Privacy policy

1. Controller and contact

Daleki Merch is operated by D-Legacy SAS, RUC 1793077323001, based in Quito, Ecuador. Sebastián Delsalto is its founder and CEO.

Email dalekimerch@gmail.com with the subject Data protection. You may also contact us at +593 99 785 4652. In-person appointments are arranged through these channels.

2. Data you provide

We process the products, quantities, colors and designs you select; your name and company if provided; delivery destination, requested date, notes and contact details. Quotes and billing may also require a legal name, tax identification and address.

The studio may receive logos, text, fonts and composed artwork. Do not include sensitive information or third-party data without authorization. Only files you submit through site features are shared with the team.

3. Purposes and legal bases

We handle inquiries and prepare quotes as precontractual steps you request. Accepted orders are processed to perform the contract. Invoices and legally required records are retained to meet legal obligations.

Optional analytics and the newsletter require separate consents that you can withdraw. Security and abuse prevention controls protect the platform and its users; their scope must be limited to what is necessary and assessed under applicable rules.

4. Browser storage and preferences

Your bag, favorites, recent products, theme, progress and studio guide are stored locally. The studio draft uses localStorage and IndexedDB for metadata and files: it expires after 7 days and is cleared when the studio next accesses the draft. Clearing site data removes it sooner.

The Merch AI conversation stays in sessionStorage for the tab session. Chat uses its own functional identifier, separate from analytics. The cookie policy lists storage names, purposes, duration and removal methods.

5. Optional analytics

We do not send analytics events before you accept. If you accept, we record pages, searches, products and actions with a temporary session identifier. This data is pseudonymous, not necessarily anonymous.

You can decline without preventing shopping or requesting a quote. Withdrawing permission in Privacy preferences stops new events and removes the optional browser identifier. Withdrawal does not automatically delete records already received; you can request erasure where those records can be identified.

6. Merch AI

This is an optional AI assistant. It sends your message, recent conversation context and catalog context to OpenRouter and the configured model provider to generate a response. You may use WhatsApp to speak with a person.

The code requests providers with data collection disabled. This does not replace verifying their policies and agreements. We do not promise zero retention or a processing region without confirming them for the active configuration.

Operational logs include the question with email addresses and phone numbers redacted, recommended products and execution details. Free text may still contain personal information. The scheduled deletion period is 90 days. The assistant does not approve orders, set final terms or make decisions with legal effects on you.

7. Original files and shared designs

Original files submitted to the studio are used to prepare your design and order. The architecture provides for private storage and temporary access by authorized staff. A draft stored only in your browser is not a backup on our servers.

Sharing a design creates a preview accessible to anyone with the link. Do not include confidential information in that image. The preview does not automatically contain the original file. You may request removal of the link.

Originals not referenced by a retained order may be deleted after 90 days even if the shared image remains for up to 730 days. Files referenced by retained orders, including won sales, are preserved and require a specific retention review. A visible link does not guarantee that the original is still available.

8. Retention

Retention is configured for 90 days for assistant logs and orphan originals; 730 days for analytics, shared previews and certain requests or quotes that did not become sales. Scheduled deletion operates only after the production process is enabled and verified; it does not run in the review environment.

Won orders, contractual documents and tax records are not deleted by those general rules. They must be retained according to their purpose and applicable obligations, and reviewed to avoid indefinite retention. We may restrict records that must be preserved to address an obligation or claim.

9. Newsletter and contact

Subscription requires express acceptance and email confirmation. We keep your address, accepted text version, source, date and confirmation or unsubscribe status. Every campaign includes an unsubscribe link; the suppression list prevents further marketing sends.

Unsubscribing does not prevent necessary communications about a quote or order you requested. External email delivery is disabled in the review environment.

10. Providers and recipients

The platform is prepared to use Vercel for hosting, Supabase for the database, files and authentication, Upstash for shared rate limits, Resend for email and OpenRouter with model providers for Merch AI. Services should only be enabled with verified configuration and terms. We do not sell personal data.

fal.ai is limited to editorial production and catalog models from product photos. Higgsfield is used for approved brand creative work. These workflows do not receive customer conversations or logos. Carriers receive only the information necessary to deliver the agreed order.

WhatsApp and Google operate their own services under their policies. Following a link to them takes you away from this site.

11. International transfers

Some providers may process information outside Ecuador. Before enabling live processing, we must document locations, recipients and the applicable transfer mechanism, and verify contractual safeguards. This draft does not certify signed agreements or data residency.

12. Rights and requests

You may request information, access, correction, updating, erasure, objection, portability or restriction, and withdraw consent. Email dalekimerch@gmail.com stating your request and a reference that helps locate your records. We will request only proportionate information to verify your identity.

Requests are free. The LOPDP provides 15 days for access and correction; we will apply the deadline and conditions relevant to each right. If an obligation prevents erasure, we will explain the reason and scope of retention. You may contact the data protection authority at spdp.gob.ec without first having to exhaust our channel.

13. Security, incidents and minors

The design includes encryption in transit, role-based access, file and request validation, abuse limits and separate environments. Their operation must be verified before production. No security is absolute; incidents will be assessed, contained and notified under applicable obligations.

The commercial service is intended for adults and authorized business representatives. We do not intentionally request data from minors. If you identify a case, contact us so we can review it and take appropriate action.

14. Policy versions

We will publish the date of each change. A new use requiring consent is not authorized simply by changing this text. The current version is a draft for review before launch.