Merc Site Search Privacy Policy
Effective 19 October 2026. Published at https://mercai.in/site-search/privacy.
This policy explains what data Merc Site Search (the "Service") processes, why, and for how long. The Service is operated by MercAI ("we", "us"), whose legal operator is named in section 12. It applies to site owners who install the Service ("merchants") and to visitors who use the search box on a merchant's site.
1. Data we process.
- App instance ID and site URL, received when the app is installed, used to identify the site and keep its data separate from every other site. After uninstall, the app instance ID alone is kept for 30 days to absorb late notifications from the platform, then deleted.
- Public content of the merchant's site: page text and titles, and product, blog post, event, service and collection data (names, descriptions, images, prices, stock status, URLs). This is content the merchant has already published.
- Visitor search queries: the text searched, the time, the number of results and the site. Queries are stored without any visitor identifier: no name, account, cookie ID or IP address.
- Visitor IP address: used in memory only to apply rate limits. It is not written to our database or logs.
- Support email: the messages you send us and your email address.
We do not collect payment details. Billing is handled by the website platform. Error reporting and product analytics tools are not currently in use. If one is added, this policy will be updated and the tool listed here before it is enabled.
2. Purposes. We use this data to build and update the search index for the merchant's site, return search results, show the merchant indexing status and search analytics, protect the Service against abuse, fix errors, and answer support requests. We do not sell data, use it for advertising, or combine data across merchants.
3. Roles. For site content and visitor search queries, the merchant is the controller and we are the processor. For support email, we are the controller.
4. Sub-processors.
| provider | purpose | region |
|---|---|---|
| Google LLC (Google Cloud, Compute Engine) | hosting of the API, database and search index | EU: europe-west3, Frankfurt, Germany |
| Vercel Inc. | hosting of the mercai.in website, including these policy pages; it does not receive search queries or site content from the Service | global edge network |
Error reporting and product analytics tools are not currently in use. If one is added, this policy will be updated and the tool listed here before it is enabled.
5. Retention.
- Visitor search queries: 90 days on Pro and Business, 7 days on Free, then deleted automatically.
- Index and page records: kept while the app is installed, and updated as the site changes. Items the merchant removes or excludes are deleted from the index.
- On uninstall: all indexed content, page records, search queries, settings and the widget key are deleted within 24 hours. The app instance ID alone is kept for 30 days to absorb late notifications, then deleted.
- Support email: kept as long as needed to resolve the request.
6. Your rights. Under the GDPR and similar laws, you can ask for access to, correction of, or deletion of personal data we hold about you, or object to its processing. Visitors should contact the site owner first, since the merchant controls their site's search data; we will help the merchant answer. Send requests to privacy@mercai.in. We answer within 30 days. You may also complain to your local data protection authority.
7. Security. All traffic to the Service uses TLS. Server disks are encrypted at rest by Google Cloud by default. Each site's data is isolated by its instance ID, and search requests from one site cannot read another site's index. Access to servers is limited to the developer.
8. Cookies. The search box and results widget set no cookies and do not use browser storage to track visitors.
9. Children. The Service is a tool for site owners and is not directed at children under 13. We do not knowingly collect personal data from children.
10. International transfers. Service data is hosted in the EU, in Frankfurt, Germany. Where a sub-processor processes data outside the EU, we rely on the safeguards that provider offers, such as standard contractual clauses.
11. Changes. We will post changes on this page and announce material changes in the dashboard before they take effect.
12. Contact. Kamaldeep Singh, trading as MercAI, 1138, Bellandur, Bengaluru 560103, Karnataka, India. Privacy: privacy@mercai.in. Support: devkamal01@outlook.com.