Privacy Policy

Effective date: July 6, 2026

Prisma Ltd. (“SoMerch,” “we,” “us,” or “our”) respects your privacy and is committed to protecting personal data.

This Privacy Policy explains how we collect, use, disclose, store, and protect information when you use:

the SoMerch website at somerch.co and its related pages;
the SoMerch platform and applications;
forms, quote-request and support services;
the SoMerch ChatGPT App;
the SoMerch Model Context Protocol (“MCP”) server and interactive components;
other integrations, tools, and services operated by SoMerch; and
our corporate merchandise, production, warehousing, fulfilment, and delivery services.

The SoMerch website, platform, applications, and services are intended primarily for business users and are operated in a business-to-business context.

1. Who We Are

SoMerch is owned and operated by:

Prisma Ltd.
A company registered in the Republic of Bulgaria

Registered office:
23A Dimitar Konstantinov Street
Pleven, Bulgaria

Principal operational office and correspondence address:
32 Vranya Street
Banishora, 1233 Sofia
Bulgaria

Privacy and support contact: [email protected]

For the purposes of applicable data protection laws, including Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”), Prisma Ltd. is the controller of the personal data described in this Privacy Policy, unless otherwise stated.

2. Scope of This Privacy Policy

This Privacy Policy applies when you:

visit or interact with the SoMerch website;
create or use a SoMerch platform account;
use a SoMerch mobile, desktop, or web application;
contact us or request information;
request a quote, proposal, sample, or product recommendation;
submit a corporate merchandise project;
place or manage an order;
use our warehousing, fulfilment, or delivery services;
use the SoMerch ChatGPT App or another authorized SoMerch integration;
interact with the SoMerch MCP server or an interactive SoMerch component;
receive products as part of an order placed by your employer or another business customer;
subscribe to marketing communications; or
otherwise communicate or do business with us.

This Privacy Policy does not govern the independent processing activities of third-party platforms, websites, or services, including OpenAI and ChatGPT. Those providers process information under their own terms and privacy policies.

3. Categories of Data We Collect

The information we collect depends on how you interact with SoMerch.

3.1 Business and contact information

We may collect:

first and last name;
company name;
job title or professional role;
business email address;
business telephone number;
country and preferred language;
business address;
billing address;
VAT or tax identification details;
information about your relationship with the company you represent; and
communication preferences.

3.2 Inquiry, quote, and project information

When you contact us or request a quote, we may collect:

project type and use case;
required products or product categories;
estimated quantities;
budget or budget range;
preferred styles, colors, and materials;
sustainability preferences;
destination countries;
requested production or delivery deadline;
branding and printing requirements;
packaging, warehousing, and fulfilment requirements;
project notes and instructions;
information about how you heard about SoMerch;
selected products or project plans; and
other information you voluntarily provide about the project.

3.3 Files and brand assets

Where relevant to your request or order, we may collect files such as:

company logos;
brand guidelines;
artwork;
images;
product references;
spreadsheets;
recipient or address files;
mockups;
print-ready files; and
other project documentation.

You should provide only files that you are authorized to use and share.

3.4 Platform and account data

If you use the SoMerch platform or applications, we may collect:

account name and business contact details;
account role and permissions;
company or workspace association;
login and authentication records;
platform preferences;
product selections;
projects, quotes, orders, and stock records;
approval and activity records;
warehouse and fulfilment instructions;
support communications; and
application configuration information.

We do not ask users to provide passwords, authentication codes, or API credentials through the SoMerch ChatGPT App.

3.5 Order, billing, and transaction data

Where you proceed with an order or paid service, we may process:

quote and order details;
purchase orders;
billing and invoicing information;
VAT information;
payment status;
transaction references;
credit notes and refund records;
order approvals;
production records;
warehouse records;
shipment records; and
communications relating to the order.

SoMerch does not intentionally collect complete payment-card details through the ChatGPT App. Where payment services are offered, card information may be processed directly by an authorized payment provider under its own privacy and security terms.

