Effective date: July 14, 2026
Information we collect
We collect the information you choose to provide through the Merchant Readiness Assessment and lead form. This may include assessment responses about your industry, operating history, processing activity, transaction profile, recurring billing, customers, fulfillment, processor history, terminations, MATCH/TMF status, chargebacks, and refund practices.
We also collect the business website URL you submit and contact information such as your full name, company name, business email, and phone number.
Website and AI analysis
When available, Merchant Blueprint may retrieve publicly accessible content from the submitted business website and related public policy pages. Assessment responses and publicly available website content may be sent to OpenAI to generate educational observations. OpenAI does not determine or modify the rules-based Merchant Readiness Score or approval outlook.
How information is used
We use submitted information to calculate the rules-based assessment, generate AI-assisted observations, prepare the Merchant Blueprint Readiness Report, save your lead submission, deliver requested emails, support consultation scheduling, prevent abuse, and improve the platform.
Storage and service providers
Assessment and contact information is stored using Supabase. OpenAI is used to generate AI-assisted analysis from submitted assessment data and available public website content. Resend is used to deliver assessment and report emails. Calendly may be used when an eligible merchant elects to schedule a review. Each provider processes information according to its own terms and privacy practices.
Cookies and local storage
The application uses essential browser storage to preserve unfinished questionnaire answers on the same device for up to seven days. This draft does not include API keys, generated reports, or server secrets, is never automatically submitted, and is cleared after a report is successfully saved or when you choose to start over. Google Analytics and Microsoft Clarity may also use cookies or similar identifiers to distinguish visits and produce aggregate usage information when those services are configured.
Analytics
Merchant Blueprint uses Google Analytics 4 in production to understand aggregate traffic, page usage, assessment progress, report interactions, PDF downloads, scheduling activity, and contact-form completion. Google may process device, browser, approximate location, referral, and interaction information according to its own privacy terms. Merchant Blueprint configures its analytics events to avoid sending names, email addresses, phone numbers, company names, submitted websites, assessment answers, or report identifiers. Saved report routes are generalized before page-view tracking so their unique identifiers are not transmitted.
Merchant Blueprint also records limited first-party product events in Supabase, including page views, assessment progress, report interactions, downloads, contact submissions, scheduling interactions, and lead-status changes. Random browser and session identifiers, first landing page, referral path, and campaign parameters may be stored to understand aggregate conversion paths. These identifiers are not fingerprints, are not derived from contact information or IP addresses, and original first-touch attribution is not overwritten on later visits.
When configured in production, Merchant Blueprint also uses Microsoft Clarity to understand how visitors navigate public pages through session-replay, heatmap, and interaction data. Microsoft may collect device, browser, approximate location, page-navigation, click, scroll, and diagnostic information and may use cookies or similar technologies according to its privacy terms. Clarity is loaded once in the shared application layout, automatically observes navigation within the single-page application, and is not initialized during local development.
Data retention and security
We retain information for as long as reasonably necessary to deliver the assessment, respond to inquiries, maintain business records, prevent misuse, and satisfy applicable obligations. We use reasonable administrative and technical safeguards, but no internet service can guarantee absolute security.
Your choices and rights
Depending on your location, you may have rights to request access, correction, deletion, restriction, or a copy of personal information, or to object to certain uses. Assessment and requested follow-up communications are separate from optional marketing emails. If you opt in to broader educational or marketing emails, you may unsubscribe at any time. We may need to verify your identity before fulfilling a request.
Contact
For privacy questions or requests, use the secure Merchant Blueprint contact form. Messages are delivered to contact@merchantblueprint.com.