Privacy Policy.

1. Who operates MerchWorthy

The MerchWorthy website is operated by Shenzhen Yiscaxia Technology Co., Ltd., operating MerchWorthy, Rm# 503, Bldg A, Fenghuang Chuanggu, Fuhai Street, Baoan District, 518103, Shenzhen, China.

Cathy Shi is the founder of MerchWorthy and the privacy contact for the website. Privacy questions or requests may be sent to cathy@merchworthy.com.

The planned Hong Kong company is still in formation and is not the current website operator, contracting entity, invoicing entity or payment recipient. This policy will be updated if that position changes.

2. Scope of this policy

This policy applies to personal information collected through:

• the MerchWorthy website;
• the General Inquiry, Curated Shortlist and Project Brief forms;
• email and other direct business communications connected with an inquiry or project; and
• website analytics and technical operations described below.

It does not control the privacy practices of third-party websites or services that you visit through an external link.

3. Information we collect

Information you choose to provide

Depending on the route you use and the information needed for your inquiry, we may collect:

• your name, work email address, company or organization;
• the project goal, audience, occasion and intended result;
• product direction, quantities, budget range and timing;
• branding, customization, packaging, assembly, delivery, proof or approval requirements;
• other project details that you choose to include;
• later email correspondence and files voluntarily shared for project review; and
• delivery or recipient information shared later when it is needed to carry out an agreed project.

The public website forms do not ask you to upload payment information, recipient address lists, passwords or other highly sensitive personal information. Please do not include this information in a public form. If a project later requires files, recipient information or other operational details, we will arrange an appropriate direct communication method.

Technical and usage information

The website and its service providers may process limited technical information needed to deliver, secure and understand use of the website. This may include:

• the page or form used, form type and submission time;
• browser, device and operating-system information;
• pages viewed, links or buttons used and other general interaction information;
• approximate location derived from network information; and
• request, security and diagnostic information used to prevent spam, abuse or service failures.

We do not intentionally send names, email addresses, company names, inquiry text, recipient lists, payment information or form-submission identifiers to Google Analytics.

4. Sources of information

We collect personal information:

• directly from you when you submit a form, email us or communicate about a project;
• automatically from your browser or device when necessary to operate, secure or, with your consent, measure the website;
• from service providers that process a form submission or website request on our behalf; and
• from another person in your organization when that person includes you in an inquiry or project communication.

5. How we use information

We may use information to:

• review and respond to an inquiry;
• understand the project goal, audience, occasion and operating requirements;
• prepare product, customization, packaging, assembly or delivery directions;
• assess feasibility and coordinate later business communications;
• provide quotations, project documentation and order support;
• maintain project history and relationship records;
• operate, secure, troubleshoot and improve the website and inquiry process;
• prevent spam, abuse, fraud or security incidents; and
• comply with legal obligations and establish, exercise or defend legal rights.

Submitting an inquiry does not add you to an automated marketing list. If we later introduce a marketing subscription, it will use a separate and clear choice.

6. Inquiry forms and business communications

The public website presents MerchWorthy-designed forms. Zoho Forms is used in the background to receive and store submissions and to send a structured notification email to Cathy.

Form submissions may include the information entered by the visitor, the source page, form type and submission time. Zoho and the hosting environment may also process technical information needed to deliver and secure a submission. MerchWorthy decides what information the forms request and how submitted information is used.

Normal inquiry and project records are retained for business correspondence, project history, relationship management, security, dispute resolution and legal obligations. They are not automatically deleted under the current operating process. Section 12 explains retention and deletion in more detail.

7. Analytics, cookies and similar technologies

MerchWorthy uses a limited Google Analytics 4 (GA4) configuration to understand aggregate website use and improve navigation, content and inquiry paths.

Our launch configuration is intended to:

• load Google Analytics only after a visitor permits analytics cookies;
• use basic consent mode so Google Analytics does not receive data before that choice;
• keep Google Signals disabled;
• keep advertising personalization and remarketing disabled;
• exclude Google Ads tags, Meta Pixel and other advertising pixels; and
• exclude personally identifiable form or inquiry information from analytics events and page URLs.

If you permit analytics, Google Analytics may use first-party cookies and process device, browser, interaction and network information to provide usage statistics. You may accept or reject optional analytics through the website’s consent control. Rejecting analytics does not prevent you from using the website or submitting an inquiry. You can also change your analytics choice through the consent control made available on the website.

The GA4 property is configured with a 14-month user-level and event-level data-retention setting. Google explains that this setting does not necessarily remove previously aggregated reporting data.

