Legal
Last updated: June 10, 2026
We take the protection of your personal data seriously. This Privacy Policy explains what data we collect, why we collect it, and what rights you have. It applies to all services operated by Primer on this domain — for visitors and buyers on product pages as well as for merchants using the Primer dashboard — and is based on the requirements of the EU General Data Protection Regulation (GDPR).
We collect and process the following categories of personal data: (a) merchant account data — the email address you sign in with (passwordless magic link) and the content you add to your account, such as products, prices and knowledge-base entries; (b) your email address as a buyer, collected at checkout and used to deliver your purchase and send transactional emails; (c) order data, including the products purchased, amounts paid, and timestamps, required to fulfil orders and provide invoices; (d) payment metadata forwarded by our payment providers — we never store raw card details; (e) chat messages exchanged with the AI assistant on product pages, including any contact details you choose to share there; (f) first-party usage statistics (page views, clicks, sales aggregates), stored in our own database without third-party tracking services.
Your data is processed on the following legal bases: performance of a contract (Art. 6(1)(b) GDPR) for order fulfilment, delivery, and operating merchant accounts; compliance with a legal obligation (Art. 6(1)(c) GDPR) for invoicing and tax records; and our legitimate interest (Art. 6(1)(f) GDPR) for fraud prevention, platform security and first-party usage statistics.
Payments for Primer subscriptions are processed by Paddle.com Market Limited (Judd House, 18-29 Mora Street, London, EC1V 8BT, UK) as Merchant of Record and independent data controller. Paddle processes your payment data under its own privacy policy at paddle.com/legal/privacy. We never receive or store your payment details. Marketplace purchases are processed by Stripe — card data is likewise handled exclusively by Stripe and never reaches our systems.
Product pages include an AI sales and support assistant. Messages sent to the assistant are processed by AI infrastructure providers (Anthropic, and Vercel's AI Gateway) solely to generate the response and to build search indexes of the merchant's content. Chat histories are stored so that merchants can follow up on conversations and enquiries. Please do not share sensitive personal data in the chat.
We engage the following service providers who may process your data, each bound by appropriate data processing agreements: Stripe, Inc. (payment processing, PCI-DSS Level 1); Paddle.com Market Limited, Judd House, 18-29 Mora Street, London, EC1V 8BT, UK (Merchant of Record and checkout provider for Primer's SaaS fees — Paddle acts as an independent data controller under its own privacy policy, and payment data for these purchases is processed exclusively by Paddle: we never receive or store your payment details); Resend, Inc. (transactional email delivery); Neon, Inc. (database hosting, EU region); Vercel Inc. (application hosting, file storage and AI gateway); Anthropic, PBC (AI model provider for the chat assistant). A full list of current providers is available on request.
Some of our providers process data in the United States. Where personal data is transferred outside the EU/EEA, we rely on the safeguards of Art. 44 et seq. GDPR, in particular the EU–US Data Privacy Framework and EU standard contractual clauses.
We use only technically necessary cookies: a session cookie that keeps you signed in and a cookie that stores your language preference. We do not use advertising, profiling or cross-site tracking cookies.
We store personal data only for as long as it is needed: account data for the lifetime of your account; order and invoice data for the statutory retention periods under commercial and tax law (up to 10 years); chat histories until the merchant deletes them or the account is closed. After that, data is deleted or anonymised.
Under the GDPR you have the right to access, rectify, erase, restrict, and port your personal data, as well as the right to object to processing and to lodge a complaint with a supervisory authority. To exercise your rights, please contact us using the details in the Imprint. We will respond within 30 days.
The controller responsible for data processing within the meaning of Art. 4(7) GDPR is:
For all data protection matters, including requests to exercise your rights, please write to the email address above.