3.6 Recipient and delivery information

Where a confirmed project requires delivery to employees, customers, offices, event locations, or other recipients, we may process:

recipient name;
company or department;
delivery address;
business or delivery telephone number;
email address where required for delivery notifications;
clothing size or product variant;
selected gift or product;
shipment tracking information;
delivery status; and
information required to resolve returns, failed deliveries, or delivery claims.

Recipient names and home delivery addresses are not required for general product search or initial project planning through the ChatGPT App. They may be collected later through the SoMerch platform or another secure process when required for a confirmed fulfilment project.

If you provide personal data about another person, you are responsible for ensuring that you have an appropriate legal basis and authority to provide that information to us.

3.7 Technical and usage data

When you use our website, platform, applications, or integrations, we or our service providers may process limited technical information such as:

IP address;
browser and device type;
operating system;
language and regional settings;
pages or application areas visited;
referring source;
session and interaction information;
date and approximate time of access;
cookie and consent preferences;
application version;
tool or feature used;
response status;
performance and error information;
security and abuse-prevention signals; and
pseudonymous technical identifiers where required for operation or security.

We do not use this technical information to create sensitive profiles about users.

3.8 Marketing information

Where permitted by law, we may process:

marketing subscription status;
communication history;
campaign engagement;
event participation;
areas of professional interest; and
unsubscribe or objection records.

4. How We Collect Information

We may collect information:

4.1 Directly from you

For example, when you:

complete a website form;
contact us by email, telephone, chat, or another channel;
create or use a SoMerch account;
request a quote or product recommendation;
upload a file;
submit or approve a project;
place or manage an order;
use the SoMerch ChatGPT App;
submit a quote request through an integration;
contact support; or
subscribe to marketing communications.

4.2 From your employer or another business customer

A company may provide information about its employees, contractors, customers, event participants, or other recipients when using our production, warehousing, kitting, fulfilment, or delivery services.

4.3 Through ChatGPT or another authorized integration

When you use the SoMerch ChatGPT App, ChatGPT may transmit task-specific information to the SoMerch MCP tools in order to perform the action you requested.

SoMerch receives only the information transmitted to the relevant tool or interactive component. We do not request, retrieve, reconstruct, or intentionally collect your complete ChatGPT conversation history.

4.4 Automatically

Certain technical information may be collected automatically through:

essential cookies;
analytics technologies;
security tools;
server logs;
application logs; and
similar technologies necessary to operate and protect our services.

4.5 From service providers and business partners

We may receive information from providers assisting with:

platform hosting;
CRM and customer communication;
production;
warehousing;
shipping and delivery;
payment and invoicing;
analytics;
security; and
support.

5. SoMerch ChatGPT App and MCP Services

5.1 How the App works

The SoMerch ChatGPT App allows users to perform actions such as:

searching the SoMerch product catalog;
retrieving product details;
comparing corporate merchandise products;
creating preliminary onboarding, event, gifting, or other merchandise plans;
assessing a project against quantities, budget, destination countries, preferences, and deadlines;
viewing interactive project-plan components; and
submitting a quote request to SoMerch after explicit confirmation.

The App communicates with SoMerch through a remote MCP server operated for SoMerch.

5.2 Information processed for product search and planning

Depending on your request, the App may process:

search terms;
product categories;
product or collection preferences;
quantity;
estimated budget;
destination countries;
requested deadline;
use case;
preferred or excluded categories;
preferred colors or styles;
sustainability preferences;
whether apparel should be included or excluded; and
limited project notes that you choose to provide.

This information is used to provide product results or prepare a preliminary merchandise plan.

5.3 Quote requests

Searching products or generating a plan does not automatically create a quote request, order, contract, or payment obligation.

A quote request is submitted only when you:

select a project option;
provide the required business contact information;
review the information that will be submitted;
consent to being contacted; and
explicitly confirm the submission.

