Privacy Policy

Effective and last updated: July 28, 2026

This Privacy Policy explains how Mivaro Labs LLC, which provides Merchant Command, collects, uses, discloses, retains, and protects Personal Information. It also explains privacy choices and rights. By using Merchant Command, you acknowledge the practices described in this Policy.

1. Scope and Our Roles

This Privacy Policy applies to Merchant Command's websites at www.merchantcommand.com and app.merchantcommand.com, the Merchant Command application, and related services that link to this Policy. It does not apply to a third-party website, application, AI provider, or Connected Service that has its own privacy policy.

The Service is currently offered to United States businesses and is not intended for personal, family, or household use. Individual account users may nevertheless have privacy rights under applicable law.

Our role depends on the information involved:

For account registration, website use, billing, support, security, and our direct business relationship, Mivaro generally determines why and how Personal Information is processed.
For information that a Customer imports from Shopify or another Connected Service, or directs Merchant Command to process through an agent, Mivaro generally acts as the Customer's processor or service provider. The Customer determines the purpose of that processing and is responsible for notices, consents, instructions, and responses to its customers.

If you are an end customer, employee, or other individual whose information was placed in Merchant Command by one of our Customers, please direct your privacy request to that Customer. We will assist the Customer as required by law and our contract.

2. Personal Information We Collect

Personal Information means information that identifies, relates to, describes, can reasonably be linked with, or could reasonably be linked with an individual or household. Depending on how the Service is configured, we may collect the following categories.

2.1 Account and business information

We collect information such as name, work email address, company name, job title, business address, store URL, account role, team membership, login information, and account preferences. We may collect a phone number or other contact details if you provide them.

2.2 Customer Content and agent interactions

We process prompts, chats, instructions, uploaded files, images, spreadsheets, documents, agent configurations, workflow settings, approvals, feedback, outputs, and other content submitted to or generated through the Service.

We may record material agent activity, including data accessed, tool calls, proposed actions, approvals, pre-authorizations, completed actions, changes, actors, timestamps, errors, and related audit information.

2.3 Connected Service data

When a Customer connects Shopify or another service, we may collect or process information made available through the granted scopes. Depending on the connection and Customer's instructions, this may include:

store, account, and organization information;
products, listings, descriptions, images, variants, pricing, discounts, and inventory;
orders, draft orders, abandoned checkouts, returns, refunds, fulfillment, shipping, and transaction status;
customer and prospect names, email addresses, phone numbers, shipping and billing addresses, order histories, preferences, and communications;
advertising, campaign, analytics, conversion, attribution, and website-performance data;
email, SMS, support, review, and customer-service information; and
other business and operational data available through the relevant API.

Merchant Command does not need or intend to receive full payment-card numbers through Shopify or other Connected Services. Payment status, transaction identifiers, limited payment metadata, or masked payment details may be available through an integration.

2.4 Connection credentials and secrets

To authenticate Connected Services, we or an integration provider may collect and store OAuth tokens, API keys, access tokens, refresh tokens, webhook secrets, account identifiers, and similar credentials. For native connections, Mivaro may manage those credentials. For connections provided through Pipedream or another integration infrastructure provider, that provider may manage them on our behalf.

Do not place API keys, passwords, or other secrets in ordinary prompts or files unless the Service specifically requests them for an authorized connection.

2.5 Billing and transaction information

If you purchase a plan, our payment processor may collect payment-card, bank, billing, tax, and transaction information. Mivaro may receive billing contact information, the payment method type, masked details, transaction identifiers, invoices, payment status, and subscription information. We do not intend to store full payment-card numbers.

2.6 Support, communications, and temporary access

We collect messages and other information you provide when you request support, report an issue, participate in onboarding, respond to a survey, or otherwise communicate with us. When you report an issue, you may choose to share relevant prompts, outputs, logs, connection details, screenshots, or other account data with support.

Where available, you may grant temporary support access through a code or account control. Authorized personnel may also access limited account or system information without a support code when reasonably necessary for security, maintenance, incident response, abuse prevention, or legal compliance.

2.7 Device, usage, and operational information

We and our infrastructure providers automatically collect information such as IP address, browser type, device and operating-system information, referring page, pages and features used, login activity, timestamps, session identifiers, error reports, crash data, performance data, API usage, token counts, and security events.

