Privacy policy

This page describes what Merchmint collects, where it goes, and what it never receives. Every statement was checked against the shipping code rather than against intent. Where a limitation exists, it is stated plainly instead of softened.

§1 Summary

Merchmint automates your own Google Flow account at labs.google/fx. You sign in to Flow yourself; Merchmint queues your prompts and submits them through that session, exactly as if you had clicked Generate yourself, then upscales and saves the results. It provides no AI generation of its own and gives you no access your Google account does not already have.

§2 What we collect

Information from signing in with Google

When you sign in we receive your email address, display name and profile picture URL from Google's userinfo endpoint. We store these to identify the account your subscription belongs to, so your plan follows you across devices. We also store Google's stable account identifier (the sub claim), because email addresses can change or be reassigned.

We also receive a Google OAuth access token. It is kept in your browser's extension storage and used as the credential for Merchmint's own API. Every request our backend receives is re-verified with Google before it is answered, which means Google sees a verification call for that token. The token is short-lived and no refresh token is ever issued or stored. Signing out asks Google to revoke it; see §10 for what happens if that call does not succeed.

We never receive or store your Google password.

Google OAuth scopes and Limited Use

Signing in requests exactly two Google OAuth scopes: https://www.googleapis.com/auth/userinfo.email and https://www.googleapis.com/auth/userinfo.profile. We request nothing beyond your email address, name and profile picture — no Drive, no Calendar, no Gmail, no contacts.

Merchmint's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements:

• Allowed use: we use this data only to authenticate you, operate your Merchmint account, and tie your subscription to your Google account.
• Allowed transfer: we don't transfer it except to the service providers named in §7, as needed to run Merchmint, or when required by law.
• No advertising: we never use it to serve ads of any kind, personalized or otherwise.
• No human reading, except (a) with your explicit consent, such as when you contact support, (b) for security investigations, (c) to comply with the law, or (d) in aggregated, anonymized form for internal operations.

Device fingerprint

We generate a device fingerprint and send it to our servers when you register, when your plan is checked, and each time a batch is authorised. It is stored against your account and copied onto each batch record. It is built from exactly these characteristics, joined into one string:

• the number of logical processor cores your browser reports
• your screen's device pixel ratio and colour depth
• the maximum number of touch points your device supports
• your operating-system family, derived from the user-agent string — one of Windows, Mac, Linux, ChromeOS, Android, or unknown
• your IANA time zone name (for example Europe/Berlin)
• a canvas rendering hash: we draw text and shapes on a small off-screen 200×50 pixel canvas and hash the result. Different hardware and drivers produce subtly different pixels, so this hash tends to be stable for one machine and different across machines
• your graphics hardware: the WebGL unmasked vendor and renderer strings, plus two capability limits — maximum texture size and maximum renderbuffer size

We use this for one purpose: detecting abuse of the free tier through duplicate accounts. It is not used for advertising, not used for tracking you across websites, and not combined with data from anywhere else to build a profile.

Batch information

Each time you start a batch, we send and store:

• the number of prompts, and whether it is an image or video batch
• the configuration as counts and fixed option names only: model, aspect ratio, images or videos per prompt, video mode and quality, reference mode, how many reference images are attached, whether start and end frames are set, download quality, and speed mode
• which optional features this installation has used — reference mapper, chaining, image library, video mode, onboarding tour — plus the number of items in your library and queue
• your extension version, operating-system family, browser language, and your Google AI plan tier where the extension can determine it
• the device fingerprint described above

Reference images are reduced to a count before this is sent. The identifiers of your media are deliberately excluded, because sending them would let the backend correlate which assets belong to which user.

Starting a batch reserves its prompts against your daily allowance up front. When the batch finishes, the extension reports how many prompts succeeded and how many failed, and the unused reservation is refunded, so only work that actually produced something is counted. The report also transmits diagnostic values (timings, a histogram of error categories, rate-limit counters, and the single most common error message) which our server reads and discards without storing; the only fields kept are the batch identifier and the success and failure counts.

