Privacy notice
Last updated: 1 November 2026
This notice explains what personal data Mercenta collects when you use mercenta.ai, why, who helps us process it, how long we keep it, and the rights you have.
Who we are
Mercenta is run by Akan Studio EOOD, a Bulgarian limited company (EIK 208222567), registered at Angel Voyvoda 25, 4230 Asenovgrad, Bulgaria. Akan Studio EOOD is the controller of your personal data.
For anything about your data, email hello@mercenta.ai. We have not appointed a Data Protection Officer, as we are not required to; this address is our privacy contact. Company details are on our legal notice.
What we collect, why, and how long we keep it
After each period below we delete the data or make it anonymous.
| What | Why | Legal basis | How long |
|---|---|---|---|
| The product page and store you submit: its web address, and what we read from it (product name, brand, price, images, description), plus the market and category you choose | To run the free report you asked for | Performing the service you requested (Art. 6(1)(b) GDPR) | 24 months from the report |
| Your answers to the optional questions during the scan (where you think you rank, the rival you worry about, why buyers choose you, what you want help with, revenue band, role) | To show your view next to what AI found, and to prepare any follow-up you ask for | Our legitimate interest in making the report useful (Art. 6(1)(f)) | 24 months from the report |
| Your first name and work email when you unlock the full report | To open the full report, and to email you one link back to it (valid for 30 days) | Performing the service you requested (Art. 6(1)(b)) | 24 months from your last report, or until you ask us to delete it |
| Updates list: your email, where you joined (footer or report), the sentence you agreed to, and when you joined, confirmed and unsubscribed | To send the monthly note and launch news, only after you confirm by email | Your consent (Art. 6(1)(a)); you can withdraw it at any time | Until you unsubscribe. Unconfirmed sign-ups deleted after 30 days. After you unsubscribe we keep only your address and the date, so we never email you by mistake. |
| Requests from your report: a call about your results, a monthly re-check, feedback | To do what you asked, and to improve the report | Performing the service you requested (Art. 6(1)(b)); for feedback, our legitimate interest (Art. 6(1)(f)) | 24 months |
| Messages from the contact form: name, email, store address if given, message | To reply to you | Our legitimate interest in answering enquiries (Art. 6(1)(f)) | 24 months from your last message |
| Booking a call: your answers on the booking page (business stage, revenue band, how AI treats your products now), your store address, email and name, and the campaign tags of the link you arrived from | To check a call is the right next step, and to prepare for it | Steps you asked for before a possible contract (Art. 6(1)(b)) | 24 months from your last booking, or until you ask us to delete it |
| A keyed, one-way code made from your network address (we never store the address itself), and counters of recent requests | To limit abuse and keep the free report affordable | Our legitimate interest in security and fraud prevention (Art. 6(1)(f)) | A few days at most; deleted automatically |
| Email delivery records: that an email was sent, accepted or failed | To make sure emails arrive, and to show you when one did not | Performing the service (Art. 6(1)(b)) or your consent, matching the email type | 90 days |
We don’t need your name or email to run a report. The work email is only needed to unlock the full version. We don’t verify it, so we treat every request tied to it as unconfirmed until you confirm by email.
AI providers
To produce a report we ask AI assistants (from OpenAI, Google Gemini and Perplexity) shopping questions about your product and category, and we use AI to read product pages and images and to write the summary. We send them product details, the market and category, and the rival names that come up. We do not send your name, email address or your answers about revenue and role.
AI answers change often. A report shows what AI services answered at one point in time, plus our reading of why. It is not a decision about you, and we make no automated decisions with legal or similar effects on you.
Who helps us process data
These providers process data for us under their standard data processing terms, which limit them to our instructions:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database and backend functions; holds everything listed above | EU (Ireland) |
| Vercel | Hosting the website; sees your requests, including your network address. It also measures how fast our pages load (Vercel Speed Insights) | Server functions in the EU (Ireland); pages served from its global network |
| PostHog | Counting page visits and steps such as starting a scan or booking a call, and which country visits come from (worked out from your IP address, which isn’t stored), without cookies and without storing anything on your device. It never receives your email, store link or answers | EU (Germany) |
| Resend | Sending our emails (report links, sign-up confirmations, updates) | EU sending region (Ireland); US company |
| Google Workspace | Our email inbox, where your replies and messages to hello@mercenta.ai arrive, and Google Meet for calls you book with us | EU and US |
| Cal.com | Booking calls: the time you pick, your name, email and the answers you gave on the booking page | US |
| OpenAI | Answering shopping questions, reading pages and images, writing the report summary | US |
| Google (Gemini) | Answering shopping questions | US and other Google locations |
| Perplexity | Answering shopping questions | US |
| Slack | Internal alerts to our team when someone asks for a call, joins the updates list or sends a message (includes the email address and request) | US |
Where a provider handles data outside the EU, we rely on the European Commission’s Standard Contractual Clauses or the EU-US Data Privacy Framework.
We don’t sell your data, and we don’t use it for advertising.
Cookies
We only use cookies that keep your report working on your device. They are strictly necessary, so we don’t ask for consent. We use no analytics or advertising cookies.
| Cookie | What it does | Lasts |
|---|---|---|
| mercenta_snapshot_access | The private key that opens your report on this device | 7 days |
| mercenta_snapshot_run | Which report this device is looking at | 7 days |
| mercenta_snapshot_claim | A signed marker that this browser confirmed the product it is checking | 7 days |
| mercenta_snapshot_requester | A random browser code used to limit how many reports one browser starts | 7 days |
| mercenta_snapshot_execute_lock | Stops the same check being started twice | 7 days |
| mercenta_snapshot_first_name | Your first name, to greet you on the unlocked report | 7 days |
Emails from us
- Your report link. When you unlock a report we email you one link to it. It works for 30 days, and anyone with the link can open the report, so please don’t forward it.
- Confirming a sign-up. If you (or anyone) joins our updates with your address, we send one confirmation email. Nothing else is sent until you click it.
- Updates. Every update email has an unsubscribe link and supports one-click unsubscribe in your email app. You can also use “Stop these updates” on your report, or email us.
Your rights
Under the GDPR you can ask us to:
- give you a copy of your data;
- correct it;
- delete it;
- restrict or object to how we use it, including use based on our legitimate interests;
- send it to you or another company in a common format;
- stop using it where we rely on your consent (this does not affect what we did before).
Email hello@mercenta.ai. We reply within one month. We may ask you to confirm the request from the email address involved.
You can complain to the Bulgarian Commission for Personal Data Protection (2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg), or to the data protection authority where you live or work.
Security
Data is encrypted in transit. Report keys and emailed links are stored only as one-way codes, our database cannot be read from the browser, and our providers are bound by contract to keep data safe.
Children
Mercenta is a business service and is not meant for anyone under 18.
Changes
If we change this notice we will update this page and the date at the top. For significant changes we will tell people on our updates list.