Privacy Policy

This Privacy Policy explains how Karma Holdings LLC, doing business as Merchly (“Merchly,” “we,” “us,” or “our”), collects, uses, shares, and protects information when you visit merchly.io (the “Site”), request a quote, or communicate with us by phone, email, or text message.

The short version: what you submit is stored in our encrypted database. We never sell it, and we never share it with anyone for their own marketing or advertising. We only text you if you opt in, and analytics cookies only run if you allow them. We serve U.S. businesses, but we hold ourselves to the European Union's General Data Protection Regulation (GDPR) standards for cookies and privacy rights anyway.

Merchly is a registered Independent Sales Organization (ISO) of Commercial Bank of California (Irvine, CA). We are not a bank. By using the Site, you acknowledge the practices described in this policy. Your use of the Site is also governed by our Terms of Service.

Information you give us

When you request a quote or contact us, we collect:

• Your first and last name
• Your email address and phone number
• How long your business has been operating
• Anything you choose to tell us in a message, such as what you sell, your processing volume, or your timeline
• Whether you opted in to text messages, and the details of any calls, emails, or text messages you exchange with us

The savings calculator on the Site runs entirely in your browser. The volume, rate, and fee figures you enter into it are not sent to us unless you include them in a message.

If you later apply for a merchant account, the application is collected separately and also governed by the application and merchant agreement you sign. Applications typically require additional business, ownership, banking, and identity information needed for underwriting.

Text message opt-in records

If you check the text message box on a form, we record when you opted in, the exact wording you agreed to, the page you were on, your IP address, and your browser type, so we can show that you gave us permission. If you leave the box unchecked, we don't record these details.

Information collected automatically

When you visit the Site, we and our service providers collect:

• Device and connection information, such as your IP address, browser type, operating system, and approximate location derived from your IP address
• Usage information, such as the pages you view, the links you click, the page that referred you, and the date and time of your visit
• Performance information about how quickly pages load on your device

We collect this through Vercel Web Analytics and Vercel Speed Insights, which don't use cookies, and — only if you allow analytics cookies — Google Analytics. Our forms are protected by Google reCAPTCHA, which collects hardware and software information and interaction data and sends it to Google to tell people and automated bots apart. Your use of reCAPTCHA is subject to the Google Privacy Policy and Terms of Service.

We use the information we collect to:

• Respond to your inquiry and prepare a custom quote
• Contact you by phone and email about your quote, your application, onboarding, and support — and by text message only if you opted in
• Send you email updates and offers about Merchly products and services, which you can unsubscribe from at any time
• Provide customer support
• Operate, secure, and improve the Site, including detecting spam, fraud, and abuse
• Understand how visitors use the Site
• Comply with legal, regulatory, and card-network obligations, and enforce our terms

We do not sell your information or use it for advertising.

Text messages are optional. Merchly only texts you if you check the text message box on one of our forms, and leaving it unchecked doesn't affect your quote. If you opt in, we may send you text messages about your quote request, your application and onboarding, and customer support. Message frequency varies. Message and data rates may apply. Reply STOP to any message to opt out, or HELP for help. You can also reach us at support@merchly.io or (800) 492-7947. Consent to receive text messages is not a condition of purchase.

Our text messaging program is registered for A2P 10DLC and follows the CTIA Messaging Principles and Best Practices and wireless carrier requirements. Full program terms are in the Text messaging terms.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties.

We never sell or rent your personal information, and we never share it with anyone for their own marketing or advertising. It stays in our encrypted database, and leaves it only in these limited cases:

• Service providers that host, store, or deliver it for us, only to provide their services to us: Vercel (website hosting and cookieless analytics), Neon (our encrypted database), Brevo (email delivery), BulkVS (text message delivery), and Google (reCAPTCHA, and Analytics if you allow it).
• Our sponsor bank and processing partners, only if you apply for a merchant account or ask us to prepare one, as needed to underwrite, open, and service it.
• Legal and safety reasons, when we believe in good faith that disclosure is required by law, regulation, subpoena, or card-network rules, or is needed to protect the rights, property, or safety of Merchly, our users, or others.
• Business transfers, in connection with a merger, acquisition, financing, or sale of all or part of our business, subject to this policy.
• At your direction, when you ask us to share it.

The mobile information restriction in Text messaging applies to every category above.

We follow the strictest cookie rules — the EU's GDPR and ePrivacy standards — even though we only serve U.S. businesses. That means:

• No analytics cookies are set until you choose Accept all or turn Analytics on in Cookie settings.
• Rejecting is as easy as accepting, and the Site works the same either way.
• We keep cookies only as long as those rules allow: analytics cookies expire after 13 months at most, and later visits never extend them. We also keep your cookie choice for 13 months, then ask again.
• If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as a refusal of analytics cookies unless you turn them on yourself.
• You can change or withdraw your choice at any time from Cookie settings at the bottom of every page. Withdrawing deletes the analytics cookies already set.

Necessary — always on

Analytics — only with your consent

Google Analytics runs with Google signals and ad personalization turned off, so what it measures isn't used for advertising. Vercel Web Analytics and Speed Insights count visits and measure page speed without setting cookies or storing anything on your device. You can also block or delete cookies in your browser settings.

We keep quote requests and communications for as long as we need them to respond to you, maintain our business relationship, resolve disputes, and meet legal, regulatory, and recordkeeping obligations. We keep text message opt-in and opt-out records for as long as we may need to prove your consent or honor your opt-out. Cookie lifetimes are listed under Cookies. When we no longer need information, we delete it or de-identify it.

Everything you submit through the Site is stored in our encrypted database: it is encrypted in transit (HTTPS) on the way to us and encrypted at rest once stored. Access is limited to authorized Merchly personnel. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please do not send sensitive information such as full card numbers, bank account numbers, or Social Security numbers through our website forms.

• Email: use the unsubscribe link in any marketing email. We may still send messages about your quote, application, or account.
• Text messages: reply STOP to any message, or tell us any other reasonable way. You will receive one confirmation and no further texts unless you opt in again.
• Phone calls: ask us to stop calling, and we will add your number to our internal do-not-call list.
• Cookies: change or withdraw your choice any time from Cookie settings at the bottom of every page.

We honor these rights for everyone, wherever you live — not only residents of states with consumer privacy laws such as California, Colorado, Connecticut, and Virginia. You can:

• Find out what personal information we hold about you and how we use it
• Get a copy of it, in a portable format
• Correct inaccurate information
• Have it deleted
• Withdraw consent you gave us, such as for text messages or analytics cookies, at any time
• Object to our using it for marketing
• Opt out of the sale of personal information, sharing for cross-context behavioral advertising, and targeted advertising — we don't do any of these
• Exercise these rights without being treated differently

To exercise a right, email support@merchly.io or call (800) 492-7947. We will verify your identity before acting on a request, and you may use an authorized agent, from whom we may ask for proof of authorization. We respond within 30 days. We may keep information where the law requires us to. If we deny your request, you may appeal by replying to our decision.

The Site is intended for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a minor has given us personal information, contact us and we will delete it.

The Site links to websites and services we do not control, such as payment platforms and software providers. Their privacy practices are governed by their own policies, not this one.

We may update this policy from time to time. When we do, we will change the effective date at the top of this page, and for material changes we will provide additional notice as required by law. Your continued use of the Site after an update means the updated policy applies.

Questions or requests about this policy or your information? Our team is available 24/7/365:

• Email: support@merchly.io
• Phone: (800) 492-7947

Karma Holdings LLC, doing business as Merchly