This Privacy Policy describes how Merchant Rate Auditor LLC ("Merchant Rate Auditor," "we," "us") collects, uses, stores, and shares information in connection with our merchant-statement analysis and processor-monitoring service, including the Free Statement Scan and paid Monitor and Pro plans. It reflects how the service actually operates today. If a practice described here changes, we will update this page.
Information We Collect
Account and business information may include your name, business name, email address, an optional phone number, business profile information you provide, merchant processor information, and merchant account identifiers needed to distinguish one connected account from another. Authentication is handled by our database provider, Supabase; we do not store your password in plain text.
Uploaded information may include merchant processing statements, merchant agreements, processor pricing schedules, processor notices, and other supporting evidence or documents you submit.
Connected processor information. Uploading a statement is the primary way to use Merchant Rate Auditor, and no processor connection is required to begin. If you separately choose to connect a supported payment processor, the information we can access depends on the processor and the permissions actually granted, and may include: merchant account identifiers; transaction and payment records; transaction dates and amounts; payment status; refunds and adjustments; tender/payment-method information; processor fee information, when available; processor billing information, when available; payout/settlement metadata, when relevant; and other processor information reasonably necessary to perform the monitoring/audit service you requested. See "Processor Access Rules" below for what we do not use a processor connection for.
Billing information may include your subscription plan, subscription status, billing identifiers, payment status, and limited payment-method metadata returned by our billing provider, Stripe. Merchant Rate Auditor does not need or intend to store your full card number — Stripe handles that directly.
Technical/security information may include IP address, browser/device information, login activity, timestamps, audit/security events, and error information, generated as part of operating the service securely and reliably.
Support information may include communications and documents you voluntarily supply when contacting us for support.
What We Do Not Collect
Merchant Rate Auditor does not store full payment card numbers, card security codes, or bank account/routing numbers. We do not use cookies, and we do not use third-party advertising or analytics trackers of any kind on this site.
Your session is kept using a token stored in your browser's local storage, not a cookie, and it is used solely to keep you signed in.
How We Use Information
We may use information to:
- Operate and secure your account
- Analyze processing costs, and calculate processing volume and effective rates
- Detect fee or rate changes
- Identify unusual or potentially avoidable processing costs
- Prepare findings and generate monitoring alerts
- Generate monthly or other periodic reports
- Investigate merchant questions and provide support
- Administer subscriptions and entitlements
- Detect and prevent fraud, abuse, and unauthorized access
- Maintain required business, security, and audit records
We do not send marketing newsletters — account-related and billing-related emails (for example, a statement review update or a payment issue) are the only emails we send.
Processor Access Rules
Merchant Rate Auditor processor connections are intended to use read-only or least-privilege permissions whenever supported by the processor.
Merchant Rate Auditor does not use a processor connection to initiate charges, initiate customer payments, issue refunds, transfer funds, hold or take custody of funds, initiate payouts, change processor settings, or obtain your processor password.
Processor capabilities differ. Some processors can provide useful information through an API; others require you to upload statements instead. We do not promise that every processor can be automatically connected, or that automatic statement retrieval is available for every processor.
Who We Share Information With
We do not sell merchant transaction data or other personal information, and we do not use merchant transaction data for third-party behavioral advertising. We work with a small number of service providers who process information on our behalf, only as needed to operate the service:
- Supabase — our database, authentication, and file-storage provider
- Stripe — our payment processor, for billing and subscription management
- Resend — our transactional email provider, used to deliver account and billing notifications
We may also disclose information if required by law, or to protect the rights, property, or safety of Merchant Rate Auditor, our users, or others.
YouTube API Services
Merchant Rate Auditor uses YouTube API Services (the YouTube Data API v3) as part of an internal, single-owner tool that manages Merchant Rate Auditor's own YouTube channel. This tool is used only by Merchant Rate Auditor to operate our own channel — it is not offered to customers or any outside user, and it is not a YouTube integration we sell or provide to third parties.
Through this internal tool, Merchant Rate Auditor's YouTube API access may involve:
- The identity of the authorized Merchant Rate Auditor YouTube channel (Merchant Rate Auditor, channel ID UCJckv-NY-Eus7cMoSUKMLhA)
- Information about videos uploaded to that channel through this tool
- The metadata and status (for example, title and privacy setting) of videos uploaded through this tool
This access is used only to:
- Verify that the tool is operating on the correct, authorized Merchant Rate Auditor channel before taking any action
- Upload Merchant Rate Auditor's own marketing videos to that channel
- Confirm that an uploaded video's status and privacy setting are what was intended
This use is unrelated to customer/merchant data. No customer account information, uploaded merchant statement, processing data, or any other information described elsewhere in this Privacy Policy is sent to, stored in, or accessed through YouTube API Services. The only YouTube channel this tool can access is Merchant Rate Auditor's own channel, authorized directly by the Merchant Rate Auditor business owner.
