Privacy policy

1. Who is responsible for your data

The data controller is D-Legacy SAS, RUC 1793077323001, domiciled at Calle Pasteur N10-62 y Avenida París, Quito, Ecuador. Merchito is the brand under which we serve you.

For any privacy matter, write to merchito360@gmail.com with the subject line "Protección de datos" (Data protection). You can also message us on WhatsApp at +593 99 988 8141.

2. What data we process and where it comes from

We process only what is necessary to quote, produce and deliver your order and to keep the store working properly. We do not ask for sensitive data, and we ask you not to share it in the chat or in the notes.

• Bag and order form: your name, company, delivery city and country, the date you need the order, notes, and the products, colors and quantities you choose. Your name and company are optional.
• WhatsApp: your number, your profile name and whatever you write to us. You start the conversation from your own WhatsApp account.
• Email: your address and the content of the messages you send us.
• Quotes for companies: legal business name, RUC (Ecuadorian tax ID), email, phone number and billing address that you give us to issue your quote and your invoice. We use them to keep your client record.
• 3D studio: the logos, text and fonts you upload, the position, size and rotation of each layer, and a thumbnail of your design.
• Our own anonymous analytics: pages you visit, products you view, searches and actions in the store, linked to a temporary session identifier that is deleted when you close the tab. It does not include your name, email or phone number.
• Merchito AI: the questions you ask it and the page you ask from.
• Newsletter, only if you subscribe: your email, the date, the exact text you agreed to, the part of the store where you subscribed and the date you confirmed or unsubscribed.
• Technical data: your IP address is used for a few minutes to stop abuse of the forms and the chat, and it is not stored together with your usage events.

3. What we use it for and on what legal basis

Each use relies on one of the legal bases recognized in article 7 of the LOPDP:

• Responding to your request, preparing the quote and following up: pre-contractual measures that you request.
• Producing and delivering your order and handling warranty claims: performance of the contract.
• Issuing invoices and keeping the accounts: compliance with Ecuador's legal and tax obligations.
• Keeping your client record and following up on the quotes you requested: legitimate interest in serving you well and pre-contractual measures. We do not use it for advertising without your consent.
• Anonymous analytics, security and abuse prevention: legitimate interest in making the store work, stay secure and improve. You can decline analytics in "Privacy preferences" at the bottom of every page, or by writing to us.
• Merchito AI: legitimate interest in answering the question you start. Using it is voluntary, and you can always talk to a person on WhatsApp.
• Newsletter with news, ideas and promotions: only with your express consent. You check the box, confirm from your email and withdraw it whenever you want with the unsubscribe link in each email.

4. Merchito AI

Merchito AI is an assistant that guides you on products, reference prices, techniques and how to use the store. Its answers are for guidance only: it can make mistakes, it does not replace the team's written quote, and it does not confirm stock, timelines or terms.

When you write to it, your message, that session's conversation and the page you are on are sent to OpenRouter, a service that connects to language model providers (currently Anthropic and, as a backup, Google). We configure OpenRouter to use only providers that do not store your messages or use them to train their models, and OpenRouter does not store the content of conversations.

In our database we store the question with emails and phone numbers hidden, the products it recommended to you and technical data (model, response time and cost), without your name. We do not store the full answer. These records are deleted starting at 90 days. The conversation also stays in your browser while the tab is open.

Merchito AI does not make automated decisions that produce legal effects on you or significantly affect you: it does not approve orders, set final prices or evaluate anyone. Those decisions are always made by a person on the team.

5. Your logos and files

The logos, fonts and composed artwork you upload to the studio are stored in private storage, with no public access. Only the Merchito team opens them, through temporary links, to prepare the production artwork for your order. We do not use them for anything else or to train artificial intelligence models.

We keep them while they are useful for your order, replacements and repeat orders, up to 24 months after your last order. If you uploaded a file and did not send an order, we delete it after 90 days. You can ask us to delete them sooner.