2.8 Cookies and similar technologies

We use cookies, local storage, and similar technologies that are necessary to authenticate users, maintain sessions, secure the Service, remember preferences, and operate core functionality. As of the Effective Date, we do not use third-party advertising pixels or session-replay tools in the authenticated application. See Section 7.

2.9 Information from third parties

We may receive information from Customers, Authorized Users, Connected Services, identity or authentication providers, payment processors, integration providers, referrals, public business sources, and service providers. The information we receive depends on the third party and the permissions granted.

3. How We Use Personal Information

We use Personal Information to:

create, authenticate, administer, and secure accounts;
provide, operate, maintain, and improve the technical reliability of the Service;
connect to third-party services and carry out Customer instructions;
generate AI outputs, recommendations, analyses, and agent actions;
manage approvals, pre-authorizations, logs, and audit trails;
provide onboarding, customer support, maintenance, and troubleshooting;
process payments, subscriptions, usage, credits, invoices, and taxes;
communicate about the Service, security, billing, policy changes, and support;
monitor performance, diagnose errors, prevent fraud and abuse, and protect rights and safety;
comply with law, legal process, and contractual obligations;
enforce our terms and policies; and
create and use aggregated or deidentified operational information that does not identify a Customer or individual or reveal Customer Content.

We do not use Customer Content or Connected Service data to train generalized AI models or to improve models for other customers unless the Customer separately and affirmatively opts in. We may use non-content telemetry, error information, safety signals, and deidentified usage statistics to operate, secure, and improve the Service.

4. AI Providers, Models, and Data Routing

Merchant Command uses multiple AI models and services for different tasks. Depending on the selected model, route, and feature, these may include models or services developed, hosted, or supplied by OpenAI, Anthropic, Google, Meta, DeepSeek, Mistral AI, xAI, Alibaba/Qwen, Perplexity AI, and other providers. A model developer may not receive Customer data when the model is self-hosted or hosted by another provider.

We may automatically select a model or provider based on capability, task type, latency, cost, availability, safety, Customer settings, and other operational considerations. The Service may send the provider the prompt, relevant conversation history, system instructions, selected Customer Content, relevant Connected Service data, files, and tool results needed to perform the task. We seek to limit the information sent to what is reasonably necessary for the requested function.

Our standard is to use business, enterprise, API, self-hosted, or other configurations under which Customer Content is not used to train generalized models. We do not intentionally route Customer Content to a provider under terms that permit generalized model training unless the Customer gives separate affirmative authorization. If a provider cannot meet that standard for a particular route, we may restrict that provider to non-sensitive or public information, use a different host, or require explicit Customer authorization.

AI providers may retain prompts, outputs, and related metadata for limited periods for service delivery, safety, abuse detection, debugging, or legal compliance. Authorized provider personnel or contractors may review data in limited circumstances under the provider's terms. Provider practices and locations vary, and some processing may occur outside the United States.

Some features may use web search, retrieval, or external sources. Search terms, URLs, or selected context may be sent to search or content providers, and visiting an external site is governed by that site's privacy practices.

5. How We Disclose Personal Information

We may disclose Personal Information to the following categories of recipients for the purposes described in this Policy:

AI model and infrastructure providers that generate outputs, host models, route requests, provide search or retrieval, or support agent functions;
Integration providers, including Pipedream, that authenticate accounts, store or refresh credentials, call APIs, run workflows, or transmit data;
Connected Services at the Customer's direction, including when an agent reads from or writes to a connected account;
Cloud, database, storage, authentication, security, monitoring, communications, support, and payment providers that help operate the Service;
Authorized employees and contractors who need access for support, maintenance, security, incident response, legal compliance, or other permitted business purposes;
Professional advisers, including attorneys, accountants, auditors, insurers, and financing sources, subject to appropriate duties;
Affiliates and corporate transaction participants in connection with financing, diligence, merger, acquisition, reorganization, bankruptcy, or sale of assets, subject to appropriate confidentiality and lawful processing; and
Government authorities, law enforcement, rights holders, and other parties when we reasonably believe disclosure is required by law or necessary to protect rights, security, safety, users, the public, or the Service.

