Privacy Policy

1. What We Collect

1.1 Registration information: your email address. If you sign in with Google OAuth, this also includes your Google account's display name and avatar URL.

1.2 Audit information: the timestamp and method (email / Google) of each sign-in, your IP address and location (looked up from the IP, country level only), and your User-Agent, used to detect abnormal activity.

1.3 Usage activity: the pages you view in Mercu, the instruments you follow, the alerts you trigger and the like, used for personalized recommendations and product improvement.

1.4 What we do not collect: phone numbers, national ID numbers, bank accounts, wallet private keys, or any information that could be used to operate your assets directly.

2. How We Use It

• Account registration, sign-in verification, and password/verification-code resets
• Sending you emails about product updates and exchange rebates/campaigns (essential communications only, no marketing)
• Monitoring conduct that violates the Terms of Service
• Complying with applicable laws and regulations and lawful requests from competent authorities

3. How We Store It

Your account data is stored in a database service hosted by a third party. Sensitive fields such as passwords are never stored in plain text; they are processed by our identity-authentication service with an industry-standard one-way cryptographic algorithm, and we ourselves never have access to your plain-text password. All data in transit is encrypted with TLS.

4. How We Share It with Third Parties

We do not sell your personal information. We may share it in the following cases:

• Infrastructure providers (cloud database, application hosting, content delivery network): only as necessary to provide the Services, and limited to the minimum scope required to do so
• Identity-authentication provider: handles registration, sign-in and password credentials
• Email delivery provider: sends verification-code and password-reset emails
• Legal requirements: in response to lawful judicial documents or regulatory requests

All of the above are service providers engaged by us that process data on our instructions; they do not use your information for their own purposes. If you would like the full list of these processors, you can request it through the contact channel in Section 10.

5. Cookies and Local Storage

We use your browser's local storage to keep your sign-in session, so you don't have to sign in again after refreshing the page. We use no third-party advertising tracking cookies. You can clear them at any time in your browser settings.

6. Your Rights

You have the following rights over your personal information:

• Access: view your account information at any time under “Account”
• Correction: change your username and password
• Deletion: request deletion of your account and associated data (let us know in the official Mercu Telegram group)
• Export: request a copy of your personal information
• Objection: object to certain processing of your personal information

We will respond to your lawful requests within 15 business days. If you are located in a GDPR jurisdiction, you may lodge a complaint with your local data protection authority.

7. Data Retention

Your account data is stored for as long as your account is retained. After your account is deleted, we physically delete its data from our production systems within 30 days, and backups are kept for at most 90 days before being permanently purged.

8. Minors

Mercu is not intended for users under 18. If you find that a minor has used our Services, please contact us to have the relevant information deleted.

9. Changes to This Policy

This policy may change as the product evolves. Material changes take effect after notice on the sign-in page or by email, and you will have 30 days to read them and decide whether to continue using the Services.

10. Contact Us

If you have any questions about this policy, please let us know in the official Mercu Telegram group, or see the Terms of Service.