Merchuno Privacy Policy

Effective date: 1 October 2026

This policy explains how Hakkı Eren, doing business as “Eren Labs” (“we”, “us”), handles personal data in connection with Merchuno, our plugin for WordPress and WooCommerce. It is also available in Turkish, together with our information notice under Türkiye’s Personal Data Protection Law (KVKK Aydınlatma Metni).

1. Who is responsible

We are the controller (in KVKK terms, “veri sorumlusu”) of the personal data described in this policy.

• Hakkı Eren (Eren Labs)
• Address: Av. Bilal Güdük Cad. No: 40/A, Eynesil / Giresun, Türkiye
• Privacy contact: support@erenlabs.net

2. What this policy covers

This policy covers personal data we process when you:

• visit the Merchuno website at erenlabs.net/plugins/merchuno or contact us;
• start a Trial, or buy, activate or renew Merchuno Pro;
• use Merchuno Lite and choose to share data with us;
• ask for support or send us feedback; or
• receive service or marketing messages from us.

It does not cover:

• Your store data. Merchuno runs on your own WordPress site. Your orders, customers, products and payments stay in your database, and you are their controller. Our Merchant Data Statement explains this.
• The checkout. Freemius processes your payment as the seller of record, under its own privacy policy.
• Services you connect to Merchuno, such as carriers. They have their own privacy policies.
• WordPress.org, which hosts Lite and its support forum under its own privacy policy.

3. What the Merchuno plugin sends to us, and what it does not

3.1 Never sent. Merchuno does not send us your orders, customers, products, payments, cash records or any other store data. We do not host this data and we cannot see it.

3.2 License activation and updates (Pro). Licensing and updates run through Freemius, which processes the following data for us when you activate a License Key and when your site checks for updates:

• your site’s home URL;
• the Merchuno and Freemius SDK versions, and whether Merchuno is active, deactivated or uninstalled;
• the License Key and its activation status; and
• only if you allow it on the activation screen: your WordPress and PHP versions, site language and title, and the list of installed plugins and themes (names, versions and whether they are active).

Freemius already knows the license owner’s name and email address from the purchase. As with any internet connection, Freemius also sees your server’s IP address.

3.3 Trials and optional data sharing (Lite). When you start a Trial, or when you click “Allow & Continue” on the screen that Lite shows after activation, Freemius receives:

• the first and last name and the email address of the WordPress user who clicked;
• your site’s home URL and title, your WordPress and PHP versions and the site language;
• the Merchuno and SDK versions, and whether Merchuno is active, deactivated or uninstalled; and
• the list of installed plugins and themes, unless you switch this off on that screen.

If you click “Skip” in Lite, none of this is sent. You can opt in or opt out later from the Plugins screen in WordPress.

3.4 Deactivation feedback. If you choose to tell us why you are deactivating Merchuno, your answer reaches us through Freemius. If you have not opted in, it is sent anonymously unless you choose to send it with your details.

3.5 Contact page inside Merchuno. Messages you send through the contact page inside Merchuno reach us through Freemius, together with your account details.

3.6 Support reports. Merchuno can create a support report with technical information, such as versions, active plugins, health check results and counts. It is designed to leave out customer details, and it reaches us only if you send it to us.

3.7 Connections you set up. When you connect a carrier, publish product feeds or use other integrations, data travels directly from your site to that provider, not to us. Our Merchant Data Statement lists these data flows.

4. Why we use personal data, and on what legal basis

For each purpose below, we list the data, the legal basis under the GDPR (where it applies to you) and under KVKK, and how long we keep the data.

4.1 Running and securing the website

• Data: IP address, browser and device information, pages visited, referring page, date and time.
• Legal basis: our legitimate interest in operating and protecting the website (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
• Retention: server logs for 90 days.

4.2 Website analytics cookies

• Data: cookie identifiers, usage events and approximate location derived from your IP address, collected through Google Analytics.
• Legal basis: your consent (GDPR Art. 6(1)(a); KVKK Art. 5(1), explicit consent).
• Retention: the cookies last as shown in the cookie list (Section 11); Google Analytics keeps the event data for at most 14 months.

4.3 Answering your enquiries

• Data: name, email address, company, your message and anything you add to it.
• Legal basis: steps taken at your request before a contract and our legitimate interest in answering you (GDPR Art. 6(1)(b) and (f); KVKK Art. 5(2)(c) and (f)).
• Retention: 2 years after our last contact.

