What we collect. And why.

Mercer is a Shopify theme developed by ZBANG LTD. This page covers mercertheme.com — the marketing and documentation site you are on now. It does not cover what your own Shopify storefront collects when you install Mercer. That is governed by Shopify policies and your own.

What we collect

• Support form submissions — when you contact us via /support, we receive: name, email, store URL, issue type, subject, message, optional files you attach, plus diagnostic metadata (user-agent, referrer, IP hint, submission timestamp).
• Anti-spam verification — we use Cloudflare Turnstile to verify form submissions are not from bots. Cloudflare processes some technical signals (IP, browser fingerprint) to issue verification tokens.
• Server access logs — Vercel (our hosting provider) logs basic HTTP request data for ~7 days, used for debugging and abuse prevention.

What we do not collect

• Analytics — no Google Analytics, no Plausible, no third-party trackers. The browser console is your only tracker on this site.
• Cookies for tracking — we set no cookies on mercertheme.com. (Cloudflare Turnstile may set a short-lived security cookie on its own iframe; we do not read it.)
• Cross-site identifiers — we do not fingerprint, do not share data with ad networks, and do not build merchant profiles.

How we use what we collect

Support form data is used only to respond to your inquiry. It is sent via Resend (a transactional email service) to our support inbox and to send your confirmation receipt. Attached files are delivered to the support inbox only; the confirmation receipt does not echo them back. We do not use support data for marketing, do not sell it, and do not share it.

Retention

• Resolved support threads — retained for 18 months after the last reply, then deleted from our inbox.
• Open support threads — retained until resolved.
• Server logs— Vercel's default ~7 days; we do not extend.

Your rights

You can request a copy of your data, correct it, or delete it. Email privacy@mercertheme.com and we will respond within 30 days.

If you are in the EU, UK, or California, you have specific rights under GDPR, UK-GDPR, and CCPA respectively, including the rights of access, rectification, erasure, restriction, portability, and objection. The contact above is the way to exercise them.

Third parties

The services that touch your data on this site:

• Vercel — hosting and edge network. Vercel privacy policy (opens in a new window)
• Cloudflare — Turnstile bot verification. Cloudflare privacy policy (opens in a new window)
• Resend — transactional email delivery for support form submissions and receipts. Resend privacy policy (opens in a new window)
• Upstash — Redis-backed rate limiting for the support form; processes a per-IP key to throttle abuse. Upstash privacy policy (opens in a new window)

Updates

If we change this policy materially, we update the date at the top. The last-updated stamp is the definitive version. Significant changes get a banner notice for 30 days.

Contact

ZBANG LTD · privacy@mercertheme.com