Last updated: April 23, 2026
This Privacy Policy explains how Envision Media Holdings LLC ("Company", "we", "us", "our") collects, uses, discloses, and protects information in connection with Merlin ("the Software"). By using Merlin, you consent to the data practices described in this policy. If you do not agree, do not use the Software.
2.1 Information You Provide:
2.2 Information Collected Automatically:
Outside of the limited categories listed in Section 2 (license records, anonymous Wisdom metrics, error reports), the following categories never reach our long-term storage:
Shopify-specific note: When you install Merlin on a Shopify store, your encrypted Shopify Admin API access token is stored at rest in our Cloudflare D1 database (encrypted with AES-256-GCM, AAD-bound to the shop slug — see Section 8.2 for the full Shopify data flow). Order, product, and customer-summary data fetched from Shopify to render your dashboard is fetched live on each page load and not persisted; we do not maintain a copy of your store catalog or customer list on our servers.
For users in the European Economic Area (EEA), United Kingdom, or Switzerland, we process personal data under the following legal bases:
telemetry: false in your config file, or by emailing privacy@merlingotme.com.Data Processing Agreement (DPA): Enterprise customers requiring a DPA for GDPR compliance may request one by emailing legal@merlingotme.com.
Merlin's Wisdom system aggregates anonymous performance metrics from all users to provide better advertising recommendations. Participation is enabled by default and you may opt out at any time by setting telemetry: false in your config file. There is no consent prompt during onboarding; this section is the disclosure.
Merlin connects to third-party services on your behalf using credentials you explicitly authorize via OAuth or API key entry:
We do not sell, rent, or share your personal information with third parties for their marketing purposes. We share data only as described in this policy: with service providers (Stripe, Cloudflare) who process data on our behalf, and in response to valid legal process.
Merlin accesses data from your Google account only through OAuth 2.0 scopes that you explicitly authorize on the Google-hosted consent screen at accounts.google.com. The scopes Merlin may request, and the user data each scope authorizes Merlin to access on your behalf, are:
https://www.googleapis.com/auth/adwords) — to create and manage ad campaigns that you author inside Merlin, pull performance metrics (impressions, clicks, spend, CPA, ROAS) into your cross-platform dashboard, pause or duplicate campaigns on your command, and upload offline conversions from your own store back to your Google Ads account for bid optimization. Scoped to the Google Ads customer ID you select at setup; Merlin never reads or writes any account you have not explicitly linked.https://www.googleapis.com/auth/webmasters.readonly, read-only) — to query your own verified site's top search queries, pages, clicks, impressions, CTR, and average position so Merlin's SEO features can surface ranking gaps and content opportunities. Read-only; Merlin never submits sitemaps, changes site settings, or modifies any Search Console resource.https://www.googleapis.com/auth/content) — to sync your Shopify product catalog into the Google Merchant Center account you select, read product approval status and disapproval reasons so Merlin can surface "fix these issues to run Shopping ads" guidance, and pull Merchant Center performance insights into your dashboard. Scoped to the Merchant Center account you select at setup.https://www.googleapis.com/auth/tagmanager.readonly, tagmanager.edit.containers, tagmanager.edit.containerversions, tagmanager.publish) — to read the tags, triggers, and variables in the Tag Manager container you select so Merlin can diagnose broken conversion tracking (missing analytics configuration, duplicate conversion tags that double-count revenue, tags that can never fire, and tracking IDs that disagree with the rest of your setup); and, only for changes you explicitly approve in-app, to create tags, triggers, and variables in a separate Merlin workspace, snapshot that workspace as a container version, and publish it. Merlin never creates Custom HTML or Custom Image tags, which are the tag types that can execute arbitrary code on your site. Staged changes do not affect your live site until you separately approve publishing. Scoped to the container you select; Merlin never reads or writes a container you have not chosen.https://www.googleapis.com/auth/analytics.readonly, read-only) — to read traffic, conversion, attribution, landing-page, and real-time metrics from your GA4 properties via the GA4 Data API and Admin API, so Merlin's analytics features can surface organic-vs-paid splits, channel-level performance, key-event coverage, and on-site engagement signals. Read-only; Merlin never modifies key events, audiences, custom dimensions, custom metrics, or property settings under this scope. Scoped to the GA4 properties on the Google account you select at setup.Limited Use. Merlin's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
merlingotme.com/auth/callback so that the OAuth client secret never ships inside the desktop binary. Tokens returned by Google are passed through to your machine on a single request-response and are not persisted, cached, or logged by the Worker.Retention of Google user data. Data fetched from Google APIs is retained only for the duration required to deliver the feature you requested and to render it in the Merlin UI. Performance snapshots written to your local results/ folder (for example, dashboard JSON files) remain on your machine until you delete them and are never uploaded to our servers. Revoking Merlin's access on the Google side, or disconnecting Google inside Merlin, purges the locally stored Google OAuth tokens from your vault.
Revoking access. You can revoke Merlin's access to your Google account at any time by visiting myaccount.google.com/permissions and removing "Merlin", or by disconnecting Google from inside the Merlin application. Revocation through either path immediately invalidates Merlin's ability to make further Google API calls on your behalf.
