How we handle your data when we email your store

Who we are (controller)

Merchant Checkpoint is a trading name of Emanuel José Vargas Luís, NIF PT233800263, Avenida do Atlântico 16, 14º, Escritório 8, 1990-019 Lisboa, Portugal. Contact for privacy questions: hello@merchantcheckpoint.com.

Why we contacted you

We check the public pages of online stores against Google Merchant Center guidance. When we find a specific problem on your store's public pages, we send one email to your store's published business address to tell you about it and to offer our paid service, with at most one follow up.

Where we got your address

From your store's own public website. The exact page is named in the email we sent you. We do not buy email lists and we do not use personal names.

What data we hold

• Your store's domain and the business email address published on it.
• The page where we found the address.
• The date of our scan and the problems it found on your public pages.
• The dates of our emails, any reply you send us, and whether you asked us to stop.

Legal basis

Legitimate interest (GDPR Article 6(1)(f)). Our interest is to tell online businesses about specific, checkable problems on their own public pages and to offer a service that helps fix them. We keep this to businesses, to published business addresses, to low volume (one email and at most one follow up), and we make it easy to stop. We have written down this balance in a legitimate interest assessment, available on request.

How long we keep it

• If you never reply to us: we delete your data 90 days after our last email.
• If you reply, contact us or ask for a scan, but do not become a customer: we delete your data 24 months after our last contact with you.
• If you become a customer: for as long as the contract runs, plus 10 years for accounting records, the period Portuguese law requires us to keep accounting books, records and supporting documents (Decreto-Lei n.º 28/2019, article 19(1)).
• If you ask us to stop: we keep only your address (or a coded version of it) on our do not contact list, with no end date, so we never contact you again. We keep nothing else about you.

Who sees it

The service providers that store, send or process data for us:

• Cloudflare, Inc., United States: hosts our website and stores unsubscribe requests.
• ALWAYSDATA SARL, France: our email provider, which sends and receives our email.
• Anysphere, Inc., United States: provides Cursor, the software platform our assistants run on to read replies and run our scans.

We do not sell or share your data for anyone else's marketing.

Transfers outside the European Economic Area

Two of our providers are in the United States, so your data may be stored or accessed there:

• Cloudflare, Inc.: certified under the EU U.S. Data Privacy Framework. The European Commission decided on 10 July 2023 that this framework gives adequate protection (Implementing Decision (EU) 2023/1795). You can check the certification at https://www.dataprivacyframework.gov/participant/5666.
• Anysphere, Inc.: the European Commission's standard contractual clauses (Decision (EU) 2021/914), which are part of Anysphere's data processing addendum at https://cursor.com/terms/dpa.

Our email provider, ALWAYSDATA SARL, is in France, inside the European Union. To get a copy of these safeguards, write to hello@merchantcheckpoint.com.

Your right to object to direct marketing

You can object at any time to our use of your data for direct marketing, and we will then stop. To object, reply "stop" (or anything asking us to stop) to our email, open the unsubscribe link in it, or write to hello@merchantcheckpoint.com. We act on it within one business day.

Your other rights

You can ask us for access to your data, to correct it, to delete it, to restrict its use, or to receive it in a portable form. Write to hello@merchantcheckpoint.com with your request and the store domain it concerns; we answer within one month, as GDPR requires.

Complaints

You can complain to a data protection supervisory authority. In Portugal this is the Comissão Nacional de Proteção de Dados (CNPD), https://www.cnpd.pt. You can also contact the authority where you live or work.

No automated decisions

We do not make decisions about you with legal or similarly significant effects by automated means. Our scanner only reads public web pages.

Last updated: 17 October 2026