Privacy Policy

TransactionMerge is currently offered as a free beta service, operated in England, United Kingdom. We are the data controller for information collected through transactionmerge.co.uk. We are in the process of registering with the Information Commissioner's Office (ICO) as a data controller. Contact us at transactionmerge@gmail.com or chat with us.

We collect and process the following:

• Waitlist data — your email address, and your name if you give one, when you join the waitlist
• Account data — your name, email address, and hashed password when you register
• eBay connection data — your eBay username, OAuth tokens (encrypted at rest), and account type (business/personal)
• FreeAgent connection data — your FreeAgent email, OAuth tokens (encrypted at rest), and nominated bank account
• Transaction data — eBay financial transaction records (amounts, dates, order IDs, descriptions) processed in order to perform the sync
• Usage data — sync history, settings, and session logs for troubleshooting

• eBay listing, order, messaging, or buyer data beyond financial transactions
• Payment card details (handled by our payment processor)
• Any data from FreeAgent beyond bank account identity needed to post transactions

• To provide the transaction sync service you have subscribed to
• To authenticate your sessions securely
• To send you service-related emails (account alerts, sync failures, billing)
• To investigate and resolve support queries

We do not use your data for marketing, profiling, or sale to third parties.

Support access. To diagnose or fix an issue you have reported, authorised support staff may temporarily access your account to view your data and settings as you see them, and — where needed to resolve the issue — take the same corrective actions you can (for example, re-syncing or removing and rebuilding synced transaction records). Any such access is time-limited, recorded in an audit log attributing each action to the staff member, and never exposes your eBay or FreeAgent login credentials. Their access is limited to your TransactionMerge account — your settings and synced transaction records — not your eBay or FreeAgent accounts themselves; and as noted in section 3, we never hold your eBay messages, buyer details, or listings.

• Contract — processing necessary to deliver the service you have subscribed to
• Legitimate interests — security logging and fraud prevention
• Legal obligation — retaining records as required by UK law

We retain your account and transaction data for as long as your account is active plus 12 months. On account deletion we remove all personal data within 30 days, except where retention is required by law. Sync history logs are retained for 90 days for troubleshooting purposes. Waitlist details are used only to contact you about access to the beta, and are kept until you register or ask us to remove them.

We share data only with:

• eBay — via OAuth, to read your financial transaction data
• FreeAgent — via OAuth, to post transactions to your account, re-sync or remove records it previously created there, and — only with your explicit confirmation, and always naming exactly what will be removed first — delete a specific existing entry it did not create that is blocking your chosen sync start date
• Hosting providers — Render (backend) and Vercel (frontend), both operating under GDPR-compliant data processing agreements
• Google Analytics — aggregated website usage data (pages visited, general location, device type) to understand site traffic
• Crisp — our live chat widget; if you start a chat, your messages are processed by Crisp to deliver the conversation. If you are signed in, we also pass your name and email address to Crisp when the chat opens, so we know who we are talking to

We do not use these tools for advertising, and we do not sell or share your data with any advertising network.

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data ("right to be forgotten")
• Object to or restrict processing
• Lodge a complaint with the ICO at ico.org.uk

To exercise any of these rights, email transactionmerge@gmail.com. We will respond within 30 days.

We use a session cookie to keep you logged in. Google Analytics and Crisp (our live chat widget) may also set their own cookies to provide website analytics and chat functionality. Neither is used for advertising or to track you across other websites.

OAuth tokens are encrypted at rest. All data in transit is protected by TLS. Sessions expire after 10 minutes of inactivity. We apply security best practices and review them regularly.

We will notify you by email before making material changes to this policy. The current version is always available at transactionmerge.co.uk/privacy.