Cookie and storage notice

Principle

We do not integrate advertising networks and do not use third-party analytics or advertising cookies. In your browser we only store what the site needs and, with your consent, a few entries of our own that are listed individually below. Also only with your consent do we measure clicks and scroll depth on our website (heatmap) and your path across the pages (journeys).

Technically necessary (no consent required)

• Sign-in token: keeps you signed in after login. Storage: localStorage or sessionStorage. Duration: until you sign out or it expires.
• Cart and working state: stores your cart and local input in the app. Duration: until you delete it in your browser.
• Settings: e.g. the chosen language and view. Duration: until you delete them in your browser.
• Your consent decision (mv_consent): so that we do not ask you again on every visit, with the version of the notice and the time. Duration: 12 months, then we ask again; earlier if you change it or delete it in your browser.
• Service worker and browser cache: stores program files of the site so that it loads faster (not on link pages). Duration: until the next update of the site.
• Stripe payment form (__stripe_mid, __stripe_sid): only when you, as a seller, change the payment method of your Merchavio plan in the dashboard. Stripe uses these entries to prevent fraud in payments. Duration: one year or 30 minutes.

This storage is strictly necessary to provide the service you requested; no consent is required for it (Art. 5(3) sentence 2 ePrivacy Directive). The legal basis for the related processing is Art. 6(1)(b) or (f) GDPR.

Only with your consent

• Visitor ID (mv:sid, localStorage): random identifier with which the visit statistics of shops and of our website recognise returning visits. Provider: us. Duration: until withdrawal or until you delete it in your browser.
• Partner code of the platform partner programme (mv:pref in localStorage and cookie mv_pref): attributes your registration to the partner whose link you came through. Provider: us. Duration: 90 days.
• Sellers’ partner codes (mv_aff_ followed by the shop name, localStorage): attributes a purchase to a seller’s partner whose link you came through. Provider: us. Duration: 30 days.
• Marketplace attribution (cookie mv_mp): records that you opened a shop via the marketplace; the fee the seller pays us depends on this. Your price does not change. Provider: us. Duration: 24 hours.
• Heatmap (only on merchavio.com, no entry in your browser): records where people click on a page and how far they scroll, without a visitor ID and without any input in form fields, so that we can see which content is read and which buttons are used. Provider: us. Duration: evaluation 90 days, then automatically deleted.
• Journey ID (mv:jid, localStorage, only on merchavio.com): random identifier with which we assign viewed pages, scrolling, mouse movements and clicks with their spot (for links and buttons with label and target, no input in form fields), from the version of the cookie notice of 10 November 2026 also while signed in to Merchavio (there without content, clicks only named by the type of element), to a journey, which our team can also view as a replay; if you sign up or sign in, we link the journey to your account so that we can see which journeys lead to sign-ups and paid plans. Provider: us. Duration: the journey ID until withdrawal, until you delete it in your browser or until your decision expires after 12 months (a new consent gives you a new journey ID), the recorded journeys 90 days, then automatically deleted.

Without consent we store none of these entries, do not measure clicks or scroll depth and do not record journeys. A partner code then only works until you reload the page, and visits are counted without a visitor ID. The legal basis is your consent (Art. 6(1)(a) GDPR in conjunction with Art. 5(3) ePrivacy Directive). Consent is voluntary; all features of the site are available to you without it. Under “Choose” in the cookie notice you decide on each purpose separately: statistics (visitor ID), recommendations (referral codes and marketplace link) and, only on merchavio.com, heatmap and journeys; all switches start off.

Change or withdraw consent

You can change your decision at any time with effect for the future, via the button below or the “Cookie settings” link in the footer. If you withdraw consent, we delete the entries and cookies listed above, the heatmap stops measuring, and we delete the journeys stored for your journey ID, including the link to your account. If you have signed up, you can also delete the journeys linked to your account at any time in the dashboard under Settings → Security, including from another device. In our backups, deleted journeys remain until the backups expire (at most 365 days, section 9) and are only used to restore after an outage; we no longer accept a deleted journey ID afterwards. The lawfulness of the processing carried out until then remains unaffected.

Third-party services only for specific features

• Google sign-in: only when you click “Continue with Google” or “Sign up with Google” are you redirected to Google’s sign-in page; your IP address is transmitted to Google, and Google may set or read cookies on its page. Provider: Google Ireland Limited / Google LLC (USA). Purpose: signing in with your Google account. No Google script is loaded on our own pages.
• Stripe: for payment you are redirected to a checkout page hosted by Stripe; Stripe sets its own cookies there, among other things for fraud prevention. Provider: Stripe Payments Europe, Ltd. (Ireland) / Stripe, Inc. (USA).
• PayPal: if you choose PayPal, you are redirected to PayPal; PayPal sets its own cookies there. Provider: PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg).
• Content embedded by sellers (e.g. YouTube, Vimeo, Twitch, Trustpilot): these providers may set their own cookies when their content is loaded. Where possible, the content is only loaded after you click.

These services only become active when you use the respective feature. The legal basis is Art. 6(1)(b) GDPR (carrying out the process you requested) or, where required, your consent (Art. 6(1)(a) GDPR).

Manage in your browser

You can also view and delete stored entries and cookies in your browser settings at any time. Deleting the sign-in token signs you out; deleting the cart removes local input. Details on the cookies of the third-party providers mentioned can be found in their privacy notices.