Privacy Policy

1. About this policy

1.1 This policy explains how Wahenam International (a sole proprietorship, 8th Floor, 803, North Plaza, Visat-Gandhinagar Highway, Motera, Ahmedabad 380005, Gujarat, India, "Mercayo", "we") collects, uses, shares and protects personal data when you:

• visit mercayo.com or any other Mercayo website;
• sign up for, or use, a Mercayo account or store admin, as a merchant or a merchant's staff member;
• contact us for sales or support.

1.2 Our role.

• We are the Data Fiduciary for the personal data described in this policy: data about merchants, their staff, and visitors to Mercayo's own websites. We decide why and how it is processed.
• We are a Data Processor for the personal data of shoppers who visit or buy from a store built on Mercayo. For that data, the merchant who runs the store is the Data Fiduciary. The merchant's own privacy policy (linked from its store) explains how it uses your data. We process shoppers' data only on the merchant's instructions, under our Data Processing Addendum. If you are a shopper with a question about your data, please contact the store first. If you cannot reach the store, write to us (section 12) and we will pass your request to the store.

1.3 The laws we follow:

• the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), as each provision comes into force;
• until those provisions are in force, the Information Technology Act, 2000 ("IT Act"), section 43A, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules");
• the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 ("IT Rules 2021");
• the CERT-In Directions of 28 April 2022, issued under section 70B of the IT Act.

2. The personal data we collect

2.1 Merchants and store owners

2.2 Staff members invited to a store

Name, email, mobile number, role and permissions, preferred admin language, sign-in records, and a history of the actions they take in the admin.

2.3 Visitors to mercayo.com

IP address, browser and device data, pages visited, the address you came from, and what you type into our forms (for example, a sign-up or contact form). See the Cookie Notice for cookies.

2.4 Shoppers (processed for merchants)

When a store runs on Mercayo, we store and process its shoppers' data on the merchant's behalf. This can include:

• name, phone number, email and delivery address;
• order details;
• payment references (never card or bank credentials);
• one-time-code records (codes stored only as hashes);
• reviews and photos;
• exchange requests and video links;
• message history and opt-outs;
• IP address and the store's own cookies.

The merchant's privacy policy governs this data. See section 1.2.

2.5 Sensitive data

We do not ask for sensitive personal data such as health, biometric or sexual-orientation data. Under the SPDI Rules, "passwords" and "financial information such as bank account or card details" count as sensitive personal data. We store passwords only as one-way hashes, and we do not collect card or bank credentials: Razorpay does. Please do not send us sensitive data in support messages.

3. Why we use it, and on what basis

3.1 Purposes and grounds

3.2 Consent

When we rely on consent, we ask for it with a clear notice and a clear action (for example, an unticked box, or a button that says what you agree to). We record when and what you agreed to. You can withdraw consent at any time, as easily as you gave it: from your account settings, through the unsubscribe link in any marketing email, or by writing to us (section 12).

If you withdraw consent needed to run your account, we will no longer be able to provide the Service. Withdrawal does not affect processing done before it.

3.3 What we do not do

• We do not sell personal data.
• We do not use shoppers' data to market Mercayo, or anything else, to them.
• We do not track or profile children, and do not show them targeted advertising (DPDP Act, section 9(3)).

3.4 Platform security data about shoppers

To protect every store and the Service as a whole, we keep, as our own records:

• network and security logs (IP addresses, request times, and outcomes);
• rate-limit counters (for example, how many one-time codes a phone number or an IP address requested);
• signals of attacks or abuse.

We use them only for security, fraud prevention and legal compliance, and keep them for the periods in section 5.

4. Who we share it with

4.1 Service providers (our processors). We use the providers below. Each processes data only on our instructions, under a contract that requires protection at least as strong as ours.

4.2 Services that receive no personal data from us:

• Bhashini (Digital India Bhashini Division, Ministry of Electronics and IT): translates Mercayo's own system texts (buttons, labels and messages written by us). We do not send it personal data.
• Let's Encrypt: issues certificates for domain names.

4.3 Services you choose to connect. When you connect your own Razorpay, Shiprocket, Shipway, Cloudflare or WhatsApp account, we send them the data needed for the actions you ask for. Your contract with them governs it, and they act for you, not for us.

4.4 Your store's shoppers see your store's public details (for example, your legal name, address, GSTIN and grievance officer) because the law requires stores to show them.

4.5 Authorities. We disclose data when the law requires it, for example:

• to a court;
• to CERT-In under section 70B of the IT Act;
• to an authorised agency under section 69 or 69B of the IT Act;
• under rule 3(1)(j) of the IT Rules 2021, which requires information to be given within 72 hours of a lawful order;
• to tax authorities.

We check that each request is lawful and disclose no more than it requires.

4.6 Business transfers. If the Mercayo business is sold, merged or restructured, personal data may pass to the successor. It will remain bound by this policy, and you will be told.

5. How long we keep it

We erase personal data when the purpose is served and no law requires us to keep it (DPDP Act, section 8(7)).