A quote request may include:

selected plan and products;
quantities;
project budget;
destination countries;
requested deadline;
company name;
contact name;
business email address;
optional business telephone number;
project notes;
submission and consent status; and
a quote-request reference.

Submitting a quote request does not place an order, reserve stock, guarantee pricing, guarantee delivery, or process a payment. A member of the SoMerch team may contact you to verify the requirements and prepare a formal proposal.

5.4 Information we do not intentionally collect through the App

The SoMerch ChatGPT App is not designed to request or collect:

complete ChatGPT conversation history;
ChatGPT or OpenAI passwords;
API keys;
authentication tokens;
multi-factor authentication or one-time codes;
complete payment-card details;
government identification numbers;
health information;
biometric information;
information about racial or ethnic origin;
political opinions;
religious or philosophical beliefs;
trade-union membership;
genetic information;
information about a person’s sex life or sexual orientation;
criminal-conviction information;
precise GPS coordinates;
employee home addresses during initial product planning; or
other information that is not necessary for the requested SoMerch function.

Please do not include such information in free-text fields, project notes, or uploaded files.

5.5 Data returned to ChatGPT

To present the requested result, the SoMerch MCP server may return information to ChatGPT such as:

product names and descriptions;
product images and links;
product identifiers;
prices or preliminary price estimates;
minimum quantities;
product attributes;
branding methods;
lead-time information;
project-plan options;
cost assumptions;
feasibility indicators;
warnings and limitations;
quote-request status; and
a user-facing quote-request reference.

We aim to return only information relevant to the action requested. We do not intentionally return internal logs, access tokens, private database records, internal account identifiers, or unnecessary diagnostic information.

6. Why We Use Personal Data

We may use personal data to:

provide and operate the SoMerch website, platform, applications, and integrations;
respond to inquiries;
search and present relevant products;
create preliminary merchandise plans;
compare products, budgets, and known project constraints;
provide product and project recommendations;
generate and display interactive project options;
prepare and send quotes and proposals;
process explicitly confirmed quote requests;
communicate with business contacts;
manage customer and supplier relationships;
create and administer accounts and permissions;
process and fulfil orders;
produce, customize, package, store, and ship products;
deliver products to authorized recipients;
manage inventory and warehousing;
process invoices, payments, refunds, and accounting records;
provide support;
maintain service reliability;
detect, investigate, and prevent fraud, abuse, and security incidents;
prevent duplicate or unauthorized submissions;
troubleshoot technical problems;
improve our catalog, platform, applications, and services;
understand website and platform usage;
send marketing communications where permitted;
establish, exercise, or defend legal claims;
comply with contractual, legal, tax, accounting, and regulatory obligations; and
protect the rights, property, and safety of SoMerch, its customers, users, and partners.

Information submitted for product search or preliminary project planning is not used to send marketing communications unless you have separately subscribed, requested further contact, or another lawful basis applies.

7. Legal Bases for Processing

Where the GDPR applies, we rely on one or more of the following legal bases.

7.1 Steps before entering into a contract

We process information when you:

request information;
search for relevant products;
ask for a project plan;
request pricing;
submit a quote request;
request samples; or
ask us to prepare a proposal.

7.2 Performance of a contract

We process information where necessary to:

provide contracted services;
manage an account;
produce and fulfil an order;
manage stock;
deliver products;
provide support; or
perform other contractual obligations.

7.3 Legitimate interests

We may process information where necessary for legitimate business interests, including:

operating and improving our services;
managing B2B relationships;
responding to business communications;
protecting our systems;
preventing fraud and abuse;
maintaining service reliability;
keeping limited operational records;
developing our products and services;
conducting appropriate B2B marketing; and
establishing or defending legal claims.

When relying on legitimate interests, we consider whether those interests are overridden by the rights and freedoms of the affected person.

7.4 Consent

We rely on consent where required, including for:

non-essential cookies;
certain analytics technologies;
certain marketing communications; and
other processing for which consent is the appropriate legal basis.

You may withdraw consent at any time. Withdrawal does not affect processing carried out before the withdrawal.

