Privacy policy
Last updated:
Mercatian processes very little personal data, and this page says exactly what. The site sets no cookies, does not profile you, and sells nothing to anyone.
Data controller
Mercatian, an independent project operated from Spain. Tax identification details are pending publication; see the corresponding section on the About page.
hola@mercatian.esWhat we process, and why
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Your email address and the language you subscribed in | Sending you the radar newsletter you asked for | Your consent | Until you unsubscribe; then it is deleted |
| Your IP address, as a counter key | Curbing abuse of the forms | Legitimate interest | In memory only, for minutes. Never written to disk or to a database |
| The domain you send through “Add your shop” | Adding that shop to the radar | Legitimate interest | While the shop is on the radar. A company domain is not personal data |
| Aggregated visit metrics | Knowing which pages get used | Legitimate interest | Aggregated by the provider, with no identifier that follows you |
What we do not do
- We set no cookies, first-party or third-party. That is why there is no cookie banner: there is nothing to consent to.
- We do not profile you, do not enrich your email from other sources, and make no automated decisions about people.
- We do not sell, share or rent personal data.
- We never ask for or store passwords or payment details.
The profiles we archive
For each shop we keep the JSON of its UCP profile. We checked: those profiles contain technical declarations and public signing keys, and no contact or personal data. Should one ever include some, telling us is enough to have it removed.
Shops that are people
A shop's data is public company information. Even so, a sole trader's domain can identify them indirectly. If that is your case, ask for removal and we will do it, snapshots included.
Who else is involved
The site relies on these providers to run. Each processes data only on our instructions and only for what is stated.
| Provider | Purpose | Where |
|---|---|---|
| OVHcloud | API server and database, where the subscriber list lives | European Union |
| Vercel Inc. | Website hosting and aggregated visit metrics | United States, with EU data centres |
| Brevo | Newsletter email delivery | European Union |
Transfers outside the EU
Website hosting is provided by a US company. That transfer relies on the standard contractual clauses in its data processing agreement. The database holding subscription emails does not leave the European Union.
Your rights
Over your data you can exercise the following rights, at any time and free of charge:
- Access: know what we hold about you.
- Rectification: correct it if it is wrong.
- Erasure: have it deleted.
- Objection: have us stop processing it.
- Restriction: have us keep it but not use it.
- Portability: receive it in a reusable format.
- Withdraw your consent whenever you like, without affecting what came before.
Write to the contact address. No form is needed and no reason has to be given. We answer within one month at the latest.
hola@mercatian.esFor the newsletter you need not even write: every email carries a one-click unsubscribe link that deletes your address.
If you believe we handle your data improperly you can complain to the Spanish Data Protection Agency. We would appreciate hearing from you first, but it is not a requirement.
Agencia Española de Protección de Datos ↗If anything material changes, the date above changes. If the change affects processing based on your consent, we will ask again rather than assume it.