Privacy notice
Last updated 12 October 2026 · Data Fiduciary: Merciglobal Systems Pvt Ltd, Surat, Gujarat, India
1. Who we are
MerciSync (https://ecommerce.merciglobal.com) is operated by Merciglobal Systems Pvt Ltd ("Merciglobal", "we"). This notice explains what personal data we process, why, and your rights under the Digital Personal Data Protection Act, 2023 (DPDP Act) and the rules made under it.
2. Data we process and why (purpose limitation)
- Account data — names, e-mail addresses and phone numbers of seller users, company name, GSTIN, PAN and billing address: to run your account, sign you in, send service e-mails, and issue GST invoices.
- Marketplace order data — for your buyers we store, by default, only name, city, state and pincode with the order. A full shipping address is kept only if you turn it on and the marketplace permits it. Purpose: to show and fulfil your orders and keep stock correct.
- Marketplace credentials — OAuth tokens and keys you authorise. They are encrypted at rest, never shown back and never logged.
- Usage and security logs — IP address, user agent and actions (audit log), API request counts: to secure the service, prevent abuse and bill fairly.
- Payment data — handled by our payment gateway (Cashfree Payments). We receive the payment status and reference, never your card or bank details.
We use personal data only for these purposes. We do not sell it and do not use buyer data for marketing.
3. Legal basis and consent
We process seller-user data on the basis of your consent given at sign-up and for the legitimate uses permitted by the DPDP Act (performing the contract, complying with law such as GST record-keeping). For buyer data that marketplaces share with you, you are the Data Fiduciary and Merciglobal acts as your Data Processor, following your instructions under our Terms.
4. Retention and deletion
- Sync logs: 7–90 days depending on plan. Webhook delivery logs: 30 days.
- When your subscription is cancelled, data stays exportable for 60 days and is then deleted within a further 30 days (90 days in total), except invoices and records we must keep by law (8 years for GST).
- You can ask us to delete your account earlier — write to support@merciglobal.com.
5. Where data is stored, and who we share it with
Data is stored on Merciglobal servers in India. We share it only with: the marketplaces you connect (to sync your listings, stock and orders), our payment gateway, and our e-mail provider — each only as needed for the purpose above.
6. Security
HTTPS with HSTS everywhere, hashed passwords (Argon2id) and API keys (SHA-256), encrypted credentials (libsodium), optional two-factor sign-in, tenant isolation tested on every API route, daily encrypted backups kept 30 days, and redaction of tokens, phone numbers, e-mails and addresses from logs.
7. Personal data breach
If a breach affects personal data, we will inform the Data Protection Board of India and affected users without delay, as the DPDP Act requires, describing what happened, the likely impact and what we are doing about it.
8. Your rights
You may ask to access, correct, update or erase your personal data, withdraw consent, and nominate another person to exercise your rights. Contact our Grievance Officer at support@merciglobal.com; we answer within 30 days. If unsatisfied, you may complain to the Data Protection Board of India.
9. Changes
We will post changes here and e-mail account owners about material changes.