7.5 Legal obligations

We may process and retain information where required to comply with:

accounting requirements;
tax requirements;
regulatory obligations;
court orders;
legally valid requests; or
other applicable laws.

8. AI-Assisted Recommendations and Automated Processing

The SoMerch ChatGPT App may use software-assisted or AI-assisted functionality to help identify products and organize preliminary merchandise plans.

These results may depend on:

the information supplied by the user;
available product data;
price information;
quantity requirements;
known production timelines;
product tags and collections; and
other project criteria.

Product recommendations and project plans are preliminary and may contain assumptions or incomplete information. They are reviewed and confirmed separately where the user proceeds with a formal quote.

SoMerch does not use the ChatGPT App to make solely automated decisions that produce legal or similarly significant effects concerning individuals.

SoMerch does not use business contact details, quote-request details, uploaded brand files, or delivery-recipient information to train its own general-purpose AI models.

We may use aggregated or appropriately de-identified information to understand which features are useful and to improve the SoMerch catalog, platform, and services.

OpenAI independently determines how information is processed within ChatGPT under OpenAI’s own terms, privacy policy, product settings, and user controls.

9. Logging, Security Monitoring, and App Analytics

We may maintain limited technical and operational logs to:

deliver MCP tool responses;
detect errors;
measure reliability and performance;
prevent abuse;
investigate security events;
enforce rate limits; and
prevent duplicate quote submissions.

These records may include:

the tool or function used;
approximate date and time;
success or failure status;
request duration;
error category;
limited technical identifiers;
IP or network security information; and
abuse-prevention signals.

Our systems are intended not to store complete ChatGPT conversations or raw chat histories in SoMerch application logs.

We do not use ChatGPT App activity for behavioral advertising, cross-service advertising profiles, or the sale of personal data.

The ChatGPT App component does not use advertising cookies. If we introduce additional non-essential analytics within the App, we will update this Privacy Policy and implement any consent controls required by law.

10. Cookies and Website Analytics

The SoMerch website may use cookies and similar technologies for:

essential website functionality;
remembering user preferences;
security;
analytics;
performance measurement; and
marketing where permitted.

These technologies may process information such as:

IP-related information;
browser and device information;
pages visited;
approximate session duration;
traffic source;
cookie identifiers; and
general interaction data.

We may use providers such as Google Analytics to understand website usage and improve performance.

Where required by law, we request consent before using non-essential cookies. You may manage your preferences through our cookie controls or browser settings.

Disabling essential cookies may affect website or platform functionality.

Information collected through non-essential analytics cookies is retained according to the applicable cookie settings and provider configuration and generally for no longer than 14 months, unless a shorter period is configured or a longer period is legally required.

11. Marketing Communications

Where permitted by applicable law, we may send business users information about:

SoMerch services;
product launches;
platform features;
relevant content;
events;
offers; and
company updates.

You may opt out at any time by:

using the unsubscribe link in the communication, where available; or
contacting [email protected].

Submitting a quote request does not automatically subscribe you to marketing communications.

We may retain limited information on a suppression list to ensure that we continue to respect an unsubscribe or objection request.

12. How We Share Personal Data

We do not sell personal data.

We may share personal data only where necessary with the following categories of recipients.

12.1 OpenAI

When you use the SoMerch ChatGPT App, information passes through ChatGPT in order to transmit tool requests and display SoMerch results.

OpenAI processes information independently under its own terms and privacy policy.

12.2 Hosting, infrastructure, and database providers

These providers support the operation, security, storage, and availability of our website, platform, applications, MCP server, and related services.

12.3 Communication, CRM, and support providers

We may use providers to:

manage inquiries;
record quote requests;
send transactional communications;
provide customer support; and
manage business relationships.

12.4 Analytics and security providers

These providers may assist with:

website analytics;
consent management;
error monitoring;
infrastructure security;
fraud prevention; and
service-performance monitoring.

