1. Scope and roles
This policy applies to the Mercestack websites, applications and related services. For account, website and commercial relationship data, Mercestack generally acts as a controller. When a customer places information about its staff, customers or operations inside a workspace, that customer determines the purposes of processing and Mercestack generally acts as its processor or service provider.
2. Data we collect
- Account and identity information such as name, email address, profile image and authentication data.
- Workspace information such as company name, role, department, permissions, locale and timezone.
- Customer content entered or uploaded to the service, including operational records, messages and files.
- Payment and subscription information. Payment providers process full payment credentials; Mercestack may retain references, status, card brand and last four digits.
- Technical and security information such as IP address, device or browser details, request logs and audit events.
- Support and communication records when you contact us.
3. Why we use data
We use personal data to provide and secure the service, authenticate users, enforce workspace permissions, process subscriptions, deliver requested communications, maintain audit history, respond to support, prevent abuse and meet legal obligations. Where applicable, processing may rely on performance of a contract, legitimate interests, consent or compliance with law.
4. AI and automation
Workspace administrators may connect AI providers and configure agents, tools and automated flows. Content is sent to a provider only when a user or configured workflow invokes that capability. Provider handling is also governed by the customer’s selected provider and agreement. Mercestack does not represent AI output as a substitute for professional judgment.
5. Sharing and subprocessors
We may share limited data with infrastructure, storage, communication, payment and AI providers needed to deliver features selected by the customer. We may also disclose data when required by law, to protect the service or as part of a corporate transaction. We do not sell personal data.
6. Retention
We retain account and workspace data while an account is active and for a reasonable period afterward for security, recovery, billing, dispute resolution and legal obligations. Customer-configured retention and deletion controls may apply to files and records. Backups and append-only security or audit records may remain for a limited additional period.
7. International transfers
Service providers may process data in countries other than yours. Where required, transfers are supported by an applicable legal mechanism and appropriate contractual or technical safeguards.
8. Your choices and rights
Depending on where you live, you may have rights to request access, correction, deletion, restriction, portability or objection, and to withdraw consent. Workspace-managed data requests should first be directed to the organisation that controls that workspace. You may contact [email protected] for assistance.
9. Security
We use safeguards designed for the nature of the service, including tenant scoping, permission checks, encrypted stored credentials, signed provider webhooks and audit logging. No online service can guarantee absolute security.
10. Children
Mercestack is a business service and is not directed to children. Do not create an account or submit personal data if you are not legally able to agree to the service terms.
11. Changes
We may update this policy as the service or legal requirements change. We will update the date above and provide additional notice when a change materially affects how personal data is handled.