4.4 Selling and managing licenses

• Data: name, email address, company, billing country and address, VAT number (if you give one), plan, License Key, activated site URLs, subscription status and the transaction details we receive from Freemius. We do not receive full card numbers.
• Legal basis: performance of our contract; our legal obligations, such as accounting and tax rules; and our legitimate interest in preventing fraud and license misuse (GDPR Art. 6(1)(b), (c) and (f); KVKK Art. 5(2)(c), (ç) and (f)).
• Retention: for the duration of the contract and then 10 years for commercial and tax records.

4.5 Activating licenses and delivering updates

• Data: the installation data listed in Section 3.2.
• Legal basis: performance of our contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
• Retention: while the installation is active, then 24 months.

4.6 Trials and optional data sharing in Lite

• Data: the data listed in Section 3.3.
• Legal basis: for Lite, your consent (GDPR Art. 6(1)(a); KVKK Art. 5(1)); for Trials, performance of the Trial (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)). You can withdraw your consent at any time by opting out.
• Retention: until you opt out or the Trial ends, then 24 months.

4.7 Support and feedback

• Data: name, email address, site URL, license details, your messages, screenshots, support reports and any other data you send us.
• Legal basis: performance of our contract and our legitimate interest in improving Merchuno and its documentation (GDPR Art. 6(1)(b) and (f); KVKK Art. 5(2)(c) and (f)).
• Retention: 3 years after the request is closed. Any access to your site that you gave us is removed when the request is closed.

4.8 Service messages

• Data: name and email address, used for security notices, license and billing notices and changes to our terms.
• Legal basis: performance of our contract and our legitimate interest in keeping customers informed (GDPR Art. 6(1)(b) and (f); KVKK Art. 5(2)(c) and (f)).
• Retention: for the duration of the customer relationship.

4.9 Marketing emails

• Data: name, email address and your preferences.
• Legal basis: your consent; or, for existing customers where the law allows it, our legitimate interest in telling you about similar products (GDPR Art. 6(1)(a) or (f)). Under KVKK, your explicit consent (Art. 5(1)); for merchants and tradespeople, Law No. 6563 allows such messages without prior consent until they opt out (KVKK Art. 5(2)(a) and (f)). Every marketing email has an unsubscribe link.
• Retention: until you unsubscribe. We then keep your address on a suppression list so that we do not write to you again.

4.10 Legal obligations and legal claims

• Data: any of the data above, as needed.
• Legal basis: our legal obligations and our legitimate interest in establishing, exercising or defending legal claims (GDPR Art. 6(1)(c) and (f); KVKK Art. 5(2)(ç) and (e)).
• Retention: as long as the law requires or until the claims are time-barred.

5. Do you have to give us your data?

To buy, activate and use Pro, we and Freemius need the data in Sections 3.2 and 4.4; without it we cannot provide a License, updates or support. Sharing data from Lite, subscribing to marketing emails and accepting non-essential cookies are optional.

6. How we collect personal data

• From you: through forms, emails, support requests and the activation and opt-in screens in the plugin.
• Automatically: through server logs and cookies on our website, and through the Freemius SDK in the plugin, as described in Section 3.
• From Freemius: purchase, subscription and license data.
• From WordPress.org: if you post in the Lite support forum, we see your public username and posts.

7. Who receives personal data

• Freemius, Inc. (USA): our reseller and merchant of record, and our licensing and update platform. Freemius processes the checkout and payments under its own privacy policy, and it processes license and installation data on our behalf under a data processing agreement. Freemius uses its own providers, such as Stripe and PayPal for payments and Amazon Web Services and Cloudflare for hosting.
• Our service providers, who process data on our behalf: Hostinger (website hosting and email) and Google (Google Analytics, set up through Google Site Kit, for website analytics).
• Professional advisers, such as lawyers, accountants and auditors, who are bound by confidentiality.
• Courts and public authorities, when the law requires it or to protect our rights.
• A buyer or successor, if our business or part of it is sold, merged or transferred to a company.

We do not sell personal data.

8. International transfers

8.1 We are based in Türkiye. Freemius and its providers process data in the United States and in other countries, and some of our own providers may be located outside Türkiye and the EU/EEA.

8.2 GDPR and UK GDPR. When personal data is transferred from the EU/EEA or the UK to a country without an adequacy decision, the transfer relies on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses (with the UK Addendum where relevant), or, where appropriate, on a derogation under Article 49 GDPR, for example where the transfer is necessary to perform our contract with you. Freemius’ data processing agreement includes the Standard Contractual Clauses.