Merlin accesses your Shopify store data only through OAuth 2.0 scopes that you explicitly authorize on the Shopify-hosted consent screen at {your-shop}.myshopify.com/admin/oauth/authorize. The web install flow that begins on the Shopify App Store grants Merlin only the read-only scopes required to render your dashboard:
read_analytics — to display your store's traffic and revenue trend on the dashboard.read_orders — to compute the 30-day revenue rollup, average order value, peak day, and top-product list shown on the dashboard. Only order financials (totals, dates, line items) are read — never customer names, emails, or addresses. Order data is fetched live and not persisted on our servers.read_products — to display product titles in the top-product table.If you also use the Merlin desktop application, additional scopes (write_products, read_content, write_content) may be requested separately when you trigger a feature that requires them (for example, publishing a blog post or updating a product description). Each request goes through Shopify's standard reconsent flow.
Storage and encryption. Your Shopify Admin API access token is stored at rest in our Cloudflare D1 database, encrypted with AES-256-GCM using a per-Worker secret key. The encrypted blob is bound to your shop slug via Authenticated Encryption with Associated Data (AAD), so a leaked ciphertext cannot be replayed under a different shop's identity. The dashboard session cookie that maps your browser to your install record is HttpOnly, Secure, SameSite=Lax, and rotates on a 30-day rolling expiry.
Data flow. When you load merlingotme.com/dash/{your-shop}, our server-side handler decrypts your token, calls the Shopify Admin API /shop.json and /orders.json endpoints (last 30 days, projected fields only), aggregates the result into the dashboard view, and renders the HTML. The fetched order, customer, and product data is held only for the lifetime of the request and discarded as soon as the response is sent. Your Shopify access token is never exposed to your browser; the dashboard makes no JavaScript Admin API calls.
Compliance webhooks. Merlin subscribes to all four Shopify-mandated webhook topics:
customers/data_request — Merlin does not persist Shopify customer data on our servers, so we acknowledge the request with an empty payload. Any customer data you have separately exported via Merlin desktop into your local results/ folder lives on your machine and is your responsibility to surface in response to a customer request.customers/redact — Same as above; we hold no customer data to redact.shop/redact — Fires 48 hours after a shop closes its Shopify account. We soft-delete the install record, wipe the encrypted token, and invalidate every active dashboard session for the shop within seconds of receipt.app/uninstalled — Fires immediately when a merchant uninstalls Merlin from their store. Same soft-delete + session-wipe behavior as shop/redact; the token is rendered unusable on our side within seconds.Every webhook is HMAC-SHA256 verified using SHOPIFY_CLIENT_SECRET with constant-time comparison. Webhooks lacking the X-Shopify-Hmac-Sha256 header, or carrying an invalid HMAC, are rejected with HTTP 401.
Disconnecting Merlin. Open your Shopify admin → Settings → Apps and sales channels → Merlin → Uninstall. Shopify revokes the access token immediately and fires our app/uninstalled webhook, which soft-deletes our install record. To remove your encrypted token entirely (instead of soft-deleting), email privacy@merlingotme.com with your shop slug.
Our servers (Cloudflare Workers) operate globally. By using Merlin, you consent to the transfer of anonymized telemetry data to servers that may be located outside your country of residence. All transfers are protected by TLS encryption and Cloudflare's security infrastructure.
Depending on your jurisdiction (including GDPR for EU/EEA residents and CCPA for California residents), you may have the right to:
To exercise any of these rights, email privacy@merlingotme.com. We will respond within 30 days (or sooner if required by applicable law).
Local data: Uninstall Merlin and delete the application folder (typically Documents/Merlin) to permanently remove all local data including credentials, brand data, generated content, and conversation history.
Server-side data: Use our self-service data deletion tool to instantly delete all server-side records associated with your Machine ID. This removes: license records, referral data, telemetry pings, and reverse indexes. For Stripe payment records, email privacy@merlingotme.com.
Merlin offers a referral program that provides additional free trial days (7 days per referral, up to 21 days maximum) and an affiliate program that provides recurring monetary commissions per active referred subscriber. These programs constitute "financial incentives" under the California Consumer Privacy Act. The value of the incentive is reasonably related to the value of the data provided (referral attribution). You may opt out of these programs at any time without penalty to your core subscription. Participation requires providing your email address and, for affiliates, Stripe Connect account information.
Merlin is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child under 18, we will promptly delete it. If you believe a child has provided us with personal information, contact privacy@merlingotme.com.
We implement commercially reasonable security measures including: encrypted credential storage (OS-level keychain via Electron safeStorage), HMAC-signed API payloads, TLS 1.3 encryption for all server communications, rate limiting, and access controls. However, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security.
We may update this Privacy Policy from time to time. Changes are effective when posted to this page. If we make material changes, we will notify you via the application or email. Continued use of the Software after changes constitutes acceptance of the updated policy.
For privacy inquiries: privacy@merlingotme.com
For general support: support@merlingotme.com
Envision Media Holdings LLC