Legal
Privacy policy
This notice explains what personal data Clever Merchants collects through this website, why, who helps us process it, how long we keep it and the rights you have under the General Data Protection Regulation (GDPR).
Last updated: 16 October 2026
Who we are
The data controller is Clever Merchants, run by Ger Devereux, Dublin, Ireland. We are an AI consultancy that works with owner-managed businesses. For anything about your personal data, email ger@clevermerchants.com. Ger reads every message himself.
We are a small business and have not appointed a Data Protection Officer, because the law does not require one for the kind of processing we do. Ger is responsible for data protection.
What we collect and why
We only collect what you choose to send us, plus basic technical data that any website receives, and analytics only if you allow it. Each form below says what it asks for.
Contact form
What: your name, email address, business name and message. Why: to reply to you. Lawful basis: our legitimate interest in answering enquiries, and taking steps you ask for before a contract.
Free AI Readiness Review
What: your name, email, company, phone number, website, country, role, industry, team size, currency, revenue band, challenges, goal, timeline and any notes. Why: to produce your report, email it to you, follow up personally and judge whether implementation work would pay off for you. We may send up to two short follow-up emails in the two weeks after you submit; reply "stop" and we will not send any more. Lawful basis: taking steps you ask for before a contract, and our legitimate interest in following up on a review you requested.
Free AI Visibility Check
What: your name, email, website address, the city or area you serve, business type, team size, revenue band, the questions your buyers ask, which AI tools you use, your concerns about AI visibility, your marketing channels and any notes. Why: to prepare your visibility report and send it to you. The report is stored at a private web address made of random characters. Anyone with that link can open it, so please only share it with people you trust. Lawful basis: taking steps you ask for before a contract.
Order forms on package pages
What: on pages such as the Visibility Fix for each trade, your name, business name, email, phone, website, country, service area, services and notes. Why: to set up the order you are about to pay for. Lawful basis: performing a contract with you, or taking steps you ask for before one.
Onboarding forms after payment
What: the details we need to do the work, for example your business address, trade licence or registration numbers, years trading, review profiles, Google Business Profile, website platform and developer, domain registrar, competitors, and for AI work the tasks, tools and data you use today. Why: to deliver the package you bought. Lawful basis: performing our contract with you. Please do not put passwords into any form. We will agree a safer way to get the access we need.
Payments
Card payments are taken on checkout pages hosted by Stripe. Stripe collects your card details; we never see or store your full card number. We receive your name, email, what you bought and whether the payment went through. Lawful basis: performing our contract with you, and our legal obligation to keep accounting records.
Email and WhatsApp
If you email us or message us on WhatsApp, we receive your name, contact details and whatever you write, and we use them to reply and, if you become a client, to do the work. Lawful basis: our legitimate interest in answering messages, or performing a contract.
Chat assistant
If you accept the cookie banner, an AI chat assistant provided by Aminos appears on the site. The messages you type are processed by Aminos to generate answers, and we can read the conversations to improve the answers and follow up if you ask us to. Please do not type sensitive personal information into the chat. Lawful basis: your consent.
Analytics and session recordings
If you accept the cookie banner, we use Google Analytics 4 to count visits and see which pages help people, and Microsoft Clarity to see heatmaps and recordings of how pages are scrolled and clicked, so we can fix pages that confuse people. Clarity masks sensitive input such as text typed into forms. Lawful basis: your consent, which you can withdraw at any time.
Google Analytics runs in Google's Consent Mode. Until you accept, it is told that analytics storage is denied, so it sets no analytics cookies. Google may still receive basic signals without cookies, such as that a page was viewed, which it uses only in aggregate.
Technical data
Like any website, our host receives your IP address, browser type and the pages you request, and keeps short-lived logs to run the site securely. Our fonts are served by Google Fonts, which also receives your IP address when the page loads. Lawful basis: our legitimate interest in running a secure, working website.
How we sort enquiries
The AI Readiness Review and the AI Visibility Check use simple rules, such as team size and revenue band, to decide which follow-up email you get and whether Ger reviews your report by hand. This does not have legal or similarly significant effects on you, and you can always ask Ger to look at your enquiry personally.
