Last updated: August 2026

At Mercidia, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our marketing analytics platform.

Controller

NaNZeta LLC operates Mercidia and is the controller for the personal information described in this policy.

Privacy contact

Contact privacy@nanzeta.com for privacy requests, questions, or complaints. A separate DPO or local representative should be added here if one is required for a jurisdiction in which Mercidia operates.

Cookies and privacy choices

Mercidia uses necessary cookies for authentication, security, session refresh, workspace selection, and remembering your privacy choice. Optional performance measurement is disabled until you make an affirmative choice. Mercidia does not currently install advertising or retargeting cookies.

See our Cookie Policy for the cookie inventory, purposes, retention information, and third-party disclosures. You can change your choice at any time:

Information We Collect

Personal Information

•Email address, authentication metadata, and any profile or company details you choose to provide
•Account and workspace identifiers, roles, preferences, and support communications
•Information needed to authenticate your account and maintain workspace access

Business Data

•Revenue targets, costs, margins, and other financial metrics you configure
•Customer metrics (AOV, CAC, LTV) and business goals
•Approved Pilot rules, budget limits, decision notes, and other workspace configuration you provide

Marketing Platform Data

•Campaign and performance data from supported connections, currently including Meta Ads; Google Ads remains evaluation-only and is not part of the launch-ready source claim
•E-commerce data from Shopify (orders, products, revenue)
•Website analytics and event or conversion reporting from Google Analytics 4 when its service-account connection is configured
•API credentials and access tokens for connected platforms (encrypted)

Usage Information

•Log data, IP address, browser type, and device information
•Usage and diagnostic information such as pages or features used when collected, request logs, and error reports
•Error reports and diagnostic information

How We Use Your Information

→Provide Services: Reconcile source data, display analytics, maintain decision records, and provide approved workflows. Where a supported provider action is explicitly enabled, process that approved action.
→Improve Platform: Analyze usage patterns to enhance features and user experience
→Communication: Send service updates, notifications, and support responses
→Security: Detect fraud, prevent abuse, and protect account security
→Legal Compliance: Meet regulatory requirements and respond to legal requests

Third-Party Services

We integrate with third-party services to provide our platform's functionality:

Google Ads API (evaluation only)

The Google Ads connector path may be used for evaluation accounts, but it is deferred from the launch-ready source claim until hosted OAuth, sync, refresh, and disconnect validation is complete. If enabled for your account, we access only the data authorized through Google's API. Subject toGoogle's Privacy Policy.

Meta Ads (Facebook/Instagram)

With your authorization, we retrieve account, campaign, ad, and performance information through Meta's Marketing API for reporting and reconciliation. The current integration requests the read-only ads_read permission and does not modify campaigns or ads. Subject to Meta's Privacy Policy.

Shopify

We sync order data, product information, and revenue metrics from your Shopify store. Subject to Shopify's Privacy Policy.

Google Analytics 4

We access reporting metrics and event or conversion data through the GA4 Data API using the configured service account and property access. Subject to Google's Privacy Policy.

Vercel Speed Insights

When you allow optional performance measurement, Vercel Speed Insights receives limited technical performance information about page delivery. It is not loaded before consent and is disabled when optional measurement is rejected. Subject to Vercel's Privacy Policy.

Infrastructure and billing providers

Supabase provides authentication and hosted database services, Vercel provides frontend hosting and delivery, Render provides backend hosting, and Stripe processes billing and payment information when you subscribe. These providers may process information needed to deliver their services under their own privacy policies and contractual obligations: Supabase, Vercel, Render, and Stripe.

Signup, communications, and product measurement

When you create an account, we process the email address and profile information you provide to create and secure the account, provide workspace access, and communicate about the service. Acceptance of the Terms and acknowledgement of this Privacy Policy are recorded as part of signup.

We may send service messages such as authentication notices, security alerts, billing messages, and operational updates because they are needed to operate the service. Optional marketing communications require an appropriate consent or lawful basis and include a simple unsubscribe method.

Optional website performance measurement is controlled separately through the privacy controls. You can reject it or withdraw that choice at any time without losing access to necessary Mercidia features.

Meta Data and Permissions

When you connect a Meta business or advertising account, Mercidia receives the Meta account and ad account identifiers, campaign structure, delivery information, and reporting metrics made available through the authorization. This can include spend, impressions, clicks, conversions, dates, and related campaign metadata. We use this information to provide analytics, reports, reconciliation, and recommendations inside Mercidia.

The current Meta integration uses the read-only ads_readpermission. Mercidia does not use this permission to create, edit, or delete Meta campaigns, ads, or budgets. We do not sell Meta data or use it to build advertising audiences outside the service you request.

Meta access tokens are stored using the platform's encrypted connector credential storage and are used only to make authorized requests for the connected workspace. You can disconnect the integration in Mercidia and revoke Mercidia's authorization through your Meta account settings. Revocation stops future access but does not automatically erase data already imported into Mercidia.

To request deletion of Mercidia-side data associated with a Meta connection, follow our Data Deletion Instructions. To request deletion of data held by Meta, use Meta's own privacy and account controls.

Data Security

We implement industry-standard security measures to protect your information:

✓Connector API credentials and tokens are encrypted at rest (AES-256-GCM)
✓Secure HTTPS connections for all data transfers
✓Server-side connector access controls and role-based account permissions
✓Access controls and authentication protocols
✓Operational logging and source-health monitoring for connector failures and stale data

However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

Your Rights

Depending on your location, you may have the following rights:

→Access: Request a copy of the personal data we hold about you
→Correction: Update or correct inaccurate information
→Deletion: Request deletion of your personal data (subject to legal obligations)
→Portability: Receive your data in a machine-readable format
→Objection: Object to processing of your personal data
→Withdraw Consent: Opt out of marketing communications

To exercise these rights, contact us at privacy@nanzeta.com

Data Retention

We retain your personal information for as long as necessary to provide our services and comply with legal obligations. When you delete your account or request removal of connected-platform data, we remove eligible Mercidia-side personal data within 30 days, except where we must retain it for legal, security, fraud-prevention, dispute-resolution, or transaction-record reasons.

Product-plan retention limits apply to historical workspace records such as metrics, decisions, reports, and automation history. Aggregated and anonymized data may be retained for analytics and product improvement purposes.

International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your data in compliance with applicable laws.

Changes to This Policy

We may update this Privacy Policy periodically. We'll notify you of significant changes via email or in-app notification. Continued use of our services after changes constitutes acceptance of the updated policy.

Contact Us

If you have questions or concerns about this Privacy Policy, please contact us:

📧Email: privacy@nanzeta.com