Privacy Policy

Who is responsible for personal data

Merchant Group AS is the controller for personal data about merchants and their staff that we collect to operate the B2B Nordic app and our websites (including merchant.no), and for personal data collected on merchant.no.

For personal data that business applicants submit on a merchant's storefront signup form, the merchant is the controller. Merchant Group AS processes that applicant data on the merchant's behalf as a processor, solely to provide the app's services.

The privacy notice text that merchants can customize on the signup form (shown to applicants under the submit button) is the merchant's own notice to their customers. It is separate from this Privacy Policy.

Information we collect through Shopify's APIs

When a merchant installs B2B Nordic, we access Shopify Admin APIs using the scopes the merchant grants. We collect and use:

• Shop identity and settings: shop domain, display name, store contact email, primary domain URL, and Shopify plan information.
• Companies, company contacts, and company locations that the app creates or updates for B2B signup and approval flows.
• Markets, payment terms templates, and shipping method names needed to configure signup markets and B2B checkout options.
• Aggregated order counts (not order line items or buyer names) to recommend partner integration packages.

Information we collect directly from merchants

Merchants and their staff may provide:

• Notification email addresses for new signup alerts.
• App configuration: enabled markets, approval rules, form design and copy, email templates, payment and delivery customization settings, and related preferences.
• Integration requests for accounting, payments, or shipping partners (including contact details in those requests).
• Identity of the logged-in Shopify staff member when opening in-app support chat (Zendesk), so we can help the right store.

Information we collect from merchants' customers (applicants)

Business applicants submit data on the merchant's storefront signup form. We store that data so the merchant can review applications and so we can create B2B companies in Shopify. Typical fields include:

• Company legal name and organization number.
• Shipping and billing addresses, and contact first name, last name, email, and phone.
• Optional email and SMS marketing consent choices when the merchant enables those fields.
• Submission locale, and a snapshot from official business registries (Brønnøysund Register Centre in Norway, CVR in Denmark, or YTJ/PRH in Finland) when registry lookup is required.
• Technical metadata: source IP address and user agent for abuse prevention and support.

How we use the information

We use the information only to provide B2B Nordic's services:

• Run the storefront signup form, validate addresses and organization numbers where configured, and create or update Shopify companies and contacts.
• Send transactional emails (for example registration received, approved, or rejected) and merchant notification emails.
• Support approvals, auto-approve rules, and B2B-only payment or delivery options in checkout.
• Recommend partner packages using aggregated order volume, and fulfill support requests.

We do not use this information for purposes other than providing the app's services. We do not sell personal data or use it for third-party advertising.

Cookies and similar technologies

We do not use advertising cookies or sell personal data.

When a merchant enables Google reCAPTCHA v3 on the signup form, Google may set cookies or similar technologies and process device and interaction signals to score submissions for bot protection. That processing happens only when reCAPTCHA is enabled for that shop.

When a merchant enables address autocomplete or validation for a market, we send address text the applicant types to Geoapify to suggest or verify addresses. Registry-filled addresses are not re-validated through autocomplete.

Session cookies or tokens are used for Shopify authentication inside the embedded admin app. Public pages such as this Privacy Policy do not require a login cookie.

How long we retain data

We keep personal data only as long as needed to provide the app and meet legal obligations.

When a merchant uninstalls the app, we delete Shopify sessions and the shop record in our database. Related registrations and settings are removed with that shop record.

Shopify mandatory compliance webhooks: customers/data_request gathers stored applicant personal data for that customer and emails it to the merchant's notification recipient; customers/redact replaces contact and address personal data on matching registrations with placeholders while keeping the registration row for quotas and history; shop/redact deletes remaining shop and session data after uninstall.

Where information is stored and processed

Our application database is hosted in Frankfurt, Germany (European Union).

Some subprocessors may process data outside the European Economic Area, including Google (reCAPTCHA, when enabled), Resend (transactional email), and Zendesk (support chat).

Geoapify (address services), the Peppol Directory (EHF eligibility lookups for Norwegian companies), and Nordic business registries operate primarily in Europe.

We are established in Norway (Europe). If you have questions about international transfers, contact us using the details below.

Sharing and subprocessors

We do not sell personal data, and we do not use it for advertising or unrelated analytics products. We share data with:

• Shopify, to create and manage companies, contacts, locations, catalogs, and checkout customizations as directed by the merchant.
• Email delivery (Resend) for transactional and notification messages.
• Google reCAPTCHA, Geoapify, Peppol Directory, and Nordic registries when those features are used for a signup.
• Zendesk when merchants open support chat.
• Optional partner integrations (for example accounting, payments, or shipping) only when the merchant requests them; those partners process data under their own agreements with the merchant.

Your rights and choices

Merchants and individuals may request access, correction, or deletion of personal data we hold, subject to applicable law and our role as controller or processor.

Applicants should contact the merchant store first for requests about signup data. We support Shopify compliance webhooks so merchants can fulfill customer data requests and redaction requests.

You can contact us at the email or address below. We respond within a reasonable time.

How to contact us

For privacy questions about B2B Nordic or Merchant Group AS: