1. What this notice covers
1.1 This notice explains the cookies and similar technologies (browser storage) used:
- on Mercayo's own websites (mercayo.com) and the Mercayo admin, where Wahenam International is responsible; and
- on stores built on Mercayo, where the merchant is responsible, and Mercayo provides the technology. Each store's own privacy policy also describes them.
1.2 A cookie is a small file a website stores in your browser. Local storage and session storage are similar places in your browser that only the website itself reads; session storage is cleared when you close the tab.
2. Our approach
- Mercayo's own websites and the admin use only what they need to work, or to keep them secure. We do not use advertising cookies, cross-site tracking, or third-party analytics cookies on mercayo.com or in the admin.
- On stores, Mercayo's technology sets only what the store needs to work, plus the tags a merchant chooses to add (section 4.3). Those tags load only after the shopper agrees to them in the store's cookie choices.
- Our own cookies are
HttpOnlywhere possible (scripts on the page cannot read them),Secureon HTTPS, and limited to the site that set them.
If we add a cookie that is not strictly needed on mercayo.com or in the admin, we will update this notice first, and ask for your consent before setting it.
3. Mercayo admin and websites
| Name | Set by | Purpose | Lasts | Type |
|---|---|---|---|---|
__Host-mercayo_admin (mercayo_admin on plain-HTTP test machines) | Mercayo | Keeps a merchant or staff member signed in to the admin. Holds the session tokens; scripts cannot read it | Until sign-out, or the session expires | Strictly necessary |
__Host-mercayo_support (mercayo_support on plain HTTP) | Mercayo, on the support host only | Keeps a Mercayo support session open in a store's admin. Lasts no longer than the session (at most 8 hours) | At most 8 hours | Strictly necessary |
mercayo_signup_flow | Mercayo, during sign-up | Links the sign-up page to the one-time code it asked for, so only that page learns whether the code worked | 15 minutes | Strictly necessary |
mercayo_site_theme (local storage) | mercayo.com | Remembers whether you chose the light or dark look | Until you clear it | Preference |
__cf_bm, cf_clearance, and other Cloudflare cookies | Cloudflare, on addresses behind Cloudflare | Bot and attack protection; proves a browser passed a security check | Up to 30 minutes (__cf_bm); cf_clearance as Cloudflare sets | Strictly necessary (security) |
4. Stores built on Mercayo
4.1 What the store needs to work
| Name | Purpose | Lasts | Type |
|---|---|---|---|
mercayo_cart | Remembers the shopper's bag, so it is still there on the next visit. Holds a random bag token, not personal details. HttpOnly | 30 days | Strictly necessary |
mercayo_shopper | Keeps a shopper signed in to their account at that store. HttpOnly | 30 days, or until sign-out | Strictly necessary |
mercayo_receipt | Lets the shopper who just ordered open their order's page without signing in. HttpOnly | Up to 3 days | Strictly necessary |
mercayo_oauth | Protects a "Continue with Google" sign-in while it is in progress. HttpOnly | 10 minutes | Strictly necessary |
mercayo_gate | Lets a visitor who entered the password see a store that is not open yet. HttpOnly | As the store sets | Strictly necessary |
mercayo_unpaid_order (session storage) | During an online payment, remembers the order being paid, so the checkout can recover if the payment window is closed | Until the tab is closed, or the payment completes | Strictly necessary |
mercayo.consent (local storage) | Remembers the shopper's cookie choices, so the store does not ask again | As the store sets | Strictly necessary |
mctry, mcur, mmkt, mmkt_seen, mfit | Remember the shopper's country, currency and market, that they closed the country suggestion, and the product fit they picked (for example, a phone model) | Up to 1 year | Preference |
mfv | Notes that this browser already holds the store's styles and fonts, so pages load faster. Holds no personal data | 1 year | Strictly necessary |
Other local storage (mercayo…) | Recently viewed products, recent searches, a product comparison, a dismissed announcement, and the bag's item count, kept in the browser only | Until you clear it | Preference |
| Razorpay cookies and storage | Run Razorpay's payment window and its fraud checks, on the checkout page only | As set by Razorpay | Strictly necessary |
| Cloudflare cookies (as in section 3) | Security, on store addresses served through Cloudflare | As above | Strictly necessary |
4.2 Set only after the shopper allows marketing
| Name | Purpose | Lasts |
|---|---|---|
mx_visit | Remembers the campaign or referral link the shopper arrived from, so the store can apply that campaign's offer | Until the browser is closed |
mercayo_aff (local storage) | Remembers an affiliate's link, so the affiliate is credited if the shopper buys | The days the store counts an affiliate link |
| A friend's referral code and a device id | Kept in the browser, so a friend's referral offer reaches the shopper's first order | Until used, or you clear it |
4.3 Tags the merchant adds
A merchant may add tags from advertising and analytics services to its store, for example the Meta pixel, Google Analytics, Google Ads, Google Tag Manager, the TikTok pixel, the Snapchat pixel, the Pinterest tag, Microsoft Clarity or Microsoft Advertising, and may add more than one of each. These services set their own cookies to measure visits and sales and to show ads. They load only after the shopper agrees in the store's cookie choices, and the shopper can change that choice at any time from the link at the foot of every page. With the same consent, a store may also send a purchase to these services from Mercayo's server (a conversions API), so the service counts it even when an ad blocker stops its tag. The merchant is responsible for the tags it adds, and each service's own privacy policy describes its cookies.
Fonts. Store pages may load fonts from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). This sets no cookies, but Google receives your IP address and browser details when the font loads. See Google's privacy policy.
5. Your choices
- On a store, use Cookie Choices at the foot of any page to allow or refuse marketing and analytics.
- You can block or delete cookies and browser storage in your browser settings. If you block the strictly necessary ones, the parts of the site that need them will not work: you will not be able to sign in, or keep a bag.
- Clearing a store's cookies empties your bag and signs you out of your account there.
6. Contact
Questions about this notice: grievance@mercayo.com. For a store's cookies, contact the store, using the details on its contact page.