Privacy Policy

Last Updated: November 10, 2025

1. Personal Information We Collect

Category Examples
Personal identifiers Name, address, email, billing address, phone number, social media handle, username/password, IP address
Protected class info Gender, age, date of birth
Commercial info Purchase/browsing history, product preferences, skincare info, survey responses, payment card info
Internet activity Device/browser type, website interaction behavior, operating system
Audio/visual info Customer service call recordings, photos/videos you upload or post
Inferences Profiles built from the above data

2. Purposes for Collection

  1. Products & Services — order processing, payments, shipping, account management
  2. Advertising & Marketing — personalized recommendations, promotional emails/SMS, loyalty program
  3. Security — cyber-attack prevention, fraud detection, system security monitoring
  4. Business Development — data analytics, product improvement, internal operations
  5. Legal Compliance — regulatory inquiries, data breaches, legal claims

3. Data Sale & Targeted Advertising

  • MERIT does sell or share the following for cross-context behavioral advertising: personal identifiers (including IP address, mobile advertising IDs) and internet activity information
  • Partners include ad networks, Google, Meta, and others
  • Third-party cookies collect your cross-site browsing behavior
  • Opt out: via the “opt out” link on the privacy policy page, or by enabling the Global Privacy Control (GPC) browser signal
  • MERIT does not respond to DNT (Do Not Track) signals, but does recognize GPC signals

4. Cookies & Tracking

  • Uses cookies, pixel tags, web beacons, and similar technologies
  • Purposes: remember preferences, analyze site usage, fraud prevention, personalized ads
  • Third parties (Google, Meta) also place cookies on the site
  • You can block cookies via browser settings or www.youradchoices.com
  • Uses Google Analytics for traffic analysis

5. Data Retention

  • Retained for as long as needed for legitimate business purposes
  • Factors: duration needed to provide services, type of data, legal retention obligations

6. Cross-Border Transfers

  • Site is hosted in the U.S.; your data will be transferred to and stored in the U.S.
  • For EEA/UK users, transfers are protected by Standard Contractual Clauses (SCCs)

7. Loyalty Program (Merit Loyalty Program)

  • Voluntary enrollment; requires name, email, shipping/billing address
  • Estimated data value: approximately $3 per member
  • Cancel anytime by emailing [email protected]
  • No discrimination for exercising your rights

8. Your Rights

U.S. Residents (CA, CO, CT, DE, MT, NE, NH, NJ, OR, TX, UT, VA):

  • Right to Know, Access/Copy, Delete, Correct
  • Right to Opt Out of sale, targeted advertising, and cross-context behavioral sharing
  • Response time: 45 days for general requests; 15 business days for opt-outs

EEA/UK Residents (GDPR):

  • Access, Rectification, Erasure, Restriction, Data Portability, Objection, Withdraw Consent, Lodge a Complaint

Australian Residents:

  • Access, Correction, Lodge a Complaint

How to exercise: Submit via the DSAR form on the website, or email [email protected]

9. Children’s Privacy

  • Site is not directed to children under 13
  • Does not knowingly collect or sell personal information from minors under 18

10. Data Security

  • Administrative, technical, and physical safeguards in place
  • Absolute security cannot be guaranteed; risks exist during transmission and on mobile devices