8.3 KVKK. Under Article 9 of KVKK, we transfer personal data abroad where the Personal Data Protection Board has made an adequacy decision for the country concerned. Otherwise we rely on appropriate safeguards, such as the standard contracts announced by the Board, which are notified to the Personal Data Protection Authority within five business days of signature. For occasional transfers only, we may rely on the exceptions listed in Article 9, such as your explicit consent after being informed of the possible risks, or where the transfer is necessary to perform a contract with you.

8.4 You can ask us for information about these safeguards.

9. How long we keep personal data

We keep personal data only for as long as the purposes in Section 4 require and the law obliges us to. When a retention period ends, we delete, destroy or anonymize the data. We may keep it longer where it is needed for legal claims or where the law requires it; for example, Turkish law requires commercial books and records to be kept for up to 10 years.

10. Security

We use appropriate technical and organizational measures, such as encrypted connections (TLS), access limited to people who need it, two-factor authentication on our accounts, confidentiality commitments and careful selection of providers. No method of transmission or storage is completely secure. If a personal data breach occurs, we will notify the competent authority and the people affected where the law requires it.

11. Cookies

11.1 The website. The Merchuno pages are part of erenlabs.net, which uses these cookies:

Google Analytics is loaded, and its cookies are set, only if you accept analytics cookies in our cookie banner. You can change your choice at any time through the “Cookie settings” link at the bottom of each page; if you reject, the Google Analytics cookies are deleted.

WordPress sets its own sign-in cookies only for people who log in to the site’s administration area. You can block or delete cookies in your browser settings.

11.2 Checkout. The Freemius checkout uses its own cookies, under Freemius’ policies.

11.3 The plugin on your site. The cookies and browser storage that Merchuno uses on your own site are part of your site, not ours. Our Merchant Data Statement describes them.

12. Your rights

12.1 Under the GDPR (where it applies to you), you have the right to:

• access your personal data;
• have inaccurate data corrected;
• have your data erased;
• restrict processing;
• receive your data in a portable format;
• object to processing based on our legitimate interests, and object at any time to direct marketing;
• withdraw your consent at any time, without affecting processing that took place before; and
• complain to a data protection supervisory authority, in particular in the country where you live or work or where an infringement took place.

12.2 Under Article 11 of KVKK, you have the right to:

• learn whether your personal data is processed;
• request information about the processing;
• learn the purpose of the processing and whether the data is used in line with that purpose;
• know the third parties in Türkiye or abroad to whom your data is transferred;
• request correction of incomplete or inaccurate data;
• request deletion or destruction of your data under the conditions in Article 7 of KVKK;
• request that corrections, deletions or destructions be notified to the third parties to whom your data was transferred;
• object to a result against you that arises from analysis carried out exclusively by automated systems; and
• claim compensation if you suffer damage because of unlawful processing.

12.3 How to exercise your rights. Write to support@erenlabs.net. We may ask you to confirm your identity.

For applications under KVKK, the law requires the application to be in Turkish and made by one of these methods:

• in writing, with your wet signature, to Av. Bilal Güdük Cad. No: 40/A, Eynesil / Giresun, Türkiye;
• with a secure electronic signature or a mobile signature; or
• by email to support@erenlabs.net from the email address you previously gave us and that is registered in our systems.

Your application must include your name and surname, your signature (for written applications), your Turkish identity number (for Turkish citizens) or your nationality and passport or identity card number (for foreign nationals), your residential or business address for notifications, your email address, phone or fax number if you have one, and the subject of your request, with any supporting documents.

We will answer as soon as possible and within 30 days at the latest, free of charge. If answering involves an extra cost, we may charge the fee set by the Personal Data Protection Board: for written answers, the first ten pages are free and each further page may cost TRY 1; for answers on a storage medium, no more than the cost of the medium. If we reject your application, if you find our answer insufficient, or if we do not answer in time, you may complain to the Personal Data Protection Board within 30 days after receiving our answer, and in any case within 60 days after your application.

13. Children

Our services are for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe that a child has given us personal data, contact us and we will delete it.

14. Automated decisions

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.

15. Changes to this policy

We may update this policy. We will publish each new version with its effective date. If a change is material, we will also tell customers by email or inside Merchuno.

16. Contact

• Hakkı Eren (Eren Labs)
• Address: Av. Bilal Güdük Cad. No: 40/A, Eynesil / Giresun, Türkiye
• Privacy contact: support@erenlabs.net