Privacy notice

Last updated 15 September 2026

This explains what Cropmerger stores about you, why, and for how long.

Contact

For questions and requests, email contact@cropmerger.com.

Cropmerger is the data controller responsible for your personal data.

Your images

We process your uploads to provide your merge and adjustments. Original upload files are not retained after processing. Temporary copies, results and associated settings expire after one hour.

Expired images are normally deleted within a minute. If the service is unavailable, deletion resumes when it restarts.

A merge belongs to its owner. A link alone does not give another person access.

Your images are never used to train AI models. We do not send your images to any other image service. Railway hosts the application and processes your images. Supabase stores account and purchase data. Resend sends automated email, and Migadu hosts our support inbox.

Your account

If you create an account we store your email address, a password hash, the account creation time, whether your address has been confirmed, your token balance, purchase records, and the terms version and acceptance time recorded when the account is created.

We do not keep a permanent merge history. Temporary result information is deleted with the images.

We use your email address to confirm the address, to reset your password, and to send you a purchase confirmation. We do not send marketing.

We use account, image and purchase information to fulfil our agreement to provide the service. Your email address and password are required to create an account, and we need the two images to make a merge.

Security

We process IP addresses, account identifiers and request counts to limit abuse and protect accounts. We rely on our legitimate interests in securing the service and preventing fraud. We also process payment and dispute information to reconcile transactions and defend legal claims, and retain records where required by law.

When you open the sign-up or login form, Cloudflare Turnstile checks that a person is making the request. It processes your IP address and browser signals for that check, and we rely on our legitimate interest in preventing automated abuse.

Messages

The contact form sends your name, email address, topic, subject, and message to our support inbox. We use them to handle your request, to fulfil our agreement with you for account and purchase support, our legitimate interest in answering other enquiries, or a legal obligation where applicable. We do not automatically link messages to your merges. Ordinary support messages are deleted within 12 months of closure, unless a dispute or legal obligation requires longer retention.

Withdrawal requests include your name, email address, purchase reference and receipt time. We keep the request and acknowledgement to handle cancellation and demonstrate compliance with our legal obligations. These records may remain after account deletion where needed for refunds, disputes or legal record-keeping.

Cookies

Cropmerger uses necessary cookies: cm_session keeps temporary results attached to the right browser for one hour, and cm_auth keeps you logged in for up to 30 days. We do not use analytics or advertising cookies.

Local browser storage remembers your acknowledgement of the terms until you clear the site’s browser data. This preference stays in your browser, separately from your account’s acceptance record.

You can remove this storage through your browser settings. Blocking necessary cookies can prevent sign-in and access to results. Stripe’s embedded payment forms and payment providers’ separate checkout pages have their own privacy and cookie notices.

Payments

Cryptocurrency payments are handled by NOWPayments, which processes wallet addresses and transaction details. Many blockchain transactions are public. NOWPayments may require identity checks. Email contact@cropmerger.com to arrange cryptocurrency refunds. This includes payments received after account deletion.

Card payments are handled by Stripe. Your card details go directly to Stripe and never reach us. If you choose to save a card, Stripe stores it for your future purchases. We link your account to a Stripe customer and display only the card type, last four digits and expiry date. You can remove saved cards in your account settings. We keep payment references, the token pack, amount, currency, payment and refund status, and the terms and immediate-access request recorded for the purchase. If a payment arrives after you delete your account and the tokens were not delivered, we automatically request a refund to the original card.

Data retention

Images expire and are deleted as described above. Account information remains until you delete the account. Login sessions expire after 30 days, email confirmation links after 24 hours, and password reset links after one hour. Expired session and link records are removed when the service next starts.

Deleting your account removes its email address, password, sessions, links, purchase history and images, and removes its saved-card customer from Stripe. Payment records remain without the account link for reconciliation, refunds, disputes and legal record-keeping. Payment references may still be linked to you through the payment provider. If a purchase confirmation is still pending when you delete your account, we retain its email address until it is sent. Support correspondence is retained as described under Messages.

Your rights

Depending on the processing and applicable law, you can request access, correction, deletion, restriction or a portable copy of your personal data. You can object to processing based on legitimate interests. These rights are subject to legal conditions and exceptions. You can also delete your account from the account page.

Send requests to contact@cropmerger.com. We may need to verify your identity. We normally respond within one month. If the law permits more time because a request is complex or there are several requests, we will explain the extension within that month.

You can complain to a data protection authority, including where you live or work.

Changes to this notice

If we make a material change to this notice, we will update the date at the top and tell you in the app.