Privacy policy

Who we are

Mercovano ("we", "us") builds and runs custom software apps on top of a company's accounting and ERP systems. Mercovano is operated by Vergo Technologies Inc., a Delaware corporation, 228 Park Avenue South, PMB 76551, New York, NY 10003, United States. Questions about this policy: see Contact, below.

This policy covers our website (www.mercovano.com) and our app (app.mercovano.com). When we process data inside the app on a customer's behalf, that customer decides what is connected and who can see it; we act as their service provider (processor).

What we collect

• When you contact us or book a demo: your name, work email, phone number, the software you'd like built and the systems you use.
• When you create an account: your name, work email, company name and a password (stored only as a salted hash, never in readable form).
• From the systems you connect (for example QuickBooks Online, Microsoft Dynamics 365 Business Central or Foundation): the business records your apps need, such as vendors, customers, bills and invoices, purchase orders, jobs and projects, cost codes, general ledger accounts, and employees' work details (name, employee number, work email, job title). When a system is first connected we "learn" what's in it: we count the records in each table or object and read a small number of sample records. We never read people's personal contact details, tax or bank details for this.
• What you give the app: your messages when you describe or change an app, files you upload (such as invoices and receipts), and the records you and your colleagues create.
• Activity and security records: an audit log of the actions taken in your account and by whom, and technical logs needed to keep the service secure and working. IP addresses used for rate limiting are stored only as one-way hashes.

How we use it

• To provide the service: connecting your systems, drawing and building your apps, running them, and syncing the records they use.
• To support you, and to tell you about your account (for example "we've read your data", "your app is ready to test").
• To keep the service secure, prevent abuse, and meet legal obligations.

We don't sell your information, we don't use it for advertising, and we don't use your data or your connected systems' data to train AI models.

Connected systems, including QuickBooks

• You choose what to connect, and connecting is read-only unless you turn on writing for a specific app. An app never moves money: it doesn't pay bills or transfer funds.
• Access tokens and connection passwords are encrypted with AES-256-GCM, bound to your account, and never shown again to anyone, including our team.
• You can disconnect at any time. Disconnecting from Connections in the app revokes our access and deletes its tokens. Disconnecting from within the connected system (in QuickBooks Online: Apps, then Disconnect) revokes our access there, so we can no longer read it. Records already synced stay in your account until you ask us to delete them or close your account.
• We use data from a connected system only to provide your apps to you. We don't combine it with other customers' data or share it with anyone except the service providers listed below.

Artificial intelligence

Some features use AI models, for example reading an uploaded invoice, suggesting how a line is coded, or drawing an app from your description. We send these requests through OpenRouter only to endpoints that keep no data and don't train on it ("zero data retention"), at Amazon Web Services (Bedrock), Google Cloud (Vertex AI) and Microsoft Azure. Fields your administrator marks as never to be shared with AI are not sent. What the AI produces is a suggestion: a person in your company confirms it.

Service providers

We use these providers to run the service; each only processes data to provide their part of it:

• Vercel: hosts the app and website (United States).
• Supabase: our database, on Amazon Web Services (us-east-1, United States).
• OpenRouter, with Amazon Web Services, Google Cloud and Microsoft Azure: AI models, zero data retention only.
• Resend: sends email from the service.
• GitHub: runs automated checks of app prototypes in a browser; a prototype can include a few sample records from your connected system.

Your data is stored in the United States.

Security

Data is encrypted in transit (TLS) and at rest. Each customer's data is kept apart by row-level security in the database. Every action is recorded in an audit log your administrators can see, including any access by our team, which is limited to people who need it to build and support your apps.

How long we keep it

We keep your account and app data while your account is open. When you close your account or ask us to, we delete your data from the service within 30 days, except where we must keep something to meet a legal obligation. Copies in our backups are deleted as those backups expire.

Your choices and rights

You can see and correct most of your information in the app. To access, export or delete your data, or to object to how we use it, write to us at the address below. Depending on where you live (for example California or the EU and UK), you may have further rights, which we honour. If you're a user of a customer's account, we may refer your request to that customer.

Cookies

The website sets no cookies and runs no analytics or advertising trackers. The app uses only the cookies it needs to keep you signed in.

Children

Mercovano is a business service, not meant for anyone under 16, and we don't knowingly collect their information.

Changes

If we change this policy in a way that matters, we'll update the date above and tell account owners by email before the change takes effect.

Contact

Vergo Technologies Inc., 228 Park Avenue South, PMB 76551, New York, NY 10003, United States.