We may disclose information at a Customer's or user's direction, with consent, or as otherwise described when the information is collected.

6. No Sale or Targeted Advertising

As of the Effective Date, Mivaro does not sell Personal Information for money and does not share Personal Information for cross-context behavioral advertising or process it for targeted advertising as those concepts are defined under applicable U.S. state privacy laws.

We do not use Customer Data to create advertising audiences for Mivaro or third parties. We do not offer financial incentives in exchange for Personal Information. If these practices change, we will update this Policy and provide any legally required notice and opt-out controls before the change applies.

7. Cookies, Analytics, and Marketing

We currently use cookies and similar technologies necessary for login, session management, security, fraud prevention, preferences, and core operation. Browser settings may block or delete cookies, but essential functions may not work properly without them.

As of the Effective Date, we do not use third-party advertising pixels, behavioral advertising cookies, or session-replay tools in the authenticated Merchant Command application. We may use internal operational logs and infrastructure telemetry.

If we add nonessential analytics, advertising, or session-recording technologies, we will update this Policy and provide consent or opt-out controls where required. Marketing emails from Mivaro will include an unsubscribe method. Transactional, security, support, and account notices are not marketing and may continue while an account is active.

8. Customer-Directed Data and Merchant Customers

Customers use Merchant Command to process information about their own customers, prospects, personnel, and business operations. For this information, the Customer is generally responsible for:

deciding why and how the information is processed;
providing privacy notices and obtaining required consent;
ensuring its instructions are lawful and proportionate;
responding to access, correction, deletion, opt-out, and other privacy requests;
complying with marketing, communications, consumer-protection, and platform rules; and
determining whether cross-border processing is permitted.

Mivaro processes this information on the Customer's instructions to provide the Service. We do not independently use merchant customer data for advertising or generalized model training.

If an agent sends a message, issues a refund, modifies an order, or takes another action involving an end customer, the Merchant Command Customer remains the merchant, sender, and responsible business. The Customer must honor required consents and opt-outs.

For Shopify public applications, Mivaro intends to respond to Shopify's required privacy and redaction requests and compliance webhooks. A merchant customer seeking access or deletion should generally contact the Shopify merchant, which can initiate the applicable process.

9. Data Retention and Deletion

We retain Personal Information for as long as reasonably necessary to provide the Service, maintain security and auditability, comply with law, resolve disputes, enforce agreements, and fulfill the purposes described in this Policy. Retention depends on the data type, account status, Customer instructions, Connected Service requirements, and legal obligations.

Our general launch retention approach is:

Active account and Customer Data: retained while the account is active and as needed to provide the Service.
After account closure or termination: we generally begin deleting or deidentifying Customer Content and Connected Service data within 90 days, unless a shorter period is required by a platform request or law or a longer period is needed for legal, security, fraud, dispute, or backup purposes.
Backups: residual copies may remain in protected backups for up to an additional 90 days before being overwritten, unless a legal hold applies.
Connection credentials: disabled or deleted after disconnection or termination when no longer needed, subject to short-lived operational copies and backups. Customers may also need to revoke access at the Connected Service.
Security, agent, and audit logs: generally retained for up to 24 months, subject to longer retention for incidents, disputes, or legal requirements.
Billing, tax, and transaction records: generally retained for up to seven years or another period required for accounting, tax, fraud prevention, or law.
Support communications: retained while reasonably useful for support, security, quality, dispute prevention, and business records.
Deidentified information: may be retained without a fixed period if it cannot reasonably identify a Customer or individual and we maintain it in deidentified form.

A Customer's deletion request may be limited by legal obligations, pending transactions, fraud prevention, security, dispute resolution, and the rights of others. Deletion from live systems does not necessarily remove information from third-party systems that the Customer instructed us to update or from a Connected Service controlled by the Customer.

10. Security and Human Access

We use administrative, technical, and organizational safeguards designed to protect Personal Information against unauthorized access, loss, misuse, alteration, and disclosure. Safeguards may include access controls, encryption, logging, credential protections, secure development practices, backups, and incident-response procedures, as appropriate to the Service and data.

Access by Mivaro personnel and contracted developers is limited to authorized individuals who need it for legitimate purposes. Human access may occur when:

a user submits an issue and shares relevant data;
a user grants temporary support access, including through a support code;
access is reasonably necessary to diagnose an outage, maintain or secure the Service, investigate abuse or fraud, or respond to an incident; or
access is required for legal compliance.

