Privacy and Consent
Respect Your Shoppers' Privacy, the Way India's Law Asks
India's Digital Personal Data Protection Act asks stores to get clear consent and to erase data on request. Mercayo builds both into every store, so you start on the right side of it.
- In every plan
- Free for 14 days
Kosha is a demo store on Mercayo. Its products, orders and customers are sample data.
In short
What It Does
Mercayo handles three parts of your shoppers' privacy for you: consent before tracking, consent before marketing, and erasing an account on request.
Cookie Consent
- Marketing and analytics tags load only after the shopper agrees, in their own browser, and only for the categories they agreed to: analytics (Google Analytics, Microsoft Clarity) and marketing (Meta, Google Ads, Pinterest). No tag is ever written into your pages.
- The banner states each purpose in plain words and names the services you really use ("Used here: …"). NECESSARY ONLY is exactly as visible as ACCEPT ALL; CHOOSE opens switches per category, all off to start with. Strictly necessary cookies (the bag, sign-in, the shopper's own choices, protection from abuse) are always on and say so.
- The shopper can change or withdraw their choice any time from Cookie Choices at the foot of every page. The choice is kept for the days you choose (180 to start with), then asked again.
- The choice is kept in the shopper's own browser and is never sent to Mercayo. Google's tags are told the choice too, so they follow it.
- The banner shows only while a tag is set, or always if you prefer. It sits at the foot of the screen over the page, so your pages do not jump when it appears.
Mercayo's own visit counts for your store analytics use no cookie and keep no personal data, so they work without the banner.
Subscribers
Email sign-ups from the footer, the sign-up popup and the home page use double opt-in: a new email address joins your list only after its owner taps the link in a confirmation email, so nobody can sign up someone else. A WhatsApp number joins with the consent the shopper gave, and the consent text they agreed to is kept with every sign-up. Marketing emails carry an unsubscribe link, and a WhatsApp STOP ends WhatsApp messages from your store.
Delete My Account
A shopper can delete their account in your store from their account page, confirmed with a 6-digit code. Before they confirm, they are shown what is deleted, what the store must keep and why, and any store credit they would lose. After a short grace (7 days, in which they can cancel), the erasure runs on its own:
| Erased | Kept, as the Law Requires |
|---|---|
| Name, mobile number, email and saved addresses | Orders, their lines, amounts and taxes, without the name, phone, email or street address |
| Ways to sign in (including the Google link) and every signed-in device | Every GST invoice and credit note, exactly as issued |
| Marketing consent, open bags, back-in-stock requests, messages not yet sent | Payment, refund, shipment and store credit records, without personal details |
| The name and contact on their reviews (the review stays, by "A customer") |
Your team then sees "Deleted customer" where the name was.
For your store
Why It Matters
Shoppers increasingly care who sees their data, and India's DPDP Act gives them rights you must respect: to be asked before their data is used, to withdraw that consent as easily as they gave it, and to have it erased. A clear banner, real consent before tracking, and a working delete button build trust and keep you prepared, without you having to engineer any of it.
The hard part of erasure in India is GST: you must keep your tax records for years, so "delete everything" is not allowed either. Mercayo draws that line for you, erasing the person while keeping the invoices and orders the tax law requires, stripped of their name, phone, email and street address.
Getting consent right also makes your marketing data cleaner: the tags count shoppers who agreed, and a list built with double opt-in reaches real people who asked to hear from you.
Step by step
How It Works
Add Your Tags
In Settings → Pixels, Cookies and App, add the ids of the services you use. Each id is checked by its shape before it is saved, and only the services you set may load on your pages. See ads pixels.
Choose When the Banner Shows
In the Cookie Banner card, set When to ask for consent: when needed (only while a tag is set) or always. Set Days a choice is kept (30 to 395). The banner's title and opening line are yours to change in Localization; the purpose wording is Mercayo's, kept in step with the law.
Shoppers Choose
On their first visit, the banner offers ACCEPT ALL, NECESSARY ONLY and CHOOSE. CHOOSE shows Analytics and Marketing with the services used for each, both off, and SAVE CHOICES. Tags load only for what they agreed to, after the page has been shown.
Keep Your List Clean
With Confirm Emails by a Link on (the default), each new email subscriber gets a confirmation email in your store's name and joins your list only after they tap it. Subscribers who unsubscribe, or reply STOP on WhatsApp, stop getting your marketing, while their order messages still arrive.
Publish a Privacy Policy
In Settings → Policies, CREATE MY POLICIES writes six pages from your store details and settings, the privacy policy among them. Read it, edit what is not true for your business, and publish: the cookie banner links to it, and all six must be published before you launch.
