Privacy Policy
This Privacy Policy explains how xMerch collects, uses, and shares information when you browse, purchase, or sell products on our marketplace. We use Web3 rails for settlement and may integrate third-party on/off-ramp providers such as MoonPay.
We collect account, order, wallet, and device data to operate the marketplace and deliver orders.
On/off-ramp services (for example, MoonPay) are provided by third parties with their own privacy policies and compliance requirements.
Delete your account yourself in Account > Profile, reply STOP to stop Instagram messages, or contact us to access or correct your information.
1. Who We Are
xMerch is a marketplace that connects buyers and independent vendors. We facilitate ordering, payment, and settlement, but vendors are responsible for the products they sell and fulfill.
2. Information We Collect
- Account data if you create an xMerch account: your sign-in email, an optional name, a saved shipping address, linked wallet addresses, and your marketing email choice (see section 8).
- Instagram data if you comment our keyword on an @xmerch.app post or message @xmerch.app: your Instagram username and the comments and messages exchanged with us (see section 9).
- Order and fulfillment data, including shipping address, items purchased, order status, and communications with vendors.
- Wallet and blockchain data, including public wallet addresses and transaction hashes used for settlement.
- Device and usage data, such as IP address, browser type, pages viewed, and analytics events.
3. Information From Third Parties
We may receive information from vendors, payment processors, on/off-ramp providers, analytics partners, and logistics services to fulfill orders, prevent fraud, and comply with legal obligations. For example, on/off-ramp providers may share verification status or transaction confirmations with us.
4. How We Use Information
- Provide and improve the marketplace experience.
- Process orders, settlement, and customer support requests.
- Detect and prevent fraud, abuse, or prohibited activity.
- Comply with legal and regulatory requirements.
- Send transactional messages about orders and important updates.
5. How We Share Information
- Vendors: we share order and shipping details with vendors so they can fulfill purchases.
- Vendor services: if a vendor directs you to their own site or support channels, their privacy policies apply to information you provide there.
- Service providers: we use vendors for hosting, analytics, customer support, and email delivery.
- AI services: replies to Instagram messages may be drafted with OpenAI. A person at xMerch reviews every reply before it is sent.
- Meta: messages sent through Instagram are processed by Meta under its own privacy policy.
- Payment and on/off-ramp providers: if you use MoonPay or similar services, they collect and process information under their own policies.
- Legal compliance: we may share data to comply with law, enforce policies, or protect rights and safety.
6. Web3 Settlement & Blockchain Data
Blockchain transactions are public by design. Wallet addresses and transaction hashes may be visible on public block explorers. We do not control blockchain networks and cannot delete or modify on-chain data.
7. Cookies & Analytics
We use cookies and similar technologies to remember preferences, understand usage, and improve the experience. We use Google Analytics to measure site usage; analytics cookies are on by default, and you can decline them at any time via the consent banner on your first visit. You can also control cookies through your browser settings.
8. Your xMerch Account and Deleting It
Your account holds your sign-in email (or wallet), an optional name, a saved shipping address, linked wallets, your marketing email choice (off unless you turn it on), and your order history.
To delete your account: go toxmerch.app/account/profileand choose Delete account. We email a 6-digit code to your sign-in email (accounts that use only a wallet type DELETE instead), then choose Delete my account. You are signed out on every device. You can't delete your account while an order is still open or under review; once it has shipped or closed you can, or contact us.
Deleted right away: your login, name, email address, saved shipping address and marketing choice.
What we keep, and why: records of orders you placed (items, amounts, the name and shipping address used for each order, your wallet address and transaction hashes). Only xMerch staff can see them. We keep them for 10 years for accounting and tax, refunds and disputes, and fraud prevention, then delete them. Vendors who fulfilled your orders received the shipping details for those orders and keep their own records. Reviews you posted stay published under the display name you chose; contact us to remove one. Blockchain transactions are public and can't be deleted (section 6).
9. Instagram Messages
We only message people who contact us first: by commenting our keyword (for example FOUNDERZ) on an @xmerch.app post, or by sending @xmerch.app a direct message. We never message people who haven't contacted us, and we don't buy or use contact lists.
- When you comment the keyword, you get one direct message with the information you asked for and a short reply under your comment. If you write back, xMerch replies; replies may be drafted with an AI service and a person reviews each one before it is sent.
- We store your Instagram username, the ID Instagram gives you for our account, the comments and messages exchanged with @xmerch.app, which post you commented on, and when. The link in our message tells us which post it came from, so we can see which posts lead to sign-ups.
- We don't sell this information, share it with vendors, or use it for advertising.
- To stop and delete: reply STOP (or "unsubscribe") in the chat. We send one confirmation, then delete our copy of the conversation and everything we stored with it, and we won't message you again unless you comment the keyword on a post later. You can also emailsupport@xmerch.appwith your Instagram username and we'll delete it.
- Conversations with no activity for 12 months are deleted automatically.
- Instagram keeps its own copy of the chat in your inbox under Meta's privacy policy; we can't delete that copy.
10. Data Retention
- Instagram conversations: deleted when you reply STOP, or after 12 months without activity (section 9).
- Deleted accounts: order records are kept for 10 years, then deleted (section 8).
- Vendor and partner dashboard security log: one year (section 11).
- Everything else: as long as needed to provide the service, comply with legal obligations, resolve disputes, and enforce agreements.
11. Security
We use reasonable administrative, technical, and physical safeguards to protect your information. No system is perfectly secure, and we cannot guarantee absolute security.
Vendor and partner dashboard (admin.xmerch.app): to protect stores, we keep a security log of sign-ins and changes made in the dashboard, including the wallet address, the time, and for sign-ins the IP address and browser. Store owners can see their own store's log. We keep it for one year.
12. Your Privacy Choices
You can delete your account yourself (section 8), turn marketing emails off in Account > Profile, and stop Instagram messages by replying STOP (section 9). You may also ask us for access to, or correction or deletion of, your personal information. We may need to keep certain data to comply with legal obligations or to complete transactions.
13. Children
xMerch is not intended for children under 18. We do not knowingly collect personal information from children.
14. International Transfers
Your information may be processed in countries other than where you live. We take steps to protect data in accordance with applicable law.
15. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be posted on this page with a new effective date.
16. Contact Us
Questions or requests? Contact us at support@xmerch.app.