Privacy Policy
We respect your privacy. This policy explains what data we collect, how we use it, and the controls you have over it.
This Privacy Policy describes how Merkora LLC ("Merkora", "we", "us", "our"), a company incorporated in Wyoming, USA, collects, uses, and protects the personal information of users of the Merkora platform at merkora.app. By using Merkora, you agree to the collection and use of information in accordance with this policy. This policy applies to all users globally — practitioners who create accounts to offer services, and clients who book or purchase those services.
1. Who We Are
Merkora is operated by Merkora LLC, a company incorporated in Wyoming, USA. We provide an online practice platform that enables coaches, therapists, consultants, and other practitioners to offer bookings, courses, live events, and digital products to their clients.
- Legal entity: Merkora LLC
- Registered state: Wyoming, USA
- Contact: [email protected]
- Platform: merkora.app
- For the purposes of the GDPR and applicable data protection laws, Merkora LLC is the data controller of personal data collected through the platform.
2. Information We Collect
a) Information you provide
- Account information: name, email address, profile photo, bio, and timezone when you register.
- Creator information: service descriptions, pricing, availability schedules, cancellation policies, and any content you publish on your page.
- Booking information: session details, attendee notes, questionnaire responses, and location preferences submitted during booking.
- Communication: messages, support requests, and feedback you send to us.
b) Information collected automatically
- Usage data: pages visited, features used, session duration, and actions taken within the platform.
- Device information: browser type, operating system, IP address, and device identifiers.
- Cookies and similar technologies: session tokens, preference cookies, and analytics identifiers. See our Cookies section below.
c) Information from third parties
- Payment data: Merkora uses Stripe Connect for payment processing. Stripe collects and processes all payment card information directly. Merkora does not store card numbers, CVV codes, or bank account details.
- Live streaming data: Stream.io processes participant data during live events to enable video and audio functionality.
- File storage: UploadThing and Cloudflare R2 store files you upload (images, videos, digital products).
3. Legal Basis for Processing
We process your personal data on the following legal bases under Article 6 of the GDPR:
- Performance of a contract (Art. 6(1)(b)): processing your account data, delivering bookings, sending booking confirmations and reminders, processing payments, and providing platform features you have requested.
- Legitimate interests (Art. 6(1)(f)): platform security, fraud prevention, abuse detection, improving service reliability, and providing creators with aggregated analytics about their page performance. We balance these interests against your rights and will not override them.
- Legal obligation (Art. 6(1)(c)): retaining financial and transaction records as required by applicable accounting, tax, and legal regulations.
- Consent (Art. 6(1)(a)): where we rely on consent (such as non-essential cookies or marketing communications), you may withdraw it at any time without affecting the lawfulness of prior processing.
4. How We Use Your Information
We use the information we collect to:
- Operate and deliver the Merkora platform — including bookings, scheduling, payments, live events, courses, and digital product sales.
- Send transactional emails: booking confirmations, cancellation notices, reschedule notifications, session reminders, and payment receipts.
- Share booking details between creators and clients so both parties have the information they need for a session.
- Provide creators with analytics about their page, bookings, and revenue.
- Respond to support requests and communicate platform updates.
- Detect and prevent fraud, abuse, or violations of our Terms of Service.
- Comply with legal obligations.
5. How We Share Your Information
We do not sell your personal data. We share information only in the following circumstances:
- Between creators and clients: when a booking is made, the creator receives the client's name, email, and any booking notes. The client receives the creator's contact details and session information.
- Service providers: we share data with Stripe (payments), Stream.io (live streaming), UploadThing and Cloudflare R2 (file storage), and email delivery providers, solely to operate the platform.
- Legal requirements: we may disclose data when required by law, court order, or to protect the safety of users or the public.
- Business transfers: in the event of a merger, acquisition, or sale of assets, user data may be transferred as part of that transaction. We will notify users before any such transfer.
6. International Data Transfers
Merkora LLC is based in the United States. Our service providers — including Stripe, Stream.io, Cloudflare, and UploadThing — are also US-based companies. This means your personal data may be transferred to and processed in the United States and other countries outside your own.
- When we transfer personal data from the European Economic Area (EEA), United Kingdom, or other jurisdictions with data transfer restrictions, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission.
- Stripe processes payment data under its own data transfer mechanisms and is certified under applicable frameworks. See stripe.com/privacy.
