Privacy Notice

1. Who we are, and our role

Merconomic ("we", "us") provides a sales, stock, GST and cost dashboard for online sellers, at merconomic.com (the "Service"). This notice is given under the Digital Personal Data Protection Act, 2023 (the "Act").

• For your own account data (who you are and how you sign in) we decide why and how it is used. We are the Data Fiduciary.
• For the business records your organization enters or imports, which can include its buyers' and suppliers' details, your organization decides the purpose and we only store and process them on its behalf. Your organization is the Data Fiduciary and we are its Data Processor. A buyer or supplier who wants to see, correct or erase their details should ask the organization they dealt with; we give the organization the tools to do it.

2. The personal data we hold, and why

• Your account: name, email address, role, and a password (stored only as a one-way hash) or your Google account identifier

  To create your account, let you sign in, and keep it secure. You give this when you sign up, and agree to this notice then.

• A phone number — only if you add one

  To send you the WhatsApp alerts you choose to switch on. You can remove it at any time.

• The name and email address of a person you choose to name to act for you — only if you name one

  So that, if you die or cannot act for yourself, we know who may exercise your data rights. You can change or remove them at any time.

• Details of teammates, entered by an Owner or Admin: name, email address, role

  To give them access to the organization's workspace. They are asked to read and accept this notice when they first sign in.

• What you do in the app: the audit log (your name, role, what changed, and when) and a sign-in session cookie

  So the organization can see who changed what, and to keep your session secure. Sign-in attempts are also counted against your email address and network address for a short time, to stop password guessing.

• Your organization's business records: sales and orders, returns, purchases, stock, costs, GST entries, payouts

  To provide the Service. These can include the name, email or phone, state and PIN code, and GST number of buyers, and the contact details of suppliers. They are your organization's data and are processed only on its behalf.

• Documents you choose to import (a photo or file of an invoice or statement)

  Only if you use "Import from document". The file is sent to our AI provider (OpenAI) to read the fields out of it. Please do not upload documents containing personal data you have no right to use. We do not keep the file after it has been read.

• Payments: an order and payment reference, the amount and its status

  To record your subscription. The payment itself is taken by Razorpay; we never see or store your card, UPI or bank details.

• Emails and messages we send you

  Account emails (verification, password reset), and — unless you switch them off in your settings — alert emails and the weekly summary, and WhatsApp alerts if you have switched them on.

We do not sell personal data, and we do not use it for advertising, profiling or tracking you across other sites.

3. Who it is shared with, and where

We use these providers to run the Service. Each handles personal data only to do its job for us.

• Supabase — database

  Stores everything above. Hosted in South Korea.

• Vercel — hosting

  Runs the application, from South Korea, and serves its pages through a worldwide network.

• Resend — email

  Delivers the emails we send you. United States.

• Twilio — WhatsApp

  Delivers WhatsApp alerts, only if you switch them on. United States.

• OpenAI — document import and product groups

  Reads documents you choose to import, and sorts product names into broad product groups for the anonymous statistics below. United States.

• Google — sign-in

  Only if you choose "Continue with Google". Governed by Google's own privacy policy.

• Razorpay — payments

  Takes subscription payments. India.

Several of these are outside India. The Act allows personal data to be transferred abroad except to countries the Government restricts; we will stop any transfer to a country that is restricted. We may also have to disclose data when the law requires it.

4. Anonymous, combined statistics

From 1 December 2026, we work out, for each month, a few percentages and averages from your organization's records (such as its margin, return rate, fees and average order value, for each platform and product category) and combine them with other sellers' to show every seller how they compare, and, later, to offer the same combined statistics to others. This is done for the organization's business, not for any person.

• To compare like with like, each product is put into a broad group (for example Beauty › Skincare) by our AI provider, OpenAI (United States). Only the product's name and the category you gave it are sent, never prices, SKUs, quantities, buyers or your organization's name, and only the group is kept, not the name.
• It never includes any order, buyer, supplier, SKU, name, email, phone number, PIN code or revenue total. It uses only ratios and averages for a whole month.
• A figure is shown only when at least 10 sellers are behind it, and then only as the range the middle half of them fall in. It cannot be traced to you or to any one seller.
• The Owner can switch it off at any time under "Benchmarks". Your figures are then taken out of the combined statistics at once, and benchmarks are no longer shown to your organization.
• Because it holds no personal data, the combined statistics are kept for as long as they remain useful.

5. How long we keep it

• Your account and your organization's records

  For as long as the account is open. If a free trial or plan ends and is not renewed, we keep the organization's data for 90 days so the Owner can come back (we email the Owners about a month before, and again a week before), and then erase it in the same way as a deletion. When your organization is deleted, everything is erased 7 days after the Owner confirms (it can be cancelled until then). When you delete your own account, your personal details are erased at once.

• Payment records for what an organization paid us

  We keep these after an organization is deleted, because tax law requires us to keep invoices and accounts for years. Nothing else is kept.

• Tax invoices your organization issued to GST-registered buyers

  These stay in your organization's records, because the law requires the seller to keep them as they were, even if the buyer asks for erasure.

• Housekeeping logs

  Sign-in links are deleted a week after they expire; the log of which alerts we sent you, after 180 days; the logs of summaries and reminders, after about 13 months; finished privacy requests, after 3 years.

6. Your rights, and how to use them

You can do all of these yourself, from the Team page once you are signed in:

• See your data: "Download my personal data" gives you a file of what we hold about you.
• Correct or update it: change your name and the email you sign in with (and your phone number in your alert settings) under "Your account". For anything else, send a request.
• Erase it: "Delete my account" erases your account and your personal details. (If you are the only Owner, make someone else an Owner first, or delete the whole organization.)
• Withdraw your consent: deleting your account does this. You can switch off alert emails, the weekly summary and WhatsApp alerts at any time without deleting anything.
• Complain, or ask us anything about your data: "Make a request or complaint" gives you a reference number, and we will reply within 30 days.
• Name someone to act for you if you die or cannot act for yourself: "Name someone to act for me" lets you record one person (their name, email address and, if you wish, how they are related to you). We do not contact them. If that day comes they write to us at the address below, we check who they are, and we deal with their request as we would yours. You can change or remove them at any time, and deleting your account erases them too.

If you are a buyer or a supplier of one of our customers, please ask that organization: they can look up, give you a copy of, and erase the personal details held about you.

7. Children

The Service is for businesses and is for people aged 18 and over. We ask you to confirm you are 18 or older when you sign up, and we do not knowingly collect personal data from anyone younger. If we learn that we have, we delete it.

8. How we protect it

• Connections are encrypted (HTTPS) and browsers are told to only ever use them.
• Passwords are stored only as one-way hashes. Marketplace connection details and two-factor secrets are encrypted before they are stored.
• You can switch on two-factor sign-in with an authenticator app.
• Each organization's data is kept apart: a signed-in person can only reach their own organization's records, and every request is checked for that.
• Access is by role; changes are recorded in an audit log; repeated sign-in attempts are blocked; and our systems are checked automatically every day for data that does not add up.

If personal data is ever lost, stolen or exposed, we will tell the people affected and the Data Protection Board of India, as the law requires, and say what happened and what to do.

9. Contact, grievances, and the Data Protection Board

For anything about your personal data, or to make a complaint:

• Email: support@merconomic.com

If you have complained to us and are not satisfied with our reply, you may complain to the Data Protection Board of India.

10. Changes to this notice

This is version 2026-11-10. When we change it in a way that matters, we raise the version, show every user a notice in the app, and ask you to read and agree again. Older versions are available on request.