Those error messages originate from Google's own responses. Before they leave your browser they are truncated to 500 characters and passed through a filter that strips anything token-shaped: Bearer values, access_token=, id_token= and token= parameters, Google ya29. tokens, and long base64 runs.

§3 Product analytics

We send an event to our servers when you use certain features. The server accepts exactly eighteen event names and silently discards anything else:

session_start · onboarding_step · upgrade_modal_opened · checkout_started · checkout_completed · checkout_abandoned · limit_reached · mapper_action · library_auto_tag · single_prompt_toggled · animate_flow_started · download_zip · announcement_viewed · announcement_clicked · announcement_dismissed · fix_unusual_modal_opened · clear_data_page_opened · stale_references_modal_opened

Each event carries your account, your extension version, and a small payload. Across all twenty-nine places in the extension that send an event, those payloads contain only counts, durations in milliseconds, true/false flags, fixed option names, your current plan name, and announcement identifiers. Examples: how many prompts and images were involved in a reference-mapping action; how many files and bytes a ZIP export contained; how long a checkout page stayed open; which step of the onboarding tour you reached. No prompt text, no filenames, no image data and no URLs are included in any of them.

§4 What we never receive

Specifics, because a general reassurance is worth nothing:

• Your prompts never reach our servers. Prompt text goes from your browser to Google and only to Google. No Merchmint API endpoint has a field that carries prompt text. Our endpoints receive: your display name and picture URL; the fingerprint; a prompt count, a mode and the settings summary above; success and failure counts; an analytics event name with its small payload; your extension version, operating-system family, browser language and Google AI tier; and — because these are ordinary HTTPS requests — your IP address and browser user-agent string, which our hosting provider receives and may log.
• Your images and videos never reach our servers, whether uploaded as references or generated as results. They exist between your browser and Google. Our servers never receive image bytes, media identifiers, or media URLs.
• We do not read the web pages you visit. Merchmint's content scripts run only on Google Flow pages. Nothing is injected into, read from, or observed on any other site.
• On Flow pages we wrap the page's own network calls so we can see the responses to five named Flow API calls, and pick out the identifiers of media you just generated — so a finished generation is never silently missed. One of those responses, the workflow-state call, includes your prompt text in its body. All of this is read inside your browser and none of it is transmitted to us. No page DOM, form field or cookie is read, and upscale responses, reCAPTCHA traffic and CDN requests are excluded.
• We do not access your browsing history, cookies, saved passwords or location. No geolocation is ever requested; the time zone in the fingerprint is the only location-adjacent value we hold.
• We never see your payment details. Card entry happens entirely on Stripe's pages.

§5 Stored on your device

Your settings, prompt queue, batch history, gallery index, reference-image library and a handful of one-time interface flags are stored in Chrome's extension storage on your device — 32 named keys in total. Only this extension can read them.

This data is not synced to your Google account and not uploaded to us. Merchmint uses no browser cookies, no localStorage, no IndexedDB, and no Chrome sync storage.

• Reference images are kept as small JPEG thumbnails only — 120 pixels on the longest edge for the image library, 30 pixels for the reference mapper. The full-size files you selected are not stored.
• The gallery index records media identifiers, URLs, the first 60 characters of the prompt as a label, and — where you used the reference mapper — the same small JPEG reference thumbnails described above, so the gallery can show which references produced which result. It stores no generated image or video data. Your generated files go to your Downloads folder and belong to you.

§6 Permissions and why each is needed

§7 Who we share data with

When you click Manage Subscription, our server asks Stripe for a one-time billing-portal link for your customer record and opens it. We store Stripe's customer and subscription identifiers, the subscription status, the current period end date, and whether it is set to cancel. We do not store card numbers, card brands, expiry dates or billing addresses — Stripe holds those.

We do not sell your data. We do not share it with advertisers, data brokers, ad networks or third-party analytics services. There are no third-party trackers in the extension. We do not use your data for creditworthiness or lending decisions.

§8 Where your data is stored

Merchmint's backend runs on Supabase in the ap-northeast-2 region — Seoul, South Korea. Our API functions and our database both run there. All account data, device fingerprints, batch records, subscription records and analytics events are stored in that region.

