Privacy Policy

This policy explains what personal data Mercastra collects, why, and what rights you have over it. Mercastra is used by workshop owners and their team members - there are no customer accounts, and customers never log in or interact with Mercastra directly. If you're a workshop's customer, see "End customers" below for the limited data a workshop may enter about you.

Who we are

Mercastra is operated by Mercastra (no registered company yet - see "Who is responsible" below for what that means for you). You can reach us at mail@mercastra.com for anything in this policy, including exercising the rights described below.

What we collect

Account data: your name, email address, and a securely hashed password (we never store your password itself).

Workshop and order data: the workshop profile you set up, and the orders and estimates you create - including any customer name or order details you choose to enter into them.

Technical data: basic request logs (e.g. timestamps, error details) used to keep the service running and secure.

Usage data on mercastra.com: if you agree to it, Google Analytics collects which pages of this website you visit and how you got here. See "Cookies and analytics" below for what that involves. The application itself, at mercastra.cloud, uses no analytics and no tracking.

Why we process it, and on what basis

Account, workshop, and order data is processed because it's necessary to provide the service you asked for - creating your account and running your workshop's orders and estimates (performance of a contract). Technical logs are kept on the basis of our legitimate interest in keeping Mercastra secure and working correctly. Usage data on mercastra.com is processed only with your consent, which you can withdraw at any time.

Who we share it with

We use three processors to run Mercastra, all acting under our instructions and none using your data for their own purposes:

• Google Cloud - hosts the application and its database.
• Resend - sends transactional emails (e.g. email verification, password reset).
• Google Analytics (Google Ireland Limited) - measures how mercastra.com is used, only if you agreed to it. See "Cookies and analytics" below.

We don't sell personal data, and we don't share it with anyone else outside of what's needed to run the service or comply with the law.

Signing in with Google

If you sign in with Google, we receive your Google account identifier, email address, and name from Google, and store them to create and recognize your account. For this data, Google isn't our processor - it processes your Google account as an independent controller under its own privacy policy. We get no other access to your Google account and don't use Google for anything else.

Where it's stored

Your account, workshop and order data is stored and processed in the European Union (an EU data centre region) and is not transferred outside the EU/EEA. The one exception is the usage data described in "Cookies and analytics": Google may process it on servers in the United States, under the EU-US Data Privacy Framework and the standard contractual clauses in Google's data processing terms.

How long we keep it

We keep your account, workshop, order, and estimate data for as long as your account is active. If you delete your account, we permanently delete your workshop and everything under it - orders, estimates, and any customer names or details entered into them - rather than keeping a residual record.

End customers

Mercastra has no accounts, login, or any surface for a workshop's customers - they don't interact with Mercastra directly. The only data we hold about a customer is whatever a workshop chooses to type into an order or estimate (typically just a name), entered and controlled by the workshop, not collected from the customer by us. That data is deleted along with the workshop's account, as described above.

Cookies and analytics

This website, mercastra.com, uses Google Analytics to understand which pages people visit, how they found the site and roughly where they are. It only runs after you choose "Allow analytics" in the notice shown on your first visit. Until then, and if you choose "No thanks", nothing is loaded from Google and no analytics cookies are set. The application at mercastra.cloud never uses it.

When enabled, Google Analytics sets cookies named _ga and _ga_ followed by an identifier, which last up to two years and tell repeat visits apart with a random identifier - not your name or email. It records the pages you view, the site that referred you, your browser and device type and your approximate location derived from your IP address; Google Analytics 4 does not store the IP address itself. We keep this data in Google Analytics for 14 months. We have turned off Google's advertising features, so none of it is used for ads or shared with other Google services.

You can change your mind at any time through the "Cookie settings" link in the page footer, which asks the question again, or by deleting the cookies in your browser. Your choice itself is remembered in your browser's local storage, which is needed so we don't ask you on every page. Google explains its own handling of this data at policies.google.com/technologies/partner-sites.

Your rights

Under GDPR, you have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to complain to a data protection authority - in Poland, the Urząd Ochrony Danych Osobowych (UODO). To exercise any of these, email us at mail@mercastra.com.

Who is responsible

Mercastra doesn't yet operate through a registered company. Under Polish law, this means Mercastra operates it as an individual (nierejestrowana działalność - unregistered activity, available below a revenue threshold). This doesn't change your rights under this policy - Mercastra is the data controller and is directly responsible for how your data is handled, the same as a registered company would be.

Changes to this policy

If we materially change what we collect or why, we'll update this page and, where the change affects you meaningfully, let you know directly rather than relying on you checking back.