Privacy policy

1. Who processes your data

The controller is MB Digitasodas, company code 305676811, registered address K. Čerbulėno g. 17-2, LT-47266 Kaunas, Lithuania (“Mervio”, “we”). For anything about personal data, write to info@mervio.lt.

This policy covers the Mervio website mervio.lt, its forms and Mervio accounts (merchants, their team members and partners). It does not cover the shops that run on the Mervio platform: each shop is the controller of its customers’ and visitors’ data and publishes its own privacy policy, while Mervio processes that data only on the shop’s behalf under the data processing agreement.

2. What data we process and why

• Contact and partner forms. Your name, email, phone and company (if given), website or portfolio (in a partner application), message, the page you wrote from, campaign tags (UTM) in the link, IP address and browser information. Purpose: to answer your question or application and to protect the forms from abuse. Legal basis: our and your legitimate interest in communicating, and steps before entering into a contract when you ask about Mervio services (GDPR Art. 6(1)(b) and (f)). We keep it while we are in touch and no longer than 2 years after the last contact.
• Reports of illegal content. The link, type of violation, explanation, your name and email (optional for reports of child sexual abuse material), language, IP address and browser information. Purpose: to review the report and tell you about the decision, as required by the Digital Services Act (Regulation (EU) 2022/2065). Legal basis: legal obligation (GDPR Art. 6(1)(c)). We do not pass your name and email to the seller unless it is necessary to prove the violation. We keep reports while they are reviewed and for 3 more years for possible complaints and requests from authorities.
• Mervio account and subscription. Name, email, password (hashed only), two-factor authentication data, company details and VAT number, shop settings, subscription plan, invoices and payment history, acceptance of the terms of service, activity logs and support requests. Purpose: to provide the service, issue invoices and keep the account secure. Legal basis: performance of the contract and legal obligation (GDPR Art. 6(1)(b) and (c)). We keep account data while the account is active and accounting documents for 10 years, as required by Lithuanian accounting law. If you sign in with Google, we receive your name and email from Google.
• Consent and source at sign-up. If you accepted statistics or marketing cookies, when you sign up we store the time and version of your consent and the source of your visit with your account. We use this data to measure how well our ads work and pass it to Meta and Google only encrypted. If you withdraw your consent, it is deleted.
• AI brand generator. If you generate a logo with AI in the shop settings, we send the shop name and your wizard answers (business, mood, colours, notes) to OpenRouter, which passes them to an AI model (currently Anthropic’s Claude; OpenAI or Google models may be used later) to suggest logos and brand texts. Do not enter personal data in the wizard. The data is not used to train models. Purpose: to create a brand at your request. Legal basis: performance of the contract (GDPR Art. 6(1)(b)). We keep the results with the shop while it is active.
• AI texts and translations. If you generate SEO texts or translate content with AI, we send the texts of products, collections, pages and articles, the shop and brand names and, when translating, product parameters and photos to OpenRouter, which passes them to an AI model (currently OpenAI; Anthropic or Google models may be used later) to suggest texts or translations. Do not put personal data in these texts and photos. The data is not used to train models. Purpose: to create or translate text at your request. Legal basis: performance of the contract (GDPR Art. 6(1)(b)). We keep the results with the shop content until you delete it or the shop closes.
• Partner links. If you arrive through a partner link (?via=…), your browser stores the partner’s code so that a shop opened later is attributed to that partner. Clicks are counted only as a daily total, without any data about you. Legal basis: legitimate interest in calculating partner commissions.
• How you heard about Mervio. When signing up you can (optionally) choose how you heard about Mervio and, if you pick “Other”, describe it in your own words. We store the answer with your account and use it only for aggregate statistics on which channels bring new customers. No cookies are involved. Legal basis: our legitimate interest in improving the service and its marketing; the answer is deleted together with your account.
• Technical logs. The server records the time, address, IP address and browser information of each request. They are needed for security and fixing errors (legitimate interest). Logs are kept briefly and overwritten automatically.
• Visitor country. The server looks up the country of your IP address in the MaxMind GeoLite2 database stored on our own server: your IP address is not sent to MaxMind. The country is used only when a shop restricts access by country, and it is not stored.

• Visit statistics. Only with your consent, Google Analytics counts how many visitors come, from where and which pages they view (page address, referrer, approximate location from the IP address, device, browser, a random visitor identifier). Purpose: improving the website. Legal basis: consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with the "Cookie settings" link in the footer. Google Analytics keeps the data for 14 months.
• Ad measurement. Only with your consent, Google and Meta (Facebook, Instagram) tags record that you came from our ad and whether you wrote to us, signed up, started a free trial or subscribed to a paid plan (with the plan amount), so we can measure our ads and show Mervio ads to people who have visited the website. Sign-up and payment happen outside the website, so we send these events from our server (Meta Conversions API, Google Analytics Measurement Protocol) together with the ad tags' browser identifiers, the IP address, browser information and a hash of your email address (SHA-256, not the address itself). For this we keep that data with the shop at sign-up, only if you consented. If a server event fails to send, we keep it with this data, encrypted, for up to 7 days so we can retry it, and then delete it. Our log of sent events (without this data: only the event name, time and amount) is kept for 30 days. Legal basis: consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with the "Cookie settings" link in the footer.

We do not make automated decisions with legal effects on you.

3. Cookies

Necessary cookies are needed for the website to work, so we do not ask for consent to them. Statistics and marketing cookies are set only after you accept them in the cookie banner; you can change or withdraw your consent at any time with the "Cookie settings" link in the footer.

You can delete cookies in your browser settings; without the session cookie the forms and sign-in will not work.

4. Who receives the data

We do not sell data. It is processed only by service providers bound by data processing agreements:

We may also disclose data to public authorities when the law requires it and, for reports of illegal content, to the shop when the violation cannot be reviewed otherwise.

5. Your rights

You can ask to access, correct, erase, restrict or port your data, and object to processing based on legitimate interest. Write to info@mervio.lt and we will reply within 30 days. You can view and change your account data yourself in the account settings. You also have the right to lodge a complaint with the State Data Protection Inspectorate of Lithuania (L. Sapiegos g. 17, Vilnius, vdai.lrv.lt).

6. Changes

If our processing changes, we will update this policy and the date at the top. We will email Mervio account holders about material changes.

7. Third-party data

This product includes GeoLite2 Data created by MaxMind, available from https://www.maxmind.com.