Payment data held by Stripe is stored on Stripe's own infrastructure under Stripe's terms, not ours.

If you are in the European Economic Area or the United Kingdom, this means your personal data is transferred outside your region to South Korea. Both the European Commission and the UK government have separately recognised South Korea as providing an adequate level of data protection — the European Commission's adequacy decision took effect on 17 December 2021, and the UK's own Data Protection (Adequacy) (Republic of Korea) Regulations 2022 took effect on 19 December 2022. Because of these adequacy decisions, this transfer does not require Standard Contractual Clauses or any additional safeguard — it is treated the same as a transfer within the EEA or UK.

§9 How long we keep it

Stated honestly, because the alternative is to invent a number:

• On your device: until you delete it or uninstall the extension. Uninstalling a Chrome extension removes its storage.
• On our servers: there is currently no automatic deletion job. No scheduled process removes account records, batch records or analytics events on its own — the only scheduled job we run releases quota holds on batches that were never reported, and it deletes no data. Instead, retention is a manual commitment: while your account is active we keep your account, batch and analytics records so the product can function. If you close your account or ask us to delete your data (§10), we manually delete your personally identifying records — email, name, picture, device fingerprint, and any data that directly identifies you — within 30 days of a verified request. Records specifically tied to a suspended account for abuse prevention (device fingerprint, coarse account signals) may be kept longer, for up to 12 months after suspension, solely to stop the same abuse recurring under a new account.
• The Google access token: short-lived by design, and revoked at Google the moment you sign out.
• Analytics after account deletion: if your account record is deleted, your analytics events are not deleted with it. They are detached from your account so they can no longer be linked to you, and the anonymous rows remain for aggregate counts.

§10 Your choices

§11 If you are in the EEA or the UK

You have the rights of access, rectification, erasure, restriction of processing, data portability and objection under the UK and EU GDPR, and the right to lodge a complaint with your supervisory authority.

If you object to processing based on legitimate interests, email contact@sellersuit.com. Be aware of the practical consequence: the fingerprint is sent as part of the call that authorises every batch, so it cannot be switched off for an active account without preventing generation.

International transfer: your data is stored in South Korea, outside the EEA and the UK, as described in §8. This transfer relies on the European Commission's and the UK's respective adequacy decisions for South Korea (see §8) rather than Standard Contractual Clauses.

Representative: Merchmint is operated by a single individual at a small scale, and no separate Article 27 EU representative or UK representative has been appointed. If you are in the EEA or UK, you can still exercise any of the rights on this page, or raise a question, by contacting us directly at the address below, or by contacting your local supervisory authority.

§12 If you are in California

You have the rights of access, deletion, correction, and to know what personal information is collected and to whom it is disclosed, under the CCPA as amended by the CPRA. Exercise them at contact@sellersuit.com.

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined. We do not use or disclose sensitive personal information for purposes beyond those permitted without an opt-out right.

§13 Children

Merchmint is not directed at children under 13, or under 16 in the EEA, and we do not knowingly collect their personal data. If you believe a child has created an account, email contact@sellersuit.com and we will delete it.

§14 Security

• All traffic between the extension, our backend, Google and Stripe is over HTTPS. Every URL this build ships with is https. The start-up check reports a non-https backend or checkout URL as a configuration error in the extension's console; it does not block the extension from running.
• Our database has row-level security enabled and forced on every table with no permissive policies at all, so no browser-held key can read any row. The API is the only way in.
• Diagnostic error strings are stripped of anything token-shaped before they leave your browser.
• The extension loads no remote code. Its content security policy allows scripts only from the extension package itself.
• Local data lives in Chrome's extension storage, readable only by this extension.

No system is perfectly secure and we do not claim otherwise.

§15 Changes to this policy

If we make a material change we will update this page and the date at the top. Continuing to use Merchmint after a change means you accept it.

Contact: contact@sellersuit.com · Facebook · Telegram
Postal address: MD Abdullah Al Muti, Badulghata, Ward-09, Manda, Kushumba-6510, Naogaon-6510, Bangladesh