Privacy

Times, product codes, documents, amounts and other tool inputs are processed in this browser on your device. Your business details, logo, currency and last document number may be saved in this browser so they are ready next time; “Clear saved info” removes them. Each time a tool gives you a result (a result left on screen after you edit, or a copy, print or download), we keep a record of that tool’s inputs and result: time card times, unpaid breaks, overtime setting, hourly rate and totals, without the employee name; barcode format and values; invoice and receipt items, quantities, prices, amounts, currency, tax, discount, shipping, dates, number, payment method and notes, without business or customer names and addresses, keeping only the domain of an email address and the country and area code of a phone number; and the amounts and options entered in the fee calculators with their results. These records contain the estimated country and device type, but no IP address or session number. Usage records are collected as described below. If we make a material change to this notice, we will post the updated notice on this page with a new revision date.

The controller for the personal data processing described in this notice on merpad is Dan Kim, the individual operator. “The operator” in this notice means Dan Kim. As a first contact, you can use the site's feedback button for privacy enquiries and rights requests, or email the operator's shared contact address, agt.tije@gmail.com. Use email if the button is unavailable, submission fails, or you need a reply.

We have not appointed a representative in the European Union. This is not a claim of exemption from the obligation to appoint one. You can send privacy enquiries and rights requests directly to the operator using the contact above.

This site collects the own-service usage and error records described below. Collection and feedback submissions are subject to the EEA restriction below.

When the collection server classifies a request’s country as being in the European Economic Area (EEA), or cannot determine its country, we block new collection of our own usage analytics, error reports and feedback for that request. If a request to load the feedback widget meets this condition, it does not display a new widget. However, a widget cached by the browser or already loaded may appear before that classification or remain visible while the page has not been reloaded. Even if the widget is visible, when a feedback submission request meets this condition, the collection server does not read or store its body, and, if you have not changed your draft since sending it, the widget displays a submission failure. The draft remains in that page’s memory and is not automatically resubmitted. Country classification can be inaccurate. This restriction does not stop hosting operations needed to serve the site.

Where you access the service from and how you arrive

To understand and improve features and language versions, we record page arrivals, interaction starts, ways of obtaining results and departure times for sessions already started. Records also contain times, page, feature and build identifiers, temporary session and operation numbers, estimated country and state or province, referral sources and one browser display-language setting. However, page arrival records do not include session and operation numbers, state or province, referral sources or display language. We do not record cities, coordinates or the full preferred-language list.

Loading a page creates one page arrival record; usage events require interaction. Errors can be reported without interaction. The session number for our own measurement exists only in browser memory and changes on reload. We do not create persistent identifiers in cookies or browser storage to recognise returning visitors. Records sent to the server remain after a visit ends or the browser's number disappears.

We record the referring site's hostname and the page path supplied for external referrals, excluding query strings and fragments. Words or identifying information within the path itself may remain. To improve the service and produce usage statistics, we store what you enter into our tools and the results they produce. Before storage, your browser removes parts of personal details, such as the part of an email address before the @, phone digits after the area code, names and street addresses, and secret values in links; passwords and authentication secrets are not stored. Copied content and search inputs are not automatically attached to our own usage or error reports. Text you submit in feedback and site-specific sharing features are separate.

To investigate and fix technical faults, we record error type, code and time, page and build identifiers and a temporary session number. If a script file maps to a registered identifier, we send that identifier and available line and column positions; otherwise we record “unknown” without a position. Error reports exclude the error message, stack trace, original URL and your inputs.

Browser errors also record estimated country and state or province, one display-language setting and the referring hostname. This error context excludes IP addresses, referral page paths, cities, coordinates, full language-preference lists, raw request headers and browser type and version signals.

Usage records include the full IP address. We display it in the administration view and use it to exclude the operator's own visits from usage statistics. An operator-visit flag may remain after the IP is removed. The same IP can link different visits, but does not necessarily mean the same person. Stored IP addresses do not themselves trigger automatic blocks.

To limit excessive submissions, we use an in-memory hash based on the site and IP that changes with the UTC date. Requests to the same site from the same IP on the same day may share this value; it is not used to store visit histories. Rate limits can reject individual submissions.

Retention periods

We retain full IP addresses and referring-page paths while they are actually needed to exclude operator visits, assess automated access (bots) and abuse, and classify and verify usage statistics. We determine this need by whether the visit has been classified as an operator visit or otherwise, whether unresolved bot or abuse questions require comparison of request times, frequency and access patterns for the same IP, and whether referral classification or checks for errors and duplicates in the related statistics still require the original information. The need for each item ends when the assessments requiring it are complete or can be performed without the original information. Possible future use or the continued production of statistics alone does not justify retaining the original information. When the need ends, we promptly transform it, for example by removing the trailing part of the IP and identifying parts of the path, so that the original IP cannot be reconstructed and individuals cannot be identified, including by combining it with other information. We retain the resulting records without an end date. If truncation alone does not prevent identification, we further reduce or aggregate the information or remove identifying parts to achieve that result. The same criteria apply to other usage records and feedback. We retain identifiable content while it is actually needed for the related usage classification, statistical verification, error investigation, or review, action and replies concerning feedback. When that work is complete or can continue without identifying information, we promptly transform it into a form that does not permit identification. We retain the transformed usage records and feedback without an end date. A temporary session identifier disappearing from your browser does not change these criteria for records already sent to the server. Identifying information in archives and backups is subject to the same criteria for when the need ends.