6. Where your data is processed

6.1 Our servers are at Mumbai, India. Some providers process data outside India, as the table in section 4.1 shows. For example:

• Brevo sends email from the EU;
• Cloudflare's network serves requests from the location nearest the visitor;
• Meta processes WhatsApp messages on its global systems.

6.2 Section 16 of the DPDP Act allows such transfers, except to countries the Central Government restricts by notification. We will stop or move any transfer to a restricted country. We choose providers that protect data at least as well as Indian law requires (as rule 7 of the SPDI Rules also requires), and we bind them by contract.

7. How we protect it

We use reasonable security practices, as section 8(5) of the DPDP Act and rule 8 of the SPDI Rules require, including:

• Encryption in transit: HTTPS/TLS for every page, the admin and every API.
• Store isolation enforced by the database: every store's data carries its store's identity, and row-level security in the database refuses any request to read or change another store's rows. Automated tests check this for every table.
• Rights checked by the database: what a staff member may see and do is checked by the database for each request, never taken on trust from a sign-in token.
• Sealed secrets: payment keys and courier passwords are encrypted with AES-256-GCM, with a key kept outside the database and each secret bound to its own store. They are never shown again on any screen.
• Hashes, not codes: one-time codes, support links and support sessions are stored only as one-way hashes.
• Limits: rate limits and attempt limits on sign-in, one-time codes, order look-ups and other sensitive actions.
• Hardened access: servers accept only key-based administrator access, sit behind a firewall, and run only what they need.
• Least privilege for Mercayo staff: access only as their role needs. Support sessions are time-limited and single-use, and every one is recorded in an internal log that cannot be edited.
• Backups: the database is backed up every night, with continuous logs for point-in-time recovery, and backups are kept for 30 days.
• Logging and monitoring: to detect and investigate incidents. System clocks are synchronised as the CERT-In Directions require.
• Incident response: see section 8.

No system is perfectly secure. If you find a vulnerability, please tell us at security@mercayo.com.

8. If there is a data breach

If a personal data breach affects your data:

• we will tell you without delay, in the form and with the details the DPDP Rules (rule 7) require: what happened, when, the likely consequences, what we are doing, what you can do, and who to contact;
• we will report it to the Data Protection Board of India, with a detailed report within 72 hours of becoming aware, or as the Rules require;
• we will report cyber security incidents to CERT-In within 6 hours of noticing them, as the CERT-In Directions require.

Where the breach involves shoppers' data, we tell the merchant, who as Data Fiduciary informs its shoppers. We help the merchant do so (see the Data Processing Addendum).

9. Your rights

Under the DPDP Act you have the right to:

• access a summary of your personal data we process and the processing activities, and the identities of others we shared it with, with a description of what was shared (section 11);
• correct, complete, update and erase your personal data, unless we must keep it to comply with the law (section 12);
• withdraw consent at any time (section 6(4));
• grievance redressal: have your complaint answered by us (section 13), and then complain to the Data Protection Board of India if you are not satisfied (section 13(3));
• nominate another person to exercise your rights if you die or become incapable (section 14).

How to ask. Write to our Grievance Officer (section 12), or to support@mercayo.com. We may need to verify your identity first. We answer within 30 days, and sooner where another law requires it.

Your duties. Under section 15 of the DPDP Act, you must not impersonate anyone, suppress material information, or file false or frivolous complaints.

10. Children

Mercayo is a service for businesses. You must be 18 or over to open an account. We do not knowingly collect personal data from children (people under 18) for our own purposes. If you believe a child has given us personal data, contact us and we will delete it.

A merchant whose store sells to or is used by children must obtain verifiable parental consent where section 9 of the DPDP Act requires it.

11. Cookies

We use a small number of cookies and similar technologies. See the Cookie Notice for what each one does.

12. Contact us and the Grievance Officer

Grievance Officer (IT Rules 2021, rule 3(2); SPDI Rules, rule 5(9)), who also answers questions about your personal data under section 8(9) of the DPDP Act:

• Name: Rahul Mehta
• Designation: Grievance Officer
• Address: Wahenam International, 8th Floor, 803, North Plaza, Visat-Gandhinagar Highway, Motera, Ahmedabad 380005, Gujarat, India
• Email: grievance@mercayo.com (privacy requests: grievance@mercayo.com)
• Phone: +91 63525 14856, Monday to Saturday, 10 am to 5 pm IST

We acknowledge complaints within 24 hours and resolve them within 15 days (IT Rules 2021). Requests to exercise your data rights are answered within the period in section 9.

If you are not satisfied:

• for data protection complaints, you may complain to the Data Protection Board of India (DPDP Act, section 13(3)), through the Board's digital office;
• for complaints about content and our grievance decisions, you may appeal to the Grievance Appellate Committee under rule 3A of the IT Rules 2021, within 30 days.

13. Changes to this policy

We will post any change here with a new date and version. If a change is material, we will tell you by email or in your admin before it takes effect, and ask for fresh consent where the law requires it.

14. Language

This policy is in English. If a translation differs, the English text prevails, except where the law gives you the right to the notice in a language listed in the Eighth Schedule to the Constitution (DPDP Act, section 5(3)).