This is an earlier version. It no longer applies.
READ THE VERSION IN FORCE1. What this notice covers
1.1 This notice explains the cookies and similar technologies (browser storage) used:
- on Mercayo's own websites (mercayo.com) and the Mercayo admin, where Wahenam International is responsible; and
- on stores built on Mercayo, where the merchant is responsible, and Mercayo provides the technology. Each store's own privacy policy also describes them.
1.2 A cookie is a small file a website stores in your browser. Session storage is similar, but is cleared when you close the tab.
2. Our approach
- We use only cookies that the site needs to work, or to keep it secure.
- We do not use advertising cookies, cross-site tracking, or third-party analytics cookies on mercayo.com, the admin, or Mercayo storefronts.
- Our own cookies are
HttpOnlywhere possible (scripts on the page cannot read them),Secureon HTTPS, and limited to the site that set them.
If we ever add a cookie that is not strictly needed (for example, analytics), we will update this notice first, and ask for your consent before setting it.
3. Mercayo admin and websites
| Name | Set by | Purpose | Lasts | Type |
|---|---|---|---|---|
__Host-mercayo_admin (mercayo_admin on plain-HTTP test machines) | Mercayo | Keeps a merchant or staff member signed in to the admin. Holds the session tokens; scripts cannot read it | Until sign-out, or the session expires | Strictly necessary |
__Host-mercayo_support (mercayo_support on plain HTTP) | Mercayo, on the support host only | Keeps a Mercayo support session open in a store's admin. Lasts no longer than the session (at most 8 hours) | At most 8 hours | Strictly necessary |
__cf_bm, cf_clearance, and other Cloudflare cookies | Cloudflare, on addresses behind Cloudflare | Bot and attack protection; proves a browser passed a security check | Up to 30 minutes (__cf_bm); cf_clearance as Cloudflare sets | Strictly necessary (security) |
| Any mercayo.com marketing-site cookies, once that site is built |
4. Stores built on Mercayo
| Name | Set by | Purpose | Lasts | Type |
|---|---|---|---|---|
mercayo_cart | The store (Mercayo technology) | Remembers the shopper's bag, so it is still there on the next visit. Holds a random bag token, not personal details. HttpOnly | 30 days | Strictly necessary |
| COD verification cookie (name to be confirmed when built) | The store (Mercayo technology) | When the store's "remember verified number" setting is on, it records that this device verified a mobile number by one-time code. It holds a signed hash of the number, never the number itself, so the shopper is not asked again for the store's setting; default 30 days. HttpOnly, and limited to that store | Up to the store's setting (default 30 days) | Strictly necessary (security / checkout) |
mercayo_unpaid_order (session storage) | The store (Mercayo technology) | During an online payment, remembers the order being paid, so the checkout can recover if the payment window is closed | Until the tab is closed, or the payment completes | Strictly necessary |
| Razorpay cookies and storage | Razorpay, on the checkout page only | Run Razorpay's payment window and its fraud checks | As set by Razorpay | Strictly necessary (payment) |
| Cloudflare cookies (as in section 3) | Cloudflare | Security, on store addresses served through Cloudflare | As above | Strictly necessary (security) |
Fonts. Store pages load their fonts from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). This sets no cookies, but Google receives your IP address and browser details when the font loads. See Google's privacy policy.
Stores' own additions. A merchant may add its own tools to its store in the future (for example, analytics or advertising pixels). The merchant is responsible for those, for telling you about them, and for asking your consent where needed. Mercayo does not currently allow merchants to add third-party scripts.
5. Your choices
- You can block or delete cookies in your browser settings. If you block the cookies above, the parts of the site that need them will not work: you will not be able to sign in, or keep a bag.
- Clearing a store's cookies empties your bag, and means you may be asked for a one-time code again.
6. Contact
Questions about this notice: grievance@mercayo.com. For a store's cookies, contact the store, using the details on its contact page.