Privacy Policy
What data Merkora collects, why, who we share it with, and the choices you have.
1. Who We Are
Merkora ("Merkora", "we", "us") is a platform where coaches, therapists, teachers and other experts ("Creators") sell sessions, courses, events and digital products to their own clients.
- Merkora is operated by Merkora LLC, a limited liability company registered in Wyoming, USA, 30 N Gould St, Ste N, Sheridan, WY 82801, USA.
- Questions about this policy or your data: [email protected].
- General questions: [email protected].
2. Our Two Roles: Whose Data Is It?
Merkora handles personal data in two different capacities, and it matters which one applies to you.
- Merkora as controller. We decide how data is used for: Creator accounts, buyer and client accounts on Merkora, visitors to merkora.app, and our own billing, support, security and marketing.
- Merkora as processor for Creators. When a client books, buys from or is managed by a Creator, the Creator decides what to collect and why (for example their booking questionnaire, their notes, their client list). We store and process that data on the Creator's behalf and only to provide the service to them.
- If you are a client of a Creator and want to access, correct or delete information the Creator holds about you, please contact the Creator first. We will help them respond, and you can always write to [email protected].
3. What We Collect
a) Visitors
- Pages visited, referring site, approximate location (from IP address), browser, device and language — collected through our analytics tools (see Cookies).
b) Creators
- Account: name, email, username, password (stored only as a secure hash), profile photo, cover image, bio, links, timezone and language.
- Business setup: your services, prices, availability, booking rules, page content and uploaded files.
- Payouts: Creators get paid through Stripe Connect. Stripe collects the identity and bank details needed to verify you and pay you out, under Stripe's own privacy policy. We receive only your Stripe account ID and status — never your full bank or ID details.
- Merkora subscription: your plan and billing history (card payments are handled by Stripe).
- Connected Google Calendar (optional): see Google User Data.
- AI page builder (optional): the address of your existing website and the text we read from it — see AI Features.
- Support and relationship notes: messages you send us and internal notes we keep to support your account.
c) Clients and buyers (people who book or buy from a Creator)
- Contact details: name, email and, if the Creator asks for it, phone number. You can book as a guest without creating an account.
- Bookings: the service, date and time, location or video link, booking status, attendance (completed or no-show), cancellations, reschedules and waitlist sign-ups.
- Questionnaire answers: anything you enter in a Creator's booking questions.
- Purchases: what you bought, prices, refunds and wallet credits. Card details are entered directly with Stripe; we never see or store full card numbers.
- Learning activity: course progress, completed lessons, certificates and downloads.
- Live sessions: your participation in video sessions and chat (see Live Sessions and Recordings).
d) Information Creators add about their clients
Creators can add private notes about a client or a session. Only the Creator can see these notes. They are stored by Merkora as processor (see Our Two Roles).
4. How We Use Information, and Our Legal Basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and run accounts; deliver bookings, purchases, courses, events and downloads | Performance of a contract |
| Process payments, refunds, credits and payouts | Performance of a contract; legal obligation (tax and accounting) |
| Send booking confirmations, reminders, receipts and account emails | Performance of a contract |
| Sync bookings with a connected calendar | Performance of a contract, at your request |
| Keep the platform secure and prevent fraud and abuse | Legitimate interests |
| Provide support and improve Merkora | Legitimate interests |
| Measure site usage with analytics cookies | Consent |
| Measure and target our ads (Google Ads, Meta) | Consent |
| Send product news and marketing emails | Consent (you can unsubscribe at any time) |
| Comply with legal requests and enforce our Terms | Legal obligation; legitimate interests |
We do not sell personal information, and we do not use Creators' client data for our own marketing.
5. Sharing
We share personal data only with:
- The Creator you book or buy from — the details needed to deliver what you bought (your name, email, phone if requested, booking details and questionnaire answers).
- Service providers who process data on our instructions, listed below.
- Legal reasons — if required by law, court order or to protect rights and safety.
- Business transfers — if Merkora is merged or sold, data may transfer to the new owner under this policy.
| Provider | What for | Location |
|---|---|---|
| Stripe | Payments, subscriptions, Creator payouts | USA / EU |
| Google sign-in; Google Calendar sync (if connected) | USA | |
| GitHub | GitHub sign-in (if used) | USA |
| Stream.io (GetStream) | Live video sessions, chat and recordings | USA |
| Cloudflare (R2) | Storage of videos and files | Global |
| UploadThing | Storage of images | USA |
| Zoho Mail (Zoho EU) | Sending emails | EU |
| Anthropic | AI page builder (text generation) | USA |
| Firecrawl | AI page builder (reading your existing website) | USA |
| Umami (self-hosted by us) | Privacy-friendly site analytics | Germany (EU) |
| Ahrefs (Ahrefs Pte. Ltd.) | Cookie-free website analytics | Singapore |
| Google (Tag Manager, Analytics, Ads) | Website analytics and measuring our ads (with consent) | USA |
| Meta (Meta Pixel) | Measuring our ads on Facebook and Instagram (with consent) | USA / Ireland |
| Hetzner Online | Servers, database and backups | Germany (EU) |
6. Sensitive Information
Creators such as therapists or health coaches may ask questions whose answers reveal health or other sensitive information, and may write notes that contain it.