6. How long we keep your data

We keep each piece of data only for as long as its purpose requires:

• Orders, accepted quotes, invoices and client record: for as long as the business relationship lasts and for the period required by Ecuador's tax and accounting regulations.
• Quotes that do not end in a sale: up to 24 months; the team may delete them sooner.
• Requests that do not end in an order: up to 24 months from the last contact.
• Merchito AI records: deleted starting at 90 days.
• Anonymous analytics events: up to 24 months.
• Newsletter: for as long as you stay subscribed. If you unsubscribe, we keep your email marked as unsubscribed so we do not write to you again, along with proof of your consent and of its withdrawal for as long as we may need it to show that we comply with the law.
• Data in your browser: until you delete it from your browser or empty your bag.

7. Who we share it with

We do not sell your data or hand it over for advertising purposes. We work with providers that process data on our behalf, only to provide the service and under data processing agreements:

• Vercel: store hosting (United States).
• Supabase: database, files and team sign-in (United States).
• Resend: order notification emails to the team and newsletter delivery to subscribers (United States).
• Upstash: abuse control using your IP for a few minutes (provider's region).
• OpenRouter and the model providers that Merchito AI uses (United States).
• fal.ai: generates the catalog's 3D models from product photos and the images for the blog and the newsletter. It does not receive client data or your logos.
• Shipping companies: only the data needed to deliver your order in Ecuador or Panama.

8. International transfers

Several of these providers are located outside Ecuador, mainly in the United States. We transfer data because it is necessary to provide the service you request (article 60 of the LOPDP) and under agreements that require those providers to protect your data with security and confidentiality measures. We are adapting those agreements to the standard contractual clauses adopted by the Superintendency of Personal Data Protection (Superintendencia de Protección de Datos Personales) for international transfers.

WhatsApp (Meta) and Google, when you use them to contact us or sign in, process your data as independent controllers under their own policies.

9. Your rights

Under the LOPDP you have the right to: information, access, rectification and updating, deletion, objection, portability, suspension of processing and not to be subject to decisions based solely on automated assessments. If you are in Panama, Law 81 of 2019 grants you the rights of access, rectification, cancellation, objection and portability.

To exercise them, write to merchito360@gmail.com with the subject line "Protección de datos" (Data protection) and include your name, the data or order you are referring to (for example, your M360 reference) and which right you want to exercise. If we cannot identify you with certainty, we will ask you for an additional piece of information.

We respond within the 15 days set by the LOPDP and, for requests from Panama, within the 10 business days set by its regulations. Exercising your rights is free.

10. If you are not satisfied

Write to us first: we want to resolve it. If we do not respond in time or you are not satisfied with the response, you can file a complaint with Ecuador's Superintendency of Personal Data Protection (Superintendencia de Protección de Datos Personales) at spdp.gob.ec. In Panama, the authority is the National Authority for Transparency and Access to Information (Autoridad Nacional de Transparencia y Acceso a la Información, ANTAI).

11. Security

We use encryption in transit, role-based permissions in the team's dashboard, private storage for client files, validation of everything submitted to the store and limits against form abuse.

No system is infallible. If a breach occurs that puts your data at risk, we will notify the authority and the affected people within the time frames required by law.

12. Minors

Merchito sells to companies and to adults. The store is not directed at minors, and we do not knowingly collect their data. If we detect data from a minor without the authorization of their legal representative, we delete it.

13. Cookies and browser storage

The store does not use advertising cookies or third-party tracking cookies. To work, it stores the following in your own browser:

• Local storage: your bag, favorites, viewed products, your creator progress, whether you have already seen the studio guide, the light or dark theme you chose and your privacy preferences. It does not leave your device except when you send your order.
• Session storage: the temporary analytics session identifier and the conversation with Merchito AI. They are deleted when you close the tab.
• Session cookies: only in the Merchito team's dashboard, to keep the session signed in.
• Anonymous analytics is the only optional part. You can accept or decline it in the notice on your first visit and change your choice whenever you want in "Privacy preferences" at the bottom of every page.

14. Changes to this policy

If we change this policy, we will publish the new version on this page with its date. If the change is significant, we will highlight it in the store. Last updated: September 27, 2026.