After removing the IP and referral page path, fields such as event and page identifiers, session numbers, times, country, region, referring hostname and display language remain. We continue to treat these as personal data. We use aggregate results for statistics and view individual records through an access-restricted administration interface. Error and feedback records also currently have no fixed deletion deadline.

The incoming temporary copy at Cloudflare is deleted after successful ingestion into our operational storage. This deletion does not automatically remove separately retained failed-ingestion data.

When you submit feedback, we receive your text, chosen rating and the relevant page identifier. We trim surrounding whitespace and attach the rating marker before sending; we do not attach an IP address or session number to the feedback record. We review feedback to improve the service. The form has no reply-address field and cannot provide individual replies, so send rights requests needing a reply to the email above. Do not include passwords, access keys, payment details, identity-document copies or unnecessary personal information.

Cloudflare, Inc. (USA) is our processor for hosting, transmission, temporary storage in our own collection path and administration access. It processes connection information such as IP addresses, access times and user agents to serve the site. If you email us, Google processes the correspondence and sender address as our email service provider.

Collected records are also processed on the operator's computer in South Korea; that computer and its local archives are included in the backup configuration for an attached drive. Cloudflare processes requests across its global infrastructure, and our collection buffer is configured in Asia-Pacific, so processing is not limited to the EEA.

The grounds and safeguards applying to transfers outside the EEA are as follows.

• Hosting and usage-record processing through Cloudflare: transfers to the United States rely on the EU–US Data Privacy Framework (DPF) adequacy decision (EU) 2023/1795; restricted transfers not covered by the DPF use the Standard Contractual Clauses (SCCs, Decision (EU) 2021/914, Module 2) under the Data Processing Addendum (DPA) incorporated by section 6.1 of the self-serve terms.
• Email received through Google (Gmail or Google Workspace) when you write to the contact address above: transfers to Google LLC in the United States rely on the DPF adequacy decision (EU) 2023/1795.
• Transfers to the operator's computer in South Korea rely on the EU adequacy decision for the Republic of Korea (EU) 2022/254.

Copies of the relevant documents are available at https://www.dataprivacyframework.gov/list or by requesting them through the email above.

Invocation-log storage is disabled for our analytics collector.

Where GDPR applies, the basis for usage statistics, excluding operator visits, fixing errors, responding to general feedback and email, hosting, request limits and investigating technical problems is our legitimate interest in each stated purpose (Article 6(1)(f)). Processing necessary to handle data protection rights requests is based on compliance with legal obligations (Article 6(1)(c)).

Subject to legal conditions, you can request access, rectification, erasure and restriction of processing. Portability applies to automated processing based on consent or contract; legitimate-interest processing alone does not create that right. We may be unable to identify your records safely and will inform you where possible. When requesting deletion, you may provide the approximate date and time of use, time zone and page visited to help us check the records, but we do not routinely require an identity document or session number. An IP match alone is not proof of identity and does not authorise disclosure of another person's records.

We will respond about action on your request without undue delay and no later than one month after receipt. If complexity or the number of requests requires up to two further months, we will explain the extension within the first month. If we do not act, we will explain why and how to complain to a supervisory authority or seek a judicial remedy within that period. A submission only through the feedback form cannot receive an individual reply, so contact the email above for a response.

Browser signals

We do not currently collect browser type and version signals or indications of automation-tool use. If we decide to enable collection, we will first update this notice to explain the data, purpose, retention arrangements and start time. If enabled, these signals will be used to help identify bots, but they are estimates reported by the browser and do not conclusively establish its type or version or whether automation tools are being used. We will not collect them retrospectively for use before collection is enabled.

Right to object

You may object at any time, on grounds relating to your particular situation, to processing of your personal data under Article 6(1)(f) GDPR. We will stop that processing unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Use the contact above to make your request.

You may lodge a complaint with a supervisory authority, particularly in the Member State of your habitual residence, workplace or the alleged infringement (Article 77 GDPR).

You have no statutory or contractual obligation to submit feedback or enable transmission of usage data; the tools work without feedback and with the measurement script blocked. Accessing the site requires technical IP processing by the hosting provider. There is currently no per-user measurement switch; you can block transmission in your browser or object using the contact above. We make no solely automated decisions producing legal or similarly significant effects on you, and possible-bot labels in administration are for internal analysis and do not trigger action against users.

Site operator: Dan Kim

Tool descriptions are written with AI assistance, and the site operator reviews them and takes responsibility for their content.

Revision date: 2026-11-01