Privacy for merchant workspaces.

1. Our data roles

MyCover.me generally acts as controller for demo requests, merchant account administration, workspace security, service operations, billing, abuse prevention, and direct communications. For buyer order, product, warranty, and support data processed on a merchant’s documented instructions, the merchant generally acts as controller or business and MyCover.me as processor or service provider. A Data Processing Addendum will govern processor activities where required.

2. Information we collect

• Contact and account: name, work email, organization, role, membership, verification, and optional phone or communication preference.
• Workspace activity: authentication, sessions, permissions, searches, settings, cases viewed, assignments, messages, policy and resolution actions, and audit events.
• Ownership credential activity: issued QR or code status, scan or preview counts, last activity time, successful claim state, recovery reviews, and the verified claimant linked to the merchant’s own sold unit. Bearer secrets are encrypted and access is restricted.
• Commerce and integration: store identifiers, provider authorization state, scopes, sync status, products, orders, customers, webhook metadata, and errors. Secrets are stored through protected infrastructure and are not displayed in ordinary logs.
• Demo and sales: company, workflow interest, campaign parameters voluntarily delivered with the request, correspondence, and qualification status.
• Technical and security: IP-derived security signals, browser and device data, request and correlation IDs, rate-limit events, and diagnostic logs.

3. Sources and purposes

We receive information from you, your organization, authorized teammates, connected commerce providers, uploaded files, and security or infrastructure services. We use it to provide and secure the Console; verify identity; configure tenants and roles; connect authorized services; operate imports, coverage and support; respond to demos; prevent abuse; troubleshoot; meter plans; maintain audit history; and comply with law.

4. Buyer data processed for merchants

Merchant controls which authorized buyer, order, product, coverage, support, attachment, and service-history data enters its tenant. MyCover.me processes that information to provide the contracted workflow, security, backup, and support. Ownership recovery may include order number, account email, buyer name, shipping-address match, serial, receipt availability or evidence, scan activity, and claim outcome. Merchant and its authorized users may use that information only to verify ownership, administer coverage, prevent fraud, and provide post-purchase service—not for unrelated advertising or sale. Merchant must provide buyer notices and respond to rights requests, with MyCover.me assistance as required. Merchant A cannot access Merchant B records or unrelated products in a consumer’s wallet.

5. Sharing and subprocessors

We share information with authorized workspace users; relevant consumers and support providers; commerce services you connect; and vetted hosting, database, object storage, email, push, security, payment, observability, AI, and professional service providers. We may disclose information for law, safety, corporate transactions, or to protect rights. We do not sell personal information or share it for cross-context behavioral advertising. A production subprocessor list and change-notice process must be published before general availability.

6. Cookies and promotion measurement

The Console uses strictly necessary session and security cookies. The public site may preserve limited first-party campaign parameters long enough to attribute a demo request, without using them to build a cross-site profile. We do not currently use advertising cookies or third-party behavioral analytics. If that changes, we will provide a notice and consent or opt-out controls where required.

7. Your choices and rights

You can update account details, notification choices, and workspace access through the service or your administrator. Depending on where you live, you may request access, correction, deletion, portability, restriction, or objection, and withdraw consent. California residents may also have rights to know, correct, delete, limit certain sensitive-data uses, opt out of sale or sharing, and receive equal service. Because we do not sell or share personal information for cross-context behavioral advertising, no sale/share opt-out is currently required for those practices.

Email privacy@mycover.me. We verify sensitive requests and may direct merchant-controlled buyer requests to the relevant merchant.

8. Retention

• Demo requests: normally up to 24 months after the last substantive interaction.
• Authentication challenges: up to 30 days; expired or revoked sessions: normally up to 90 days.
• Application request logs: normally 30 days, subject to security investigations and provider lifecycle.
• Workspace, billing, audit, and merchant-directed buyer records: for the service relationship and applicable contractual, warranty, tax, legal-hold, and limitation periods, then deleted or de-identified as appropriate.

Backups expire through the backup provider’s documented lifecycle rather than being selectively rewritten immediately.

9. Security and international transfers

Controls include tenant-scoped authorization, role-based access, secure sessions, encryption in transit, private storage, signed access, upload validation, rate limiting, secret management, and audit events. No system is perfectly secure. Providers may process data outside your country. EEA transfers require an adequacy decision or safeguards such as Standard Contractual Clauses, an appropriate transfer assessment, and supplementary measures where required.

10. EEA release gate, children, and changes

EEA marketing and account activation must remain disabled until MyCover.me publishes its complete controller identity and postal address and confirms its Article 27 representative and DPO position, Data Processing Addendum, subprocessors, transfer safeguards, retention schedule, rights operations, and incident process. Merchant workspaces are not directed to children. Material changes will use a new version and appropriate notice.