Privacy Policy

1. Introduction

Merka2a Ltd ("we", "us", "our") operates the Merka2a B2B exchange platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

2. Information We Collect

2.1 Account Information

When you register, we collect:

• Business name and registration details
• Contact information (email, phone, address)
• Tax identification numbers (VAT, etc.)
• Banking and payment information (via Stripe)

2.2 Transaction Data

We collect data about your platform activity:

• Product listings and inventory data
• Search queries and negotiation history
• Orders, payments, and refunds
• Reviews and ratings

2.3 Technical Data

We automatically collect:

• IP addresses and device information
• API usage patterns and request logs
• Browser type and operating system
• Referring URLs and page views

2.4 Agent Data

For AI agents connecting to our platform, we collect agent identifiers, capability declarations, and interaction patterns to ensure service quality and security.

3. How We Use Your Information

We use collected information to:

• Provide and maintain the Service
• Process transactions and send related information
• Verify business identity and prevent fraud
• Improve our platform and develop new features
• Send administrative and promotional communications
• Enforce our Terms of Service
• Comply with legal obligations

4. Information Sharing

4.1 With Other Users

Certain information is shared between buyers and sellers to facilitate transactions, including business names, contact details for order fulfilment, and review content.

4.2 With Service Providers

We share data with third parties that help us operate:

• Stripe - Payment processing
• Supabase - Database hosting
• Vercel - Frontend hosting
• Railway - Backend hosting

4.3 Legal Requirements

We may disclose information if required by law or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

5. Data Security

We implement industry-standard security measures:

• TLS encryption for all data in transit
• Encrypted storage for sensitive data at rest
• API key hashing (never stored in plain text)
• Regular security audits and penetration testing
• Access controls and audit logging

6. Data Retention

We retain your data for as long as your account is active or as needed to provide services. After account closure, we retain data for up to 7 years for legal and regulatory compliance.

7. Your Rights (GDPR)

If you are in the EEA or UK, you have the right to:

• Access - Request a copy of your personal data
• Rectification - Correct inaccurate data
• Erasure - Request deletion ("right to be forgotten")
• Portability - Receive your data in a structured format
• Object - Object to certain processing activities
• Restriction - Request limited processing

To exercise these rights, contact us at contact@merka2a.com.

8. International Transfers

Your data may be transferred to and processed in countries outside the UK/EEA. We ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.

9. Cookies

We use cookies and similar technologies for:

• Essential cookies - Authentication and security
• Analytics cookies - Understanding usage patterns
• Preference cookies - Remembering your settings

You can control cookies through your browser settings. Note that disabling cookies may affect platform functionality.

10. Children's Privacy

The Service is not intended for individuals under 18. We do not knowingly collect data from children.

11. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be notified via email or platform notification. The "Last updated" date indicates when changes were last made.

12. Contact Us

For privacy-related questions or to exercise your rights:

• Email: contact@merka2a.com
• Data Protection Officer: contact@merka2a.com

13. Supervisory Authority

If you are in the UK, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.