Mecsto

Privacy Policy

Effective 7 June 2026

Mecsto ("we", "us") operates a platform that lets service businesses ("merchants") run an online storefront — listings, bookings, subscriptions, payments, customer management, and marketing tools. This Privacy Policy explains what we collect, how we use it, and your choices. It applies to mecsto.com, our merchant and admin apps, and merchant storefronts hosted on Mecsto.

1. Information we collect

Account information — name, email, and authentication details when you sign up (we use email one-time codes; we do not store passwords).
Merchant store data — store profile, listings, prices, categories, content, business hours, and settings you create.
Customer & order data — when customers buy or book, we process their contact details, order and booking information on behalf of the merchant.
Payment information — payments are processed by our payment partners (e.g. Razorpay). We do not store full card or bank details; we receive transaction status and identifiers.
Usage & device data — basic logs, IP address, and analytics needed to operate and secure the service.
Information from connected Google services — see Section 3.

2. How we use information

To provide, operate, and secure the platform and merchant storefronts.
To process orders, bookings, subscriptions, and payments.
To show merchants their own business and website analytics.
To send transactional emails (order confirmations, receipts, account notices).
To prevent fraud, abuse, and to comply with law.

3. Google user data (Analytics & Calendar)

Merchants may optionally connect their own Google account so Mecsto can power specific features. When you connect, we request only the scopes needed for the feature you enable:

Google Analytics (analytics.readonly) — used solely to read your Google Analytics 4 metrics (visitors, sessions, traffic sources, conversions) and display them to you inside your Mecsto "Grow → Website" dashboard. We do not modify your Analytics data and we do not use it for advertising.
Google Calendar — used solely to create and manage booking/appointment events for your store on the calendar you authorise, so bookings made on your storefront appear on your calendar.

Limited Use disclosure. Mecsto's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide or improve the user-facing feature you connected it for; we do not sell it, do not use it for advertising, and do not allow humans to read it except where you explicitly request support, for security, or to comply with law.

You can disconnect Google at any time from the integration settings, which revokes Mecsto's access. We cache fetched Analytics metrics only briefly to display them, and we delete connection tokens when you disconnect.

4. How we share information

We do not sell your personal information. We share it only with service providers that help us run the platform, under contract, including: payment processing (Razorpay), email delivery (Resend / Amazon SES), hosting and storage (Cloudflare, Supabase). Merchants control their own customer and store data; Mecsto acts as a processor for that data on the merchant's behalf. We may disclose information if required by law.

5. Data retention

We keep account and store data while your account is active and as needed to provide the service or comply with legal obligations. You can request deletion (Section 7). Google connection tokens are deleted on disconnect.

6. Security

We use industry-standard measures — encryption in transit, scoped access, and tenant isolation — to protect data. No method is perfectly secure, but we work to protect your information.

7. Your rights & choices

You may access, correct, or request deletion of your personal information, and disconnect any connected Google account, by contacting us at privacy@mecsto.com or using in-app settings. Customers of a merchant should contact that merchant; we will assist the merchant as their processor.

8. Children

The platform is not directed to children under 13 (or the minimum age in your jurisdiction), and we do not knowingly collect their data.

9. International users

Mecsto operates from India. By using the service you understand your information may be processed in India and other countries where our providers operate.

10. Changes

We may update this policy; we will revise the effective date above and, for material changes, provide notice. Continued use after changes means you accept the updated policy.

11. Contact

Questions or requests: privacy@mecsto.com.