1. Data Collected

MergeFrame collects the bare minimum:

• Email: only if you create an account (optional).
• Payment data: handled by Stripe, never stored by MergeFrame.
• Anonymous usage data: page views, visit duration, country of origin (via Google Analytics 4, with anonymized cookies).

2. Images

Your images never leave your browser. MergeFrame uses your browser's Canvas API to assemble images. No network upload takes place. MergeFrame cannot see, store, or access your images.

3. Cookies

MergeFrame uses essential technical cookies (Supabase authentication session) as well as a Google Analytics 4 cookie for anonymous audience measurement. No advertising tracking cookies are used. You can refuse analytics cookies via the consent banner or your browser settings.

4. Legal Basis (GDPR)

• Contract performance: processing necessary to provide the service.
• Legitimate interest: anonymous analytics to improve the service.
• Consent: for Google Analytics 4 analytics cookie and marketing emails (if offered in the future).

5. Your Rights

In accordance with the GDPR, you have the right to access, rectify, erase, and port your data. Contact: contact@mergeframe.com.

6. Subprocessors

• Vercel (hosting) — United States, EU-US Data Privacy Framework (DPF).
• Supabase (authentication) — United States, EU-US Data Privacy Framework (DPF).
• Stripe (payments) — United States, EU-US Data Privacy Framework (DPF).
• Google (GA4 — analytics) — United States, EU-US Data Privacy Framework (DPF).