12.5 Production and supply partners

Where required to provide a project, we may share limited project information with:

product suppliers;
printing and decoration partners;
packaging providers;
quality-control providers; and
other authorized production partners.

We share only the information needed for the relevant task.

12.6 Warehouse, fulfilment, and delivery providers

Where required to fulfil or deliver an order, we may share recipient and shipment information with:

warehouse providers;
fulfilment providers;
postal operators;
couriers;
freight providers;
customs agents; and
other logistics partners.

12.7 Payment, invoicing, and accounting providers

Where applicable, these providers may process information necessary to administer:

invoices;
payments;
refunds;
credit notes;
accounting; and
financial compliance.

12.8 Professional advisers and authorities

We may disclose information to:

legal advisers;
accountants;
auditors;
insurers;
courts;
regulators;
law-enforcement authorities; and
other public bodies where legally required.

12.9 Corporate transactions

If SoMerch or Prisma Ltd. is involved in a merger, restructuring, acquisition, financing, or transfer of business assets, relevant information may be disclosed subject to appropriate confidentiality and data-protection safeguards.

Service providers acting on our behalf are required, where applicable, to process personal data under contractual, confidentiality, security, and data-protection obligations.

13. International Data Transfers

Some service providers or recipients may process personal data outside Bulgaria or the European Economic Area.

Where personal data is transferred to a country that does not benefit from an adequacy decision, we use appropriate safeguards where required, which may include:

Standard Contractual Clauses approved by the European Commission;
contractual and technical safeguards;
supplementary security measures; or
another lawful transfer mechanism.

You may contact [email protected] for further information about the safeguards applicable to a particular transfer.

14. How Long We Keep Information

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, including legal, contractual, accounting, security, and dispute-resolution requirements.

Our general retention periods are as follows.

14.1 Product searches

Product-search requests are not retained as a permanent personal profile.

Limited technical records relating to search execution may be retained for up to 90 days for reliability, security, and abuse prevention.

14.2 Temporary merchandise plans

Where a merchandise plan must be stored to support an interactive view or subsequent quote request, it may be retained for up to 30 days from creation.

A plan may be deleted earlier if it expires, is no longer required, or deletion is requested and no legal reason requires continued retention.

14.3 Unsuccessful or incomplete quote submissions

Incomplete or failed quote-submission records may be retained for up to 30 days to diagnose errors and prevent duplicate submissions.

14.4 Inquiries and quote requests

General inquiries and quote requests that do not become an active customer relationship may be retained for up to 6 months after the last meaningful communication.

They may be retained longer where reasonably necessary to:

follow up on a requested project;
resolve a complaint;
prevent abuse;
establish or defend a legal claim; or
comply with legal obligations.

14.5 Customer projects and orders

Information relating to active customers, projects, quotes, approvals, orders, deliveries, and support may be retained for the duration of the business relationship and afterward for the applicable limitation and legal-retention periods.

Invoice, accounting, tax, and transaction records may be retained for up to 10 years where required by applicable law.

14.6 Delivery-recipient information

Recipient and delivery information is retained only for as long as necessary to:

complete delivery;
manage tracking;
process returns;
investigate failed delivery;
resolve claims; and
meet contractual or legal obligations.

Unless a longer period is required for a claim, contract, or legal obligation, delivery-recipient information is generally deleted or anonymized within 24 months after completion of the relevant delivery program.

14.7 Uploaded project and brand files

Files connected with an inquiry that does not become an active project may be retained for up to 6 months.

Files used for an active project or order may be retained for the duration of the customer relationship and for as long as reasonably necessary to support repeat production, resolve disputes, or comply with contractual and legal obligations.

Customers may request earlier deletion where continued retention is not required.

14.8 Support communications

Support records may be retained for up to 12 months after the issue is resolved, unless they relate to an active order, legal claim, security incident, or other matter requiring longer retention.

14.9 Security and operational logs

Application, MCP, security, and error logs are generally retained for up to 90 days.

Relevant records may be retained longer when required to investigate a security incident, prevent fraud, or establish or defend a legal claim.