Essential browser storage may still be used where reasonably necessary to operate the website, remember privacy choices, maintain security or provide a requested feature.

8. Service providers and other recipients

We use service providers to operate the website and inquiry process. At launch these include:

• Namecheap / EasyWP — domain services, WordPress hosting and related infrastructure;
• Namecheap Private Email — business email delivery and storage;
• Zoho Forms — form-submission processing, storage and notification delivery; and
• Google Analytics — optional, consent-based website usage measurement.

These providers process information in connection with their services and operate under their own terms, privacy documentation and security controls.

We may also share project information with suppliers, customization providers, packaging or assembly partners, logistics providers, professional advisers or other project participants when reasonably necessary to evaluate, plan or carry out a project. We aim to share only the information needed for that participant’s role.

We may disclose information when required by law, necessary for security or fraud prevention, or needed to establish, exercise or defend legal rights. We may also transfer relevant information if the ownership or operation of MerchWorthy changes, subject to applicable law and appropriate notice.

MerchWorthy does not sell personal information for monetary consideration and does not share personal information for cross-context behavioural advertising. If these practices change, we will update this policy and provide any choices required by applicable law.

9. International processing

MerchWorthy works with customers, service providers and operating partners in more than one country. Information may therefore be processed outside the country where it was submitted, including in locations used by our hosting, form, email and analytics providers and by project participants.

Where applicable, we will use reasonable operational, contractual and provider controls for cross-border processing. Privacy protections and legal rights may differ between countries.

10. Legal grounds for processing

Where applicable law requires a legal basis, we process information as appropriate to:

• respond to your request and take steps connected with a potential business relationship;
• perform an agreement or project;
• pursue legitimate business interests such as maintaining records, improving services, preventing abuse and protecting rights;
• comply with legal obligations; or
• act on your consent, including consent for optional analytics cookies.

You may withdraw analytics consent through the website’s consent control. Withdrawal does not affect processing that occurred before your choice was changed.

11. Your privacy choices and rights

Depending on your location and applicable law, you may have rights concerning personal information connected with your inquiry, including rights to request access, correction, deletion, restriction, objection, withdrawal of consent or a portable copy.

Residents of certain U.S. states may also have rights to know the categories and specific pieces of personal information collected, correct inaccurate information, request deletion, obtain a copy, and opt out of certain sale, sharing, targeted-advertising or profiling activities. MerchWorthy does not currently sell personal information, share it for cross-context behavioural advertising or use it for solely automated decisions that produce legal or similarly significant effects.

To make a request, email cathy@merchworthy.com. Please describe the request and the inquiry or business relationship it concerns. We may need to verify your identity and authority before responding. An authorized agent may submit a request where applicable law permits, but we may request evidence of that authority or confirmation from the individual.

We will not discriminate against you for exercising a privacy right. Some rights are subject to exceptions, and some records may need to be retained where applicable law or a legitimate legal need permits or requires it. You may also raise a concern with the relevant privacy or data-protection authority where that right is available.

12. Retention and deletion

Inquiry and project information is retained for business correspondence, project history, relationship management, security, dispute resolution and legal obligations. Records are not automatically deleted under the current operating process.

Information may be deleted when requested by the individual and applicable, required by law, necessary for security, connected with a service or account closure, or manually authorized by the operator. Some information may need to be retained for legal obligations, disputes, fraud prevention, backup integrity or the protection of rights.

Retention by service providers may also be affected by their account settings, backup processes, legal requirements and service terms. The separate GA4 retention setting is described in Section 7.

13. Security

MerchWorthy uses reasonable technical and operational measures intended to protect inquiry and project information. These measures include controlled account access, HTTPS, form validation, anti-spam controls, provider security features and restricted administrative access.

No internet, hosting, form or email system can guarantee absolute security. Please do not send payment information, passwords, complete recipient address lists or other highly sensitive personal information through a public website form.

14. Children

The MerchWorthy website and inquiry services are intended for business users and are not directed to children. We do not knowingly collect personal information through the public inquiry forms from children under 13. If you believe a child has provided personal information, contact us so we can review the situation.

15. Third-party links

The website may link to third-party websites or services. Their privacy practices are governed by their own policies, and this Privacy Policy does not control those services.

16. Changes to this policy

We may update this Privacy Policy when the website, service providers, operating entity, analytics configuration or business processes change. The published policy will display its effective date and last-updated date. Where appropriate, we will provide additional notice of a material change.

17. Contact