Who processes data for us
We do not sell your data or share it for advertising. We use these providers to run the business, and each one only processes data to provide its service to us.
| Provider | What it does for us | Where data may be processed |
|---|---|---|
| Netlify | Hosts the website, receives form submissions, runs the functions that send our emails, and stores AI Readiness Review and AI Visibility Check submissions and reports (Netlify Blobs). | United States and other countries |
| Zoho Mail | Our business email, including the automatic report and confirmation emails. | EU data centre |
| Google (Gmail) | Receives internal notifications and copies of follow-up emails about AI Readiness Review submissions. | United States and other countries |
| Stripe | Takes card payments on its own checkout pages. | Ireland, United States and other countries |
| Google Analytics 4 | Website statistics, only with your consent. | United States and other countries |
| Microsoft Clarity | Heatmaps and session recordings, only with your consent. | United States and other countries |
| Aminos | The AI chat assistant, only with your consent. | May be outside the European Economic Area |
| Google Fonts | Serves the fonts the site uses. | United States and other countries |
| WhatsApp (Meta) | Only if you choose to message us on WhatsApp. | Ireland, United States and other countries |
We may also share data if the law requires it, or with professional advisers such as an accountant, who are bound by confidentiality.
International transfers
Several of these providers are based in, or use, the United States or other countries outside the European Economic Area. Where that happens, the transfer is covered by the EU-US Data Privacy Framework where the provider is certified under it, or by the European Commission's Standard Contractual Clauses, together with the provider's own security measures. You can ask us for more detail about any transfer.
How long we keep data
- Form submissions, reports and related emails: up to 24 months from your last contact with us, unless you ask us to delete them sooner.
- Client, invoice and payment records: for as long as Irish tax law requires, currently six years.
- Analytics and session recordings: held by Google and Microsoft under the retention settings of those tools.
- Your cookie choice: 12 months, after which we ask again.
Cookies and the consent banner
When you first visit, a banner asks whether you accept analytics and the chat assistant. Accept and Decline are equally easy, and nothing optional runs until you choose Accept. If you decline, Microsoft Clarity and the chat assistant are never loaded and Google Analytics sets no cookies. You can change your mind at any time with the "Cookie settings" link at the bottom of every page, or change your cookie settings now.
| Name | Set by | Purpose | How long | When |
|---|---|---|---|---|
| cm-consent (browser storage) | Clever Merchants | Remembers your Accept or Decline choice | 12 months | Always, because it is needed to respect your choice |
| _ga, _ga_ZSTQF68SJ7 | Google Analytics | Tells visits apart so we can count them | Up to 2 years | Only if you accept |
| _clck, _clsk and related | Microsoft Clarity | Links page views into one session for heatmaps and recordings | Up to 1 year | Only if you accept |
| Chat widget storage | Aminos | Keeps your chat conversation open as you move between pages | Set by Aminos | Only if you accept |
Stripe sets its own cookies on its checkout pages to process payments and prevent fraud. Those pages are covered by Stripe's privacy policy.
Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you and get a copy.
- Correct data that is wrong or incomplete.
- Delete your data, where we have no legal reason to keep it.
- Restrict how we use your data while a concern is looked into.
- Object to processing based on our legitimate interests, and to any direct marketing at any time.
- Data portability: receive data you gave us in a common, machine-readable format.
- Withdraw consent at any time, for example with the Cookie settings link. This does not affect processing that already happened.
To use any of these rights, email ger@clevermerchants.com. We will reply within one month. We may ask you to confirm your identity before we act, so that we never hand your data to someone else. There is no charge.
Complaints
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Data Protection Commission, the Irish data protection authority, at dataprotection.ie, or to the authority in the EU country where you live or work.
Security
Only Ger has access to submissions and client data. Our providers use encryption in transit and access controls, and reports are stored at addresses that cannot be guessed. No system is perfectly secure, but if a breach affecting your data ever happened we would tell you and the Data Protection Commission where the law requires it.
Children
This website and our services are for businesses. They are not aimed at children, and we do not knowingly collect data from anyone under 16.
Changes to this notice
If we change how we use personal data, for example by adding a new tool, we will update this page and the date at the top. If a change affects you significantly and we have your email address, we will tell you.
Contact
Clever Merchants, run by Ger Devereux, Dublin, Ireland.
Email: ger@clevermerchants.com
See also our terms of service.