No security system is perfect, and we cannot guarantee absolute security. Customers should use strong, unique credentials, enable available multifactor authentication, apply least-privilege scopes, review logs, and promptly report suspected compromise to support@merchantcommand.com.

11. International Processing

Mivaro is based in the United States. We and our providers may process Personal Information in the United States and other countries where we or they operate. Those countries may have privacy laws different from the laws where the information originated.

The Service is currently offered to United States businesses. A Customer that submits information about individuals in another country is responsible for determining whether that processing and any international transfer are lawful and whether additional contractual safeguards are needed. We may introduce regional hosting, transfer mechanisms, or supplemental terms as the Service expands.

12. Your Choices and U.S. Privacy Rights

Depending on where you live and the context, you may have rights to:

confirm whether we process your Personal Information and access it;
correct inaccurate Personal Information;
delete Personal Information;
obtain a portable copy of certain Personal Information;
opt out of sale, targeted advertising, or certain profiling;
limit or withdraw consent for certain sensitive-data processing; and
appeal a decision on a privacy request.

You may update certain account information in the Service, disconnect a Connected Service, cancel an account, or unsubscribe from marketing emails using available controls.

To submit a privacy request, email support@merchantcommand.com with the subject Privacy Request and describe the request. We may ask for information needed to verify your identity, authority, account, or relationship to the data. An authorized agent may submit a request where permitted by law, but we may require proof of authorization and identity verification.

We will respond within the period required by applicable law. We may deny or limit a request where permitted, including when we cannot verify it, the information is controlled by a Customer, an exception applies, or fulfilling it would adversely affect another person's rights. To appeal, reply to our decision with the subject Privacy Appeal and explain the basis for the appeal.

Because we do not currently sell Personal Information or use it for targeted advertising, there is no separate sale or targeted-advertising opt-out needed at this time. If our practices change, we will provide legally required controls, including recognition of qualifying universal opt-out signals where applicable.

If your information was submitted by a Merchant Command Customer, contact that Customer first. We will assist the Customer with its response as required.

13. Additional U.S. State Privacy Disclosures

For transparency, the categories of Personal Information we may have collected during the preceding 12 months include:

identifiers and contact information;
customer-record information, including business contact and account information;
commercial information, including subscriptions, purchases, store operations, orders, refunds, and transaction status;
internet, network, device, and application activity;
approximate location derived from IP address;
professional or employment-related information supplied for a business account;
communications and Customer Content;
inferences generated from business and usage data; and
sensitive information limited primarily to account credentials, connection tokens, API secrets, and any sensitive information contained in Customer Data at the Customer's direction.

We obtain these categories from individuals, Customers, Authorized Users, Connected Services, integration and identity providers, payment processors, and automatically from use of the Service. We use and disclose them for the business and commercial purposes described in Sections 3 through 5.

We may disclose these categories to service providers and contractors that support AI, hosting, integration, authentication, security, communications, support, and payments, and to Connected Services at Customer direction. We do not sell these categories or share them for cross-context behavioral advertising.

We use sensitive information only to provide requested functionality, authenticate and secure accounts, perform Customer instructions, prevent fraud, and comply with law. We do not use sensitive information to infer characteristics about individuals for advertising or unrelated purposes.

14. Children

Merchant Command is not directed to children or individuals under 18, and they may not create accounts or use the Service as Authorized Users. We do not knowingly collect Personal Information directly from a child for account registration. If we learn that an underage individual created an account, we may suspend the account and delete the information.

Customer Data may incidentally contain information about a Customer's end customers or shipment recipients. The Customer is responsible for ensuring that any processing involving minors is lawful and appropriate.

15. Changes to This Policy

We may update this Privacy Policy as the Service, vendors, laws, and practices change. We will post the updated version and revise the effective date. For a material change, we will provide additional notice by email, in-product notice, or another reasonable method before the change takes effect where required.

We will not retroactively use previously collected Customer Content for generalized AI model training without separate affirmative consent.

16. Contact Us

Mivaro Labs LLC

Email: support@merchantcommand.com

Website: merchantcommand.com