Storage. OAuth authorization tokens for the authorized Merchant Rate Auditor Google/YouTube account may be stored securely for as long as needed to maintain that authorized access, and are excluded from our source code repositories. Operational records such as a video's YouTube video ID and upload status may also be stored, solely to prevent duplicate uploads and track upload history. If this tool's use of a given Google account ends, its locally stored authorization tokens and related upload records are deleted.
Deletion of locally stored YouTube API data. The authorized Google/YouTube account owner may request deletion of locally stored OAuth authorization data (tokens) and related YouTube API operational records (such as stored video IDs and upload status) by contacting hello@merchantrateauditor.com. We will delete the requested locally stored YouTube API data as soon as possible, and no later than 7 calendar days after receiving the request. Deleting this locally stored data does not delete videos or other content stored by YouTube itself — to delete content stored by YouTube, the account owner must use YouTube directly or another application authorized to manage that content. As noted below, revoking Google authorization stops future API access but does not, by itself, delete content already stored by YouTube. This deletion process applies only to the YouTube API data described in this section — it is separate from, and does not involve, customer merchant-statement or account data, which is addressed elsewhere in this Privacy Policy.
No sale or unrelated sharing. YouTube/Google data accessed through this tool is not sold, rented, or shared for advertising or any purpose unrelated to operating Merchant Rate Auditor's own YouTube channel.
Authorization and revocation. Access is granted directly by the Merchant Rate Auditor Google Account owner through Google's own OAuth consent process, and can be revoked at any time from that Google Account's third-party access permissions page. Revoking access stops this tool from taking any further action on the channel; it does not, by itself, delete video content already published to YouTube, which remains governed by YouTube's own policies.
This use of YouTube API Services is also governed by the Google Privacy Policy and the YouTube Terms of Service.
Questions about this section, or requests related to the data described here, can be sent to hello@merchantrateauditor.com.
Automation and Human Review
Merchant Rate Auditor may use software, automated calculations, rule-based analysis, and other analysis tools to review your information. Low-confidence, exceptional, disputed, or otherwise appropriate cases may receive review by an authorized human reviewer. A finding produced by our service is not a guarantee that a fee is incorrect, refundable, negotiable, or recoverable.
How Uploaded Statements Are Handled
Uploaded files are stored in access-controlled cloud storage. Viewing a stored document requires a short-lived, individually generated link — there is no permanent public URL for any uploaded file. Review of a submitted statement may involve an authorized Merchant Rate Auditor reviewer examining its contents.
Retention
We retain information as reasonably necessary to provide the service, preserve customer-requested history and reports, maintain security and audit records, resolve disputes, meet contractual or legal obligations, and maintain legitimate business records. We distinguish between the physical file you uploaded and the historical analysis/account record derived from it; both are retained under the general practices described in this section.
Disconnecting a processor connection stops future collection from that connection after a reasonable amount of technical processing time, but does not automatically erase information we already lawfully collected before the disconnection.
Your Choices and Controls
Subject to legitimate legal, security, billing, and audit exceptions, you may:
- Update appropriate account information
- Disconnect a processor connection at any time
- Cancel your subscription through the available billing controls
- Contact us about access, correction, or deletion requests
While a submitted statement or piece of evidence is still awaiting initial review, you can also cancel that submission yourself from within the app; once review has progressed further, you can submit a removal request instead, which an authorized reviewer will approve or deny.
Our product does not currently include a fully automated, self-service "delete my account" feature. If you would like to close your account or ask about the information we hold, contact us at hello@merchantrateauditor.com. Some information may need to be retained even after such a request — for example, billing records needed for financial recordkeeping, or information needed to comply with law or prevent fraud — and only for as long as reasonably necessary for those purposes.
Security
We use access controls on our database and storage, and statements are only ever accessible through short-lived, individually generated links rather than a permanent public URL. No method of storing or transmitting information is completely secure, and we cannot guarantee absolute security.
Children's Privacy
Merchant Rate Auditor is a business service intended for business owners and is not directed to children.
Changes to This Policy
We may update this Privacy Policy from time to time as our service changes. We will update the "Last updated" date above when we do.
Contact
Merchant Rate Auditor LLC operates https://merchantrateauditor.com. Questions about this Privacy Policy can be sent to hello@merchantrateauditor.com.