Privacy policy

1. Who we are

Mecan is operated by Sidemarket LLC, a Delaware limited liability company (“we”, “us”). This policy covers mecan.io, our business tools, and customer booking pages. Berk Karaoğlu is responsible for our privacy practices and can be contacted at contact@mecan.io.

We control information used to manage our accounts, billing, security, and website. When a business uses Mecan to manage its customers, bookings, or messages, we process that information on its instructions. That business is responsible for its own privacy notice and lawful use of customer data. Contact it first about those records; we can help route your request.

2. Information we collect

From you: account name and email; business details, services, hours, location, and phone number; booking names, phone numbers, booking details, and notes; assistant instructions and chats; and support messages.
From connected services: authorized account identifiers and access credentials, Instagram profiles and conversations (including message and attachment metadata), and public Google business information and images, including aggregate ratings and review counts.
From payments: Stripe customer and subscription identifiers, payment status, and billing records. Stripe collects payment details directly; Mecan does not receive your full card number.
Automatically: IP address, browser and device information, request and security logs, session identifiers, pages visited, referral sources, and feature-use events. DataFast visitor identifiers can be associated with checkout to measure which visits lead to subscriptions.

Please do not submit sensitive information, such as health records, government identification, or financial account details, in booking notes, chats, or support requests.

3. Why we use it

We use information to sign you in, operate booking pages, verify phone numbers, send service notifications, manage subscriptions, answer support requests, and protect against misuse. Connected information lets us deliver Instagram replies. Usage data helps us find confusing steps and understand which features and acquisition channels lead to subscriptions.

Where European or UK data protection law applies, we rely on performing our contract with you for account and service delivery; legitimate interests in administering business relationships when you represent a business customer; legal obligations for required financial records; and legitimate interests for security, support, and proportionate service analysis. Where consent is required, including for optional tracking, we rely on consent, which you may withdraw. Information required to provide a feature must be supplied to use that feature.

Businesses receive their customers’ bookings and communications. Their public business profiles, services, and booking availability are visible to visitors. We use providers for the following functions, sharing information needed for those functions:

Cloudflare: hosting, email delivery, and security; Neon: database hosting in Frankfurt, Germany.
Stripe: payment processing, subscription billing, and tax calculation; DataFast: website and conversion analytics.
Meta: connected Instagram and WhatsApp services; Zernio: Instagram integration and WhatsApp service messages; Google Maps: public business information, images, aggregate ratings, and review counts.
Sendly: phone verification and SMS service messages; Slack: internal account, billing, and support notifications.
OpenRouter and its model providers, including OpenAI and DeepSeek: AI processing described below.

We may disclose information when legally required, to protect rights and safety, or in a business transfer subject to appropriate safeguards. We do not sell personal information or share it for cross-context behavioral advertising, and we do not use it for targeted advertising.

5. AI processing

AI features send relevant business details, instructions, conversation text or attachment types to OpenRouter and the model provider handling the request. These systems generate replies and assist with setup. Conversations and rules may be stored to operate these features; they are not necessarily deleted when a request finishes.

Mecan does not use your content to train AI models. [CONFIRM EACH AI PROVIDER’S TRAINING USE, LOGGING, RETENTION, AND OPT-OUT SETTINGS.] Avoid sending information you do not have permission to share. Automated replies can be wrong; the business remains responsible for how it uses them.

6. Cookies and your choices

We use cookies for sign-in, connection security, and interface preferences. DataFast uses visitor and session identifiers for analytics and checkout attribution. Browser settings let you block or delete cookies, although blocking essential cookies may prevent sign-in or other features.

[INSERT VERIFIED COOKIE DURATIONS, CONSENT CONTROLS, AND ANALYTICS OPT-OUT INSTRUCTIONS.] You can disconnect integrations through the relevant account settings or provider. Disconnecting stops future access but does not itself erase previously stored records.

[STATE WHETHER THIRD PARTIES COLLECT INFORMATION ABOUT ACTIVITY OVER TIME AND ACROSS OTHER WEBSITES THROUGH MECAN, HOW WE RESPOND TO DO NOT TRACK SIGNALS WHERE RELEVANT, AND HOW WE HONOR GLOBAL PRIVACY CONTROL WHERE REQUIRED.]

7. Retention and security

We retain account and business records for [PERIOD / DELETION TRIGGER]; bookings, messages, and AI chats for [PERIOD]; support and security logs for [PERIOD]; analytics for [PERIOD]; and billing records for [STATUTORY PERIOD]. Deleted information leaves backups within [PERIOD]. Legal obligations or disputes may require limited records to be retained longer.

We use access controls and other safeguards to protect information, but no service can guarantee absolute security. Request account closure or deletion at contact@mecan.io.

8. International processing

Our Neon database is hosted in Frankfurt, Germany. We and our other providers also process information in [OTHER PROCESSING COUNTRIES], which may be outside your country. Information processed abroad may be accessible to courts, law enforcement, or national security authorities under local law. Where information leaves the EEA, UK, or another protected jurisdiction, we use [CONFIRMED TRANSFER MECHANISM, SUCH AS AN ADEQUACY DECISION OR APPROPRIATE CONTRACTUAL SAFEGUARDS]. Contact contact@mecan.io for information about these safeguards or a copy.

9. Your privacy rights

Depending on your location and applicable law, you may request access, correction, deletion, or a portable copy of your information; restrict or object to processing; withdraw consent without affecting earlier lawful processing; and opt out of sale, sharing, or targeted advertising where applicable. We do not discriminate against you for exercising these rights.

Send requests or privacy complaints to Berk Karaoğlu at contact@mecan.io. We may verify your identity and an authorized agent’s authority, and will respond within the applicable legal deadline. If we refuse a request, we will explain why, subject to legal restrictions. If your jurisdiction provides an appeal, reply to our decision to request one.

To withdraw consent, use the relevant privacy control or contact contact@mecan.io. We will explain if withdrawal prevents us from providing a requested feature. It does not affect earlier lawful processing or information we must retain by law.

You may complain to the UK Information Commissioner’s Office, the Office of the Privacy Commissioner of Canada or relevant provincial authority, or the competent authority in your jurisdiction. [INSERT APPLICABLE UAE COMPLAINT ROUTE AND ANY REQUIRED UK REPRESENTATIVE OR DPO CONTACT DETAILS.]

10. Children and policy changes

Mecan does not set a minimum age for accounts or bookings. Where applicable law requires a parent or guardian’s authorization to process a child’s information, that requirement still applies. Contact us if you believe a child’s information was collected unlawfully so we can investigate and delete it where required.

We will post updates here with a revised date and give appropriate notice of material changes, including seeking consent where required. External sites and services have their own privacy policies.