Who we are
Merch Invoice is provided by Karma Holdings LLC, doing business as Merchly ("Merchly", "we", "us"). This policy covers merchinvoice.com, the Merch Invoice app, the pay pages and customer portal we host for businesses, and the emails we send. It applies to the businesses that use Merch Invoice ("merchants"), the people who work for them, our referral partners, and visitors to our website.
Information we collect
Information you give us
- Account details: your name, work email, phone number, business name and role, and your sign-in credentials. Passwords are stored only as secure hashes.
- Payment account details: information needed to open a payment account, such as legal business name, tax ID, ownership details and the bank account for deposits. We pass this to our payment processing partners for approval.
- Settings: the fees, reminder schedule, branding and QuickBooks accounts you choose.
- Website forms and support: what you send us when you request access, apply to partner, or contact support.
Information from QuickBooks Online, with your permission
When you connect QuickBooks Online, we receive the data described in QuickBooks data below.
Information from your customers when they pay
When someone pays an invoice, we receive their name, email, billing address and payment details. Card and bank account numbers are entered directly into hosted payment fields provided by our PCI DSS compliant processing partners and never reach our servers. We keep only a token, the card brand or bank name, the last four digits and the expiry date.
Information collected automatically
Our servers record technical data such as IP address, browser type, pages requested and times, to keep the service secure and working. We don't use advertising cookies or cross-site tracking.
How we use information
- To provide Merch Invoice: send invoices, pay links, reminders and receipts, take payments, and record them in QuickBooks.
- To open and maintain your payment account with our processing partners.
- To secure accounts, verify sign-ins and detect fraud or misuse.
- To provide support and tell you about changes to the service.
- To bill you for Merch Invoice.
- To monitor reliability and improve the service, using aggregated or de-identified data where we can.
- To meet legal, tax and card-network obligations.
We may email merchants and partners about Merch Invoice, and you can opt out of those emails at any time. We never market to your customers.
QuickBooks data
With your authorization through Intuit, Merch Invoice accesses your QuickBooks Online company using the accounting permission. We read company details, invoices, customers, your chart of accounts and payments you record yourself, and we write payments, fee lines and items, deposits, refunds and voids. The full list is on How Merch Invoice works with QuickBooks Online.
- We use QuickBooks data only to provide the service you asked for.
- We don't sell QuickBooks data or use it for advertising.
- We share it only with the service providers we need to run Merch Invoice, under confidentiality obligations.
- You can disconnect at any time from Merch Invoice or from QuickBooks Online. When you do, we revoke our access and stop reading and writing your QuickBooks data.
How we share information
We share information only as described here:
- Service providers that run parts of Merch Invoice for us: payment processing and gateway partners and their sponsor bank, cloud hosting and database providers in the United States, email delivery, and error monitoring. They may use the information only to provide their services to us.
- Intuit, when we write to your QuickBooks Online company at your direction.
- Your customers, who see your business name, logo and invoice details on pay pages, emails and receipts.
- Your referring partner, if a Merchly partner introduced you: your business name, account status and processing totals, so the partner can be paid.
- Legal and safety: when required by law, to respond to legal process, or to protect the rights, property or safety of our users, the public or us.
- Business transfers: as part of a merger, acquisition or sale of assets, with notice to you.
We do not sell personal information, and we don't share it for cross-context behavioral advertising.
Your customers' information
For information about a merchant's customers, we act as a service provider to that merchant and process it on the merchant's instructions. The merchant's own privacy policy applies. If you paid a business through Merch Invoice and have a privacy request, contact that business; we'll help them respond.
Cookies
We use only cookies that are necessary to run the site and keep you signed in. We don't use advertising, analytics-sharing or cross-site tracking cookies.
How long we keep information
- Account and settings data: while your account is open, then as described in Deleting your data.
- Payment records: as long as the law, card-network rules and our processing partners require, generally up to seven years.
- Website inquiries we don't turn into accounts: up to 24 months.
- Server logs: for shorter periods, as needed for security and troubleshooting.
Deleting your data
To close your account and delete your data, email support@merchly.io from the email address on your account. We'll confirm the request, disconnect QuickBooks if it's still connected, and delete or de-identify your data within 30 days, except records we're legally required to keep, which we retain only for that purpose.
Disconnecting QuickBooks stops our access but doesn't delete what we already hold. Ask us to delete it if that's what you want.
Security
We encrypt data in transit and at rest, encrypt QuickBooks access tokens and payment keys with AES-256-GCM, require two-step sign-in for every user, and keep each business's records separate. No system is perfectly secure; if a breach affects your information, we'll notify you as the law requires. Read more on our security page.
Your privacy rights
Depending on where you live, including California and other US states with privacy laws, you may have the right to know what personal information we hold about you, to get a copy, to correct it, to delete it, and to opt out of marketing. We won't treat you differently for using these rights. To make a request, email support@merchly.io or call 844-327-6247. We'll verify your identity and respond within 45 days. You can use an authorized agent with your written permission.
Children
Merch Invoice is a business service and isn't directed to anyone under 18. We don't knowingly collect information from children.
Changes to this policy
We'll post any changes here and update the date at the top. If a change materially affects how we use your information, we'll email account owners before it takes effect.
Contact us
Karma Holdings LLC, d/b/a Merchly
701 E Franklin St, Ste 105-1413, Richmond, VA 23219
support@merchly.io · 844-327-6247