- Creators are responsible for having a valid reason and, where required, explicit consent to collect such information, and should collect only what they need.
- Merkora uses this information only to store it and show it to the Creator. We never use it for analytics, marketing or AI training.
- Clients: share sensitive details only if you are comfortable doing so; you can ask the Creator to delete them.
7. Google User Data
a) Permissions we request
If a Creator connects a Google account, Merkora requests these permissions:
- See the list of your calendars (calendar.calendarlist.readonly) — so you can choose which calendars block your availability and where new sessions are added.
- See free/busy times (calendar.events.freebusy) — so clients can't book times you're already busy.
- Create and manage events that Merkora creates (calendar.events.owned) — so your Merkora sessions appear in your Google Calendar and stay up to date.
b) What we store
For busy times, only the start and end time and Google's event ID — never event titles, descriptions, locations or attendees. We also store your calendar names, your Google account email and name, and access tokens, which are encrypted.
c) What we write
Events for your Merkora sessions, containing the session title, time, video link or location, and your client's name and email so you know who you're meeting. We only change or delete events that Merkora created.
d) Sharing
Google user data is not shared with anyone except as needed to provide this feature, comply with the law, or with your explicit consent. It is not transferred to Creators' clients, sold, or used for advertising.
e) Retention and deletion
When you disconnect Google Calendar in Settings, we revoke Merkora's access at Google, delete the stored busy times and remove the tokens. You can also revoke access at any time at https://myaccount.google.com/permissions.
f) Limited Use
Merkora's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We do not use Google user data to develop, improve or train AI or machine-learning models, and our staff do not read it except with your permission, for security purposes, or to comply with the law.
g) Google sign-in
If you sign in with Google, we receive your name, email address and profile picture, and use them only to create and secure your account.
8. AI Features
When a Creator uses the AI page builder, we fetch the public pages of the website they provide (via Firecrawl) and send that text to Anthropic's Claude to draft their Merkora page. The Creator reviews and edits the result. These providers process the content only to perform this task and, under their terms with us, do not use it to train their models. Client data is never sent to AI providers.
9. Live Sessions and Recordings
Live video sessions and chat run on Stream.io. If a Creator records a session, the recording is stored and made available to the Creator and, if the Creator chooses, to participants. Creators are responsible for telling participants when a session is recorded.
10. How Long We Keep Data
- Accounts: for as long as the account is active. After you ask us to delete it, we delete or anonymise your data within 30 days, except what we must keep by law.
- Payment and transaction records: as long as tax and accounting laws require (generally up to 10 years).
- Creators' client data: for as long as the Creator keeps their account, or until the Creator deletes it; deleted when the Creator's account is deleted.
- Google Calendar data: busy times are refreshed continuously and deleted immediately when you disconnect.
- Analytics data: up to 26 months.
- Backups: overwritten on a rolling basis within 30 days.
12. International Transfers
Our servers and database are hosted in Germany (EU). Some providers are located outside the European Economic Area, mainly in the USA. Where this happens, we rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.
13. Your Rights
Depending on where you live (including the EU, EEA, UK and California), you may have the right to:
- access the personal data we hold about you and receive a copy;
- correct inaccurate data;
- delete your data;
- restrict or object to certain processing;
- data portability;
- withdraw consent at any time, without affecting earlier processing;
- not be discriminated against for exercising these rights.
Email [email protected] to use any of these rights; we reply within 30 days. If your request concerns data a Creator collected about you, we will forward it to the Creator or help them answer (see Our Two Roles).
You also have the right to complain to your local data protection authority.
14. Security
Data is encrypted in transit (HTTPS). Passwords are stored only as secure hashes, and calendar access tokens are encrypted at rest. Access to production systems is limited to people who need it. No system is perfectly secure; if a breach affects your data, we will notify you and the authorities as the law requires.
15. Children
Merkora is not intended for children under 16, and we do not knowingly collect their data. Creators who work with minors are responsible for obtaining parental consent where the law requires it.
16. Governing Law
This Privacy Policy is governed by the laws of the State of Wyoming, USA, without regard to its conflict of law provisions. Where mandatory local data protection laws apply — including the GDPR for EEA residents and the UK GDPR for UK residents — those laws take precedence over this clause to the extent required.
17. Changes
We may update this policy as Merkora changes. We will post the new version here with a new effective date and, for significant changes, notify Creators by email or in the dashboard.
18. Contact
Merkora LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, USA
Privacy: [email protected]
General: [email protected]