14.10 Marketing data

Marketing information is retained until you unsubscribe, object, withdraw consent, or the information is no longer required for the relevant marketing purpose.

We may retain a minimal suppression record after an opt-out to ensure that we do not send further marketing communications.

14.11 Backups

Deleted data may remain in restricted backup systems for up to 90 additional days before being overwritten, unless a longer period is required for security, disaster recovery, or legal reasons.

At the end of the applicable period, information is deleted, anonymized, or securely restricted unless continued retention is legally required.

15. Data Security

We apply reasonable technical and organizational measures designed to protect personal data against:

unauthorized access;
accidental or unlawful destruction;
loss;
alteration;
disclosure;
misuse; and
other unauthorized processing.

Measures may include:

access controls;
role-based permissions;
secure authentication;
encryption in transit;
appropriate encryption at rest;
logging and monitoring;
backup and recovery procedures;
data minimization;
provider due diligence;
staff confidentiality obligations;
incident-response procedures; and
regular maintenance and security updates.

No internet transmission or storage system is completely secure. We therefore cannot guarantee absolute security.

If you become aware of a suspected security issue involving SoMerch, contact [email protected] without sending passwords, access tokens, or other authentication secrets.

16. Your Rights

Where the GDPR applies, you may have the right to:

receive information about how your data is processed;
request access to personal data we hold about you;
request correction of inaccurate or incomplete information;
request deletion of personal data;
request restriction of processing;
object to processing based on legitimate interests;
object to direct marketing at any time;
request data portability where applicable;
withdraw consent where processing is based on consent;
request information about applicable international-transfer safeguards; and
lodge a complaint with a competent data-protection authority.

In Bulgaria, the competent supervisory authority is the Commission for Personal Data Protection.

These rights may be subject to legal conditions, exemptions, and limitations.

To exercise a right, contact [email protected]. We may need to verify your identity and relationship with the relevant company or project before completing the request.

17. ChatGPT App Controls and Deletion Requests

When using the SoMerch ChatGPT App, you may:

stop product planning at any time;
decline to submit a quote request;
review the information before submission;
correct your contact details before submission;
avoid including optional information;
request deletion of a temporary merchandise plan;
request deletion of a quote request where no legal basis requires continued retention;
object to marketing communications; and
stop using or remove the App through the controls available in ChatGPT.

Removing or disconnecting the App from ChatGPT does not automatically delete a quote request or other information already submitted to SoMerch.

To request deletion, contact [email protected] and, where available, include the relevant:

temporary plan ID;
quote-request reference;
company name;
business email address; or
other information needed to locate the record.

Do not send passwords, authentication codes, or API keys when making a request.

18. Children

The SoMerch website, platform, applications, and services are intended for business use and are not directed to children.

We do not knowingly collect personal data directly from children through the SoMerch ChatGPT App or our business services.

If you believe that a child has provided personal data to us without appropriate authorization, contact [email protected].

19. Third-Party Platforms, Websites, and Services

Our services may contain links to third-party websites, products, delivery providers, payment providers, or other platforms.

The SoMerch ChatGPT App operates within ChatGPT, a service provided by OpenAI. Your ChatGPT account, conversation history, ChatGPT settings, and OpenAI’s independent use of information are governed by OpenAI’s own terms and privacy policy.

SoMerch is not responsible for the privacy practices of third parties acting as independent controllers. We encourage you to review their privacy information before providing personal data.

20. Changes to This Privacy Policy

We may update this Privacy Policy to reflect:

changes to our services;
new applications or integrations;
changes to our data practices;
legal or regulatory developments;
security requirements; or
changes to the providers we use.

The updated version will be published on this page with a revised effective date.

Where a change materially affects how we use personal data, we will provide additional notice where required by law.

21. Contact Us

For questions about this Privacy Policy, the SoMerch ChatGPT App, or the way we process personal data, or to exercise your data-protection rights, contact:

Prisma Ltd.