Merchant Club SA
Privacy Policy
Last updated: July 2026
Merchant Club SA ('we', 'us', 'our') operates merchantclubsa.com. This policy explains what personal data we collect, why we collect it, and your rights under the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia.
1. Data We Collect
We collect different data depending on how you use the platform: brand partners submitting an application (brand name, business category, brand story, Instagram handle, email, website); customers creating an account or placing an order (name, phone number, email, delivery address); creators applying to the Merchant Club creator program (name, phone, email, social handle); and site visitors generally (a session identifier and a hashed IP address for analytics — see 'Cookies & Analytics' below). We do not collect or store payment card numbers, government IDs, or other sensitive personal data at any point — card payments are processed directly by our payment provider, and card details never reach our servers.
2. Why We Collect It
We use this data to review and respond to brand and creator applications; create and manage customer and creator accounts; process, fulfil, and communicate with you about orders; attribute a purchase to the creator who referred it, for commission purposes; and understand, in aggregate, how the platform is used so we can improve it. We do not sell your data, and we do not use it for third-party advertising.
3. Cookies & Analytics
We use cookies to keep you signed in, remember your language preference, and attribute a purchase to the creator whose link you followed (a short-lived referral cookie). We also use Google Analytics and ContentSquare to understand site usage — these see a session identifier and a hashed, not raw, IP address, never your name or contact details directly. A cookie-consent banner letting you manage these preferences is in development.
4. How We Store It
Application, account, order, and analytics data is stored in a managed database operated by Supabase, access-restricted to authorized Merchant Club SA team members and protected by row-level security policies. Emails are sent via Resend and are not retained by Resend beyond delivery. The site is hosted on Vercel.
5. How Long We Keep It
We retain brand and creator application data for up to 12 months if the application is not accepted. Customer account and order data is retained for as long as your account is active, or as required to meet our legal and accounting obligations. You may request deletion of your data at any time, subject to those obligations.
6. Your Rights Under PDPL
Under Saudi Arabia's Personal Data Protection Law, you have the right to: access your personal data, correct inaccurate data, request deletion of your data, and withdraw consent at any time. To exercise any of these rights, contact us at info@merchantclubsa.com.
7. Third-Party Services
We use Supabase (database, authentication, and file storage), Resend (transactional email), Vercel (hosting), and Google Analytics and ContentSquare (site analytics). Once live, we will also use Moyasar for payment processing — Moyasar receives your payment details directly, under its own privacy policy, never through our servers. We do not share your data with any other third party.
8. Contact
For any privacy-related questions or requests, contact us at info@merchantclubsa.com.