- Stream.io, Cloudflare, and UploadThing each maintain their own data processing agreements and transfer mechanisms. Links to their privacy policies are in the Third-Party Services section.
- By using Merkora, you acknowledge that your data may be transferred internationally. We take steps to ensure that appropriate protections are in place wherever your data is processed.
7. Payment Data & Stripe Connect
Merkora uses Stripe Connect for payment processing. Stripe integration is currently being finalized — payment features will be available soon. Once active, this has important privacy implications:
- Clients' payment card data is entered directly on Stripe's secure checkout page. Merkora never sees or stores card numbers, expiry dates, or CVV codes.
- Creators connect their own Stripe account to receive payouts. Stripe's Privacy Policy governs the handling of your Stripe account data.
- Merkora stores payment records including transaction amounts, timestamps, booking references, and payment status — but not raw card data.
- For disputes, refunds, or payout questions, Stripe is the primary point of contact for payment data. Merkora can assist with platform-level records.
8. Cookies
Merkora uses cookies and similar technologies for the following purposes:
- Necessary cookies: session authentication tokens required to keep you logged in. These cannot be disabled without breaking core platform functionality.
- Preference cookies: to remember your settings such as timezone and display preferences.
- Analytics cookies: to understand how users interact with the platform and improve the experience. Analytics data is aggregated and not linked to individual identities.
- You can control cookie preferences through your browser settings or through our cookie consent panel. Disabling non-essential cookies will not prevent you from using the platform.
9. Data Retention
We retain your data for as long as your account is active or as needed to provide the service:
- Account data is retained while your account is open. When you close your account, we delete or anonymize your personal data within 90 days, except where retention is required by law.
- Booking records and payment records may be retained for up to 7 years for accounting, legal, and tax compliance purposes.
- Content you have deleted (courses, services, digital products) is removed from public view immediately and from our storage within 30 days.
10. Your Rights
Depending on your location, you may have the following rights regarding your personal data. EEA and UK residents have these rights under the GDPR and UK GDPR respectively:
- Access (Art. 15 GDPR): request a copy of the personal data we hold about you.
- Correction (Art. 16 GDPR): request that we correct inaccurate or incomplete data.
- Deletion (Art. 17 GDPR): request that we delete your personal data, subject to legal retention requirements.
- Restriction (Art. 18 GDPR): request that we restrict processing of your data in certain circumstances.
- Objection (Art. 21 GDPR): object to our processing of your data based on legitimate interests.
- Portability (Art. 20 GDPR): request your data in a structured, machine-readable format.
- Withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
- Lodge a complaint: you have the right to lodge a complaint with your local data protection supervisory authority. EEA residents may contact the supervisory authority in their EU member state. UK residents may contact the Information Commissioner's Office (ico.org.uk).
- To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.
11. Data Security
We take reasonable technical and organizational measures to protect your data, including:
- HTTPS encryption for all data in transit.
- Secure, access-controlled database infrastructure.
- Payment processing handled entirely by Stripe's PCI-compliant infrastructure — Merkora never processes raw card data.
- Regular security reviews and access controls for internal systems.
- No security system is impenetrable. In the event of a data breach that affects your rights, we will notify you and relevant authorities as required by applicable law.
12. Third-Party Services
Merkora integrates with third-party services to deliver platform functionality. Each service has its own privacy policy:
- Stripe — payment processing and Stripe Connect for creator payouts. stripe.com/privacy
- Stream.io — live video streaming infrastructure for events and sessions. getstream.io/privacy
- Cloudflare R2 — video and file storage. cloudflare.com/privacypolicy
- UploadThing — image and file upload handling. uploadthing.com/privacy
- Merkora is not responsible for the privacy practices of these third-party services.
13. Children's Privacy
Merkora is not directed to children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us at [email protected] and we will delete it promptly.
14. Governing Law
This Privacy Policy is governed by the laws of the State of Wyoming, USA, without regard to its conflict of law provisions. Where mandatory local data protection laws apply — including the GDPR for EEA residents and the UK GDPR for UK residents — those laws take precedence over this clause to the extent required.
15. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by displaying a notice on the platform before the changes take effect. The updated policy will include a new effective date. Your continued use of Merkora after changes are posted constitutes your acceptance of the revised policy.