OpenMerchant privacy policy

Effective July 29, 2026 · v0.3 draft

1. Overview

This policy describes how Procura Payments Inc, doing business as OpenMerchant, handles two kinds of data: information about you, the merchant, and information that passes through your endpoints when agents shop your catalog. It explains what we collect, why, and what we never touch.

2. What we collect

Account data: your name, work email, and business details. Catalog data: the products, services, prices, and stock you import. Endpoint logs: which agents requested your catalog, what they queried, and what they ordered — kept as an audit trail. Waitlist data: the email you submit, used only to send your invite.

3. What we never collect

Buyer card numbers and payment credentials. Payments are authorized through protocol credentials (MPP) or mandates (AP2) and processed by your payment provider. Card data never transits OpenMerchant systems.

4. How we use data

To operate and sign your endpoints, publish your catalog to agent surfaces, detect fraud and abuse, and send you operational email about your account. We do not use your catalog or order data to train models, and we do not sell personal data.

Agent surfaces and protocol registries receive your catalog data — that is the product. Payment providers receive order data needed to settle transactions. Infrastructure processors host our systems under data processing agreements. Nothing else is shared unless the law requires it.

6. Retention

Catalog data is deleted within 7 days of deregistration. Endpoint audit logs are kept for 24 months because disputes and chargebacks reference them. Account data is deleted 30 days after account closure, except where retention is legally required.

7. Security

Endpoints are signed so agents can verify they are yours. Data is encrypted in transit and at rest. Access to production systems is scoped, logged, and reviewed.

8. Your rights

You can export your catalog and audit logs, correct account data, or delete your account from the dashboard at any time. Waitlist emails include a one-click removal link. Privacy requests can be made from your account settings.