Merchshot

Privacy Policy

Effective 24 September 2026

Merchshot turns photos of your products into studio photos. This policy explains what we collect, why, who processes it and how to delete it. We don’t sell your data and we don’t track you for advertising.

The short version

What we collect

DataWhyKept
Account identifier and email address from Sign in with Apple (this may be an Apple private relay address)To give you an account that holds your photo balance and shootsUntil you delete your account
Product photos you confirm for a shoot, your notes and any brand details you addTo create the images you asked forUntil you delete them or your account
Images created for youTo deliver your results to your devicesUntil you delete them or your account
Photo balance, shoot history and purchase records (product, transaction ID, time, amount)To keep an accurate balance, refund failed shoots and handle App Store refundsFor as long as required for accounting and tax, even after account deletion, without your photos
Product analytics (on by default; you can turn it off): which features are used and whether they workTo improve the appUp to 12 months

We don’t collect your location, contacts, browsing history or advertising identifiers. Photos are re-encoded before upload, which removes location and camera metadata. The originals on your iPhone are never changed.

Photos that never leave your iPhone

Your product library, drafts, capture checks, label reading, product-name suggestions, background removal, resizing and store kits all run on your device. Merchshot has no copy of these unless you confirm a shoot.

Who processes your data

ServiceWhat it does
OpenAICreates your images from the photos you confirm. OpenAI may keep API data for up to 30 days to monitor abuse and does not use it to train its models.
Supabase (United States)Hosts your account, balance and privately stored photos.
Apple and RevenueCatProcess App Store purchases. We never see your payment details.
PostHog (United States)Product analytics, unless you turn it off.

Your choices and rights

Security

Data travels over encrypted connections. Uploaded photos are stored in a private bucket that only our service can read, and results are delivered only to the account that created them. AI provider keys live on our server, never in the app.

Children

Merchshot is a business tool and isn’t directed at children under 13. We don’t knowingly collect their data.

Changes

If we change this policy in a way that affects how your data is used, we’ll update the date above and tell you in the app.

Contact

Questions or requests: support@businessflowstudio.com