Privacy notice

Who is responsible for your data

Merripaper is operated by Teraniq OÜ, Ahtri tn 12, 15551 Tallinn, Estonia, the controller of personal data processed to provide this service. For privacy questions or requests, email hello@merripaper.com or use our contact form.

What we process and why

You can generate regular images without an account or photo uploads. We process the design settings you submit to create your preview. If you create an account, we store your name, email address, a one-way password hash, verification and session records, saved project settings, optional uploaded photos and generated files. Uploaded photos are re-encoded without their original embedded metadata; people and other personal information may still be visible in the image.

For purchases, we process billing-provider references, payment and access status and, for fixed-term contracts, the authorized terms version and payment schedule. If you contact us, we process your name, email address and message to respond. Technical request information and short-lived request counters help secure the service and prevent abuse.

Legal bases

We process the information needed to generate designs, manage your account, provide purchased access and answer purchase-related enquiries to perform our contract with you or take steps you request before entering it (Article 6(1)(b) GDPR). We rely on our legitimate interests in protecting accounts, preventing fraud and abuse, maintaining a reliable service and answering other enquiries (Article 6(1)(f)). We process information needed to meet applicable accounting, tax and other legal obligations under Article 6(1)(c). Where processing requires consent, we will ask for it; you may withdraw it at any time without affecting processing that was lawful before withdrawal. Required account and payment information is necessary for the corresponding features; photo uploads are optional.

Who receives information

Hosting, database, file-storage and email service providers process the information needed to operate Merripaper and deliver account and support messages. Stripe processes payments, authorized fixed-term installments and existing subscription payments. Card details are entered through Stripe’s hosted payment pages; Merripaper does not receive or store your full card number. See Stripe’s privacy notice for its processing of payment information. Information may also be disclosed where required by law or necessary to establish, exercise or defend legal claims.

If personal data is transferred outside the European Economic Area, applicable data-protection rules require an appropriate transfer basis, such as an adequacy decision or standard contractual clauses with any necessary additional safeguards. Contact hello@merripaper.com for information about the recipients and safeguards relevant to your data.

Cookies and your device

An essential, HttpOnly session cookie keeps you signed in, normally for up to 14 days. The studio can store an unfinished draft in your browser until you save or clear it. You can remove cookies and local storage through your browser settings; doing so may sign you out or remove an unsaved draft. Merripaper does not include advertising or third-party analytics scripts.

How long we keep information

Saved projects remain in your account until you delete them or your account. Up to eight recent generated versions are retained per project. Scheduled maintenance removes expired sessions, verification links and request counters, email delivery records older than seven days, and processed billing-event records older than 90 days. Message bodies in the delivery queue are cleared after successful delivery; this does not delete correspondence from the recipient’s mailbox.

Account deletion removes active account and project records and initiates removal of associated files; remote file cleanup may finish during scheduled maintenance. It also requests deletion of the associated Stripe customer and stops associated subscriptions. This does not erase financial records that payment providers must retain by law. Support correspondence and any records needed for legal obligations or claims are retained only for as long as those purposes require. Account deletion does not remove files you have already downloaded to your own device.

Your rights and choices

Under the GDPR, you may request access to your personal data, correction, erasure, restriction of processing and, where applicable, data portability. You may object to processing based on legitimate interests on grounds relating to your situation. These rights are subject to the conditions and exceptions in applicable law. We may need to verify your identity before acting on a request.

In Account, you can export account and project settings or delete your account. Download uploaded images and generated files separately; PDF downloads require active access, but this does not limit your statutory data-access rights. You can also delete individual projects. Send privacy requests to hello@merripaper.com. We normally respond within one month; if a lawful extension is needed, we will explain why.

You may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), www.aki.ee, or with the supervisory authority in the country of your habitual residence, place of work or the alleged infringement. You do not have to contact us first.