Requests to Delete Are Handled for You
A shopper presses DELETE MY ACCOUNT on their account page, ticks that they understand what is deleted and kept, and confirms with a code sent to their confirmed phone or email. While an order is still on its way, they are asked to wait until it is delivered or cancelled. After the grace period, the erasure runs on its own.
Your shoppers
What Your Shoppers See
A clear banner with equal ACCEPT ALL and NECESSARY ONLY buttons, a Cookie Choices link on every page to change their mind, and nothing optional switched on until they agree. When they join your list by email, a confirmation email to tap first. In their account, a Delete My Account that tells them, before they confirm, what will be erased, what the law makes the store keep (orders and GST invoices, without their details) and any store credit they would lose, with a few days to cancel.
Settings
Settings You Control
Each one is in your admin. A new store starts with the value shown.
Mercayo
Mercayo's Controls
The banner's category wording and its withdrawal line are Mercayo's, kept in step with the law for every store; its title and opening line are yours. The grace period before an account is erased is set by Mercayo (7 days), and what is erased and what is kept is the same for every store, so no store can keep more personal data than the law allows or erase invoices it must keep. Mercayo's team can force the banner to show always for a store, or switch tags off, with a reason your admin shows.
Limits today
Good to Know Before You Start
- Deleting an account keeps the orders and GST documents the law requires, without the personal details.
- A shopper's account is deleted in one store only; their accounts in other stores are separate.
- Store credit left on a deleted account is lost (it is not cash); the shopper is told the amount before they confirm.
- Mercayo writes a starting privacy policy from your details, but it is not legal advice: what it says about your business is yours to check and publish.
- WhatsApp sign-ups join at once with the consent they gave; there is no confirmation message on WhatsApp.
Questions
About Privacy and Consent
Do tags load before the shopper agrees?
No. They load only after consent, in the shopper's browser, and only for the categories they agreed to. Before that, your pages carry no marketing or analytics tag at all, and your pages allow only the services you set to load.
Can a shopper change their mind?
Yes, any time, from Cookie Choices at the foot of every page. Withdrawing is as easy as agreeing: the same switches, off. From then on, the tags they switched off are not loaded.
What is kept when a shopper deletes their account?
Orders, amounts, payments, shipments and every GST invoice and credit note, as tax law requires, with the name, phone, email and street address removed. Personal details, saved addresses, sign-in ways and marketing consent are erased.
Can a shopper with an open order delete their account?
Not until the order is delivered or cancelled, or an exchange in progress is finished; they are told so. If an order appears during the grace period, the erasure waits until it is done.
Can a deletion be undone?
During the grace period (7 days), yes: the shopper presses CANCEL DELETION in their account and nothing is lost. After it, the personal details are gone and cannot be brought back, by you or by Mercayo.
Does Mercayo's own analytics need consent?
No. Mercayo's visit counts for your analytics use no cookie, no browser storage and no personal data, so they run for every visit. Only the outside tags you add (Meta, Google, Pinterest, Clarity) wait for the banner.
Is the banner the same as GDPR's?
It is written for India's DPDP Act: plain purposes, the services named, refusing as easy as accepting, and withdrawal at any time. Those are also what GDPR asks of a cookie banner, but Mercayo does not claim GDPR compliance for your store.
Who sees a shopper's consent?
The cookie choice stays in the shopper's own browser and is never sent to Mercayo. A subscriber's consent (the words they agreed to, when and where they signed up) is kept with their sign-up, as your record of it.
Related
Related Features
- Ads Pixels and Analytics TagsAdd your Meta pixel, Google Analytics 4, Google Ads, Pinterest and Clarity tags by their ids; they load only after shoppers agree.
- Subscribers, Popups and Floating ButtonsA sign-up popup with sensible rules, a footer band, double opt-in with consent kept, a subscribers list with CSV, and floating WhatsApp buttons.
- Customer AccountsShoppers sign in with a one-time code by email or phone, or with Google, and find their orders, invoices, addresses and credit in one place.
- Store IsolationEvery store's orders, shoppers and products are walled off by the database itself, and tests prove one store can never reach another's.
- Store AnalyticsTen tabs of sales, orders, products, customers, traffic, discounts, GST, stock and live numbers, each with one clear definition and compared over time.
More in Security and Trust: Store Isolation · Staff and Roles · Two-Step Sign-In · Activity Log · Support Access · Encrypted Keys
Try It on Your Own Store
Every feature is in every plan, free for 14 days.
