Effective date: October 8, 2026
JCB Publishing LLC operates Merchstead. This Privacy Notice explains how Merchstead collects, uses, stores, shares, and protects information in connection with our website, merchant accounts, hosted ecommerce platform, integrations, support, and related services.
JCB Publishing LLC
4157 Fox Run Trl, Ste 1
Cincinnati, Ohio 45255, USA
Privacy contact:
joseph.bily@merchstead.com
This Privacy Notice applies to Merchstead's public website, merchant accounts, administration tools, hosted storefront platform, integrations, and support services.
For account, billing, security, platform-administration, and website information, JCB Publishing LLC determines how information is used.
For customer information collected through a merchant's storefront, the merchant generally determines why that information is collected and used, and Merchstead processes the information to provide the merchant's hosted ecommerce service. Store customers should contact the selling merchant first regarding that merchant's use of customer information.
Depending on how Merchstead is used, we may process the following categories of information:
Merchant and administrator information. Business name, contact information, account identifiers, store slug or domain, permissions, password hashes, account status, subscription records, and administrative activity.
Store and customer information. Product listings, images, customer names, email addresses, shipping and billing addresses, order information, purchased items, fulfillment instructions, taxes, discounts, refunds, and related transaction records.
Integration information. Integration settings, encrypted credentials or authorization tokens, provider identifiers, payment references, shipping information, tracking information, currencies, statuses, and provider responses.
Communications. Support requests, account messages, transactional email records, notification records, and communications necessary to operate or support the service.
Technical and security information. Session identifiers, IP addresses or related technical identifiers, login and signup activity, request records, security events, operational errors, and administrator audit information.
Information may come from merchants, authorized merchant personnel, storefront customers, enabled third-party providers, Google APIs when authorized, and interactions with Merchstead systems.
We use information as necessary to:
Merchant customer information is processed to provide the merchant's ecommerce service and is not used by Merchstead to create unrelated advertising or marketing profiles.
Merchstead uses Google OAuth 2.0 and the Gmail API when a merchant, platform administrator, or authorized recovery account connects Google email functionality.
Merchstead requests the Gmail authorization scope:
https://www.googleapis.com/auth/gmail.send
This permission allows Merchstead to send email on behalf of the Google account that granted authorization.
When Google authorization is enabled, Merchstead may receive and process:
Merchstead does not use the Gmail API to read a user's existing mailbox messages, contacts, drafts, or inbox content.
Google authorization information is used only to:
Merchstead does not use Google user data for advertising, audience profiling, unrelated marketing, or sale to third parties.
Merchant and platform Gmail refresh credentials stored in the Merchstead database are protected using application-level encryption.
Certain dedicated production recovery credentials may instead be stored in protected server-side configuration so that recovery email can operate independently of the application database. That configuration is excluded from source control and protected by restricted server permissions.
Temporary Google access tokens are used only as needed to communicate with Google APIs and are not intended to serve as long-term stored credentials.
Merchstead does not sell Google user data.
Google-related data is disclosed only as necessary to:
We do not transfer Google user data to advertising platforms or data brokers.
Merchstead's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy , including the Limited Use requirements.
Users may disconnect Google integrations through available Merchstead controls or revoke authorization through their Google Account. Revocation prevents future authorized Gmail API activity but may not automatically remove records that Merchstead must retain for security, accounting, operational, or legal reasons.
Merchstead uses third-party providers to operate the service.
These may include:
These providers process information according to their own terms and privacy practices and, where applicable, our instructions or contractual arrangements.
Payment providers process payment instruments directly. Merchstead does not ask users to send complete card numbers or card security codes through support communications.
Merchstead uses essential session cookies and similar technical mechanisms for authentication, security, checkout, navigation, and application operation.
Merchstead does not currently use third-party advertising cookies, behavioral advertising pixels, or cross-site tracking technologies.
Blocking essential cookies may prevent account, storefront, checkout, or administrative functions from working correctly.
Merchstead does not sell personal information.
Merchstead does not use personal information for cross-context behavioral advertising or targeted advertising.
If Merchstead offers promotional email, recipients may use the provided unsubscribe mechanism or contact us. Essential security, billing, service, account, and requested transactional messages may continue where necessary.
Merchants are responsible for their own marketing practices and customer communication preferences.
Merchstead retains information only as reasonably necessary for the purposes described in this Notice, including:
Retention periods vary according to the type of information, purpose, merchant instructions, legal requirements, and backup cycles.
Cancellation of a merchant subscription does not automatically mean immediate deletion of all records.
Where deletion is requested or appropriate, information may remain temporarily in restricted backups or archives until those copies expire through normal retention and recovery processes, unless longer retention is required or permitted by law.
Google OAuth credentials that are no longer required may be removed from active Merchstead systems. Users may also revoke Google authorization through their Google Account.
Merchstead uses administrative, technical, and application safeguards designed to protect information.
These safeguards include, as applicable:
No system of transmission or storage can be guaranteed completely secure. Users should protect their credentials and promptly report suspected unauthorized access to joseph.bily@merchstead.com.
Depending on applicable law and your relationship with Merchstead, you may have rights to request access, correction, deletion, restriction, objection, portability, or other privacy-related actions.
Requests may be sent to joseph.bily@merchstead.com.
We may verify the requester's identity or authority before responding.
Do not send passwords, OAuth tokens, payment-card information, or other authentication secrets through email.
Store customers should normally contact the merchant from whom they purchased. Merchstead will assist merchants with appropriate privacy requests when required.
Merchstead's primary hosting and application infrastructure is located in the United States.
Third-party providers may process information from other locations as part of their global infrastructure.
Where applicable law requires specific safeguards for international transfers, Merchstead and its merchants are responsible for establishing appropriate arrangements before the relevant processing occurs.
Merchant accounts are intended for adults operating businesses and are not directed to children under 13.
Merchstead's public marketing and merchant-registration services are not designed for children.
Merchants are responsible for complying with applicable age, parental-consent, and child-privacy requirements for their own storefront customers.
If you believe a child has submitted information directly to Merchstead improperly, contact joseph.bily@merchstead.com.
Merchstead storefronts may contain merchant-provided content, links, integrations, and services operated by third parties.
Those businesses may have their own privacy practices. Users should review the privacy notices of the entity receiving their information.
We may update this Privacy Notice as Merchstead, its integrations, or applicable requirements change.
The current version will be published on this page with an updated effective date.
Where required, material changes will be communicated through the service, website, or email and consent will be obtained when applicable.
JCB Publishing LLC
4157 Fox Run Trl, Ste 1
Cincinnati, Ohio 45255, USA
Email: joseph.bily@merchstead.com