day, and rejects prompt-injection patterns at the edge before any LLM call.
• Provider error responses are never echoed back to clients or logged with their raw bodies — many providers include the offending prompt fragment in 400-class errors, so we drop the body and log only the status code class.
• No plaintext credential storage anywhere in our stack. The credential-encryption key is held by Vercel + GitHub Actions environment-variable storage; no human on the team has direct read access to the contents of encrypted_credentials.
• Access to production infrastructure is limited to engineering personnel under written confidentiality obligations.

No system is perfectly secure. If we become aware of a breach affecting your data we will notify you by email within the timeframe required by applicable law (72 hours under GDPR; without unreasonable delay under most US state laws).

Depending on where you live, you may have rights to:

• Access the data we hold about you;
• Correct inaccurate data;
• Delete your data (note: cancelling triggers automatic deletion within 7 days);
• Export your derived profiles in a machine-readable format;
• Object to processing or withdraw consent (which will end your use of the Service);
• Lodge a complaint with your local data-protection authority.

Self-serve. Signed-in users can immediately exercise their access and erasure rights without filing a ticket:

• Export: GET /api/account/export returns a JSON download of your subscription, mailbox connections (credential blobs redacted), and the last 90 days of draft history.
• Delete: POST /api/account/delete with a JSON body {"confirmEmail":"<your-primary-email>"} wipes your mailbox connections and draft history immediately, and breaks the link between any retained billing record and your Clerk identity. You should also delete your Clerk account and cancel any remaining Stripe charges, as detailed in the response.

For any of the other rights above, or if either of the self-serve endpoints fails for you, email hello@merchgent.com. We will respond within 30 days.

merchgent.com sets a small number of essential cookies needed to keep you signed in, maintain your locale preference, and protect OAuth flows from CSRF. We do not use third-party advertising or analytics cookies.

The specific cookies in use today:

• __session, __client, __clerk_db_jwt, __refresh_* — set by our authentication sub-processor Clerk (see section 5) to hold your signed-in session. First-party on merchgent.com and clerk.merchgent.com. Expires when you sign out or after the inactivity window configured in Clerk.
• mg_locale — first-party. Remembers whether you prefer the English or Chinese interface. 12-month expiry. No personal data stored in it.
• mg_oauth_state— first-party, short-lived (10 minutes), HTTP-only. HMAC-signed nonce that protects the OAuth handshake when you connect a mailbox. Burned at the callback.

All cookies above are categorised as “strictly necessary” under the ePrivacy Directive and require no consent banner. If we ever add a non-essential cookie (analytics, marketing, etc.) we will introduce a consent banner before doing so.

Material changes will be notified by email to the address on file at least 14 days before they take effect. Non-material changes (typo fixes, clarifications) may be made without notice; the “Last updated” date at the top of this page will always reflect the current version.

Email hello@merchgent.com for any privacy-related question or request.