Privacy

Last updated: 19 August 2026.

Meritt handles two very different kinds of data, and mixing them up would be the first mistake: that of our customers — merchants and their affiliates — and that of the visitors who click an affiliate link.

1. Visitors who click

When someone follows an affiliate link, we record the link identifier, the timestamp, the country derived from the IP address, and a technical fingerprint used to recognise a unique visitor. A first-party cookie is set on the merchant's domain.

What we do not do: build an advertising profile, resell this data, cross-reference it between merchants, or follow a person beyond the attribution of the sale the link exists for. The IP address is not kept in clear beyond resolving the country.

The merchant is the controller for this data; Meritt is the processor. It is for the merchant to inform their visitors and, where applicable, to collect their consent.

2. Merchants

Name, email address, company details and billing information. They serve to run the account, to produce the accounting documents, and to write to you about your own service.

3. Affiliates

Name, email address, postal address where it appears on documents, payout address, tax status and VAT number where applicable. An affiliate account is unique per person and shared across the merchants they promote: that is what lets someone hold a single tax identity rather than one per programme.

An affiliate decides for themselves which messages they receive, from their own area. Three messages fall outside that setting — the answer to their application, and anything concerning their money: a payout sent, a payout that could not be made, a payout returned.

4. Payments

We hold no bank details for your affiliates. A transfer is initiated with your provider — PayPal or Wise — from your own account, and the details it needs are held by them. The credentials that let us act on your behalf are encrypted at rest with a key that is not in the database.

5. Processors

• Neon — database hosting.
• DigitalOcean — application hosting.
• Stripe — subscriptions, and reading your sales when you connect your account.
• PayPal and Wise — carrying out transfers from your accounts.
• Resend — email delivery.
• Google — sign-in with a Google account, if you use it.

6. Retention

Clicks are kept for as long as attribution needs them, plus the commercial limitation period. Accounting entries and documents are kept for ten years, because the law requires it and because a ledger with holes in it proves nothing. A closed account is deleted within thirty days, accounting records aside.

7. Your rights

Access, rectification, erasure, portability, objection. Write to [email protected]; we answer within thirty days. If the request concerns data collected on a merchant's behalf, we point you to them — they are the controller, and answering in their place would be deciding in their place.

8. Transfers

Some processors are established outside the European Union. Those transfers rest on the European Commission's standard contractual clauses.