mezcal

Privacy notice

This notice explains what personal data the Mezcal website and its store trial handle, why, for how long, and what your rights are.

Last updated .

Who we are

The controller is Just Another Lemon Oy, the company that makes Mezcal.

Business ID
3646120-4
Postal address
Jollaksentie 81 B, 00850 Helsinki, Finland
Email
[email protected]

Email us about anything in this notice, including the rights listed below.

What we handle and why

Trial limits

What
When you start a trial or ask for a report, our server turns your IP address into a code with a secret key (a keyed one way hash) and counts how many trials and report requests that code made today. For an IPv6 address we use only its network part (the first half, a /64), not the full address. We never store your IP address itself. For each trial we also store a random trial ID, the store address and how many store searches it used. These contain no IP address.
Why
To keep the free trial available to everyone, stop misuse and limit the load on the stores we query.
Legal basis
Our legitimate interest (GDPR Article 6(1)(f)).
How long
We delete these records after 7 days. The deletion runs automatically when trials are started.

Human check

What
Before a trial starts, a contact form message is sent or you join the waitlist, Cloudflare Turnstile checks that you are a person. It loads only when you start typing a store address or start writing in the contact form or the waitlist form on our pages. It runs in your browser from challenges.cloudflare.com and reads technical signals from your browser and device, together with your IP address. To confirm the result, our server sends it and your IP address to Cloudflare. We get back only a pass or a fail.
Why
To protect the trial, the stores and our inbox from automated use.
Legal basis
Our legitimate interest (GDPR Article 6(1)(f)).
How long
We store nothing from the check. Cloudflare handles the signals as described in its Turnstile privacy policy.

Report requests

What
If your store is too big for the browser trial, you can ask us to email you a report on your full catalog. We store your email address, the store address, the estimated number of products, the time of the request and the same IP code as above (it limits requests per day).
Why
To make and send you the report you asked for. We use your email address only for this report.
Legal basis
Your consent, given when you send the request, and taking the step you asked for (GDPR Article 6(1)(a) and (b)).
How long
We delete the request after the report has been sent. You can withdraw your consent at any time by emailing us, and we delete the request.

Contact form

What
When you send a message with the contact form on our contact page, we store your name, your email address, your company or store if you give it, your message, the page language, the time and the same IP code as above (it limits messages per day). We email the message to our team mailbox, with your email address as the reply address. We store it in our database too, so that it is not lost if the email fails.
Why
To read your message and reply to you. We do not use your details for marketing.
Legal basis
Our legitimate interest in answering messages sent to us, and taking steps you ask for before a possible agreement (GDPR Article 6(1)(f) and (b)).
How long
12 months, then deleted automatically from our database. The copy in our mailbox is kept as long as needed to handle your matter. The daily counters with the keyed IP code: 7 days.

Waitlist

What
When you join the waitlist on our front page, we store your email address, your store’s address if you give it, the page language and the time you joined (and the time of your latest join, if you join again). To limit joins per day we use the same IP code as above, kept only in a daily counter and not on the list. We email a notice of your join to our team mailbox, with your email address as the reply address. Joining again with the same address updates your details instead of adding a second entry.
Why
To tell you when Mezcal is in the Shopify App Store. We do not use your email address for anything else.
Legal basis
Your consent, given when you join (GDPR Article 6(1)(a)). You can withdraw it at any time: write to [email protected], and we remove you from the list.
How long
Until 12 months after Mezcal is in the Shopify App Store, or until you ask us to remove you, whichever comes first. The notice in our mailbox is kept as long as needed to run the waitlist. The daily counters with the keyed IP code: 7 days.

Language choice

What
When you click EN or FI, your browser stores your choice in a cookie. When you open the front page without a choice, our server reads the country that Cloudflare works out from your IP address and sends visitors from Finland to the Finnish page. The country is not stored.
Why
To show the site in your language and not redirect you after you have chosen.
Legal basis
Needed for a feature you use (our legitimate interest, GDPR Article 6(1)(f)). See Cookies and browser storage.
How long
The cookie lasts 1 year. The country is used for that one request only.

Hosting and request logs

What
The website and the trial run on Cloudflare Pages. To deliver the pages and protect them from attacks, Cloudflare processes technical data about every request, such as your IP address, browser type, the address you opened and the time. Our own code writes no request logs, and we have not turned on log storage of our own.
Why
To run the website securely.
Legal basis
Our legitimate interest (GDPR Article 6(1)(f)).
How long
We keep no request logs. Cloudflare keeps its own operational and security data as described in its privacy policy.

What happens in the store trial

Visit statistics

What
We use Cloudflare Web Analytics to count visits to this site. It adds a small script from static.cloudflareinsights.com to the pages. It uses no cookies and no browser storage, does not follow you across sites and does not build a profile of you. We get only totals, such as page views, visits, countries, browsers and the sites visitors came from, and we cannot tell who you are from them. Like any request on the internet, loading the script and sending the visit reaches Cloudflare, which handles it as described in its privacy policy.
Why
To see how many people visit and which pages they use, so we can improve the site.
Legal basis
Our legitimate interest (GDPR Article 6(1)(f)).
How long
We store nothing ourselves. Cloudflare keeps the totals as described in its privacy policy.

We use no advertising or tracking tools. The fonts are served from our own site, so loading a page sends nothing to font services.

Personal demo pages

What
We send some online stores a private link to a demo page with a ready-made search comparison on the store’s own products and public facts about the store and the company, with their sources. When the page is opened we store only which page was opened and when. We store no IP address, no browser details and no cookies, and we do not know who opened the page. For the first opening we get a notice with the store’s name and the time.
Why
To know whether the demo has been opened, so we can follow up at the right time.
Legal basis
Our legitimate interest (GDPR Article 6(1)(f)).
How long
The link works for 30 days. The page and its opening times are deleted 90 days after that.

Mezcal Chrome extension

What
The extension shows Mezcal’s search on a store’s own pages in your Chrome. It works only on stores you allow one at a time in Chrome’s own permission prompt. For an allowed store it reads the public product list (titles, brands, tags, prices, pictures and addresses of up to 2,000 products) straight from the store, without cookies. From the store page that is open in your tab it reads the store’s name, search service and currency; when you open a search from the trial page in your store, there is no page open yet, so it reads the store’s front page for the same. It keeps the products, the store’s name, its search service and currency, and your switch position in the extension’s storage on your computer. On the store’s search page it reads the text you searched for, to show Mezcal’s results, and does not keep it. The product list and your searches stay on your computer. When you open a search from the trial page in your store, the trial page passes the extension only the store’s address and the search text, inside your browser. The extension uses them to open that store’s search page and does not keep them. To show the right button, the trial page also asks the extension whether it is installed; that question stays inside your browser too. When you install the extension it opens a short welcome page that is part of the extension. The extension’s popup and the page that opens from the trial have a plain link to the install section of our site; the link carries no store address or other data.
Why
To let you try Mezcal on your own store’s pages.
Legal basis
This part of the extension works on your computer and sends us no data. Usage data is sent only if you allow it, as described next.
How long
The product list is read again after 24 hours. Removing a store’s permission in Chrome deletes that store’s data, and removing the extension deletes all of it.

Extension usage data, only if you allow it

What
The extension asks on its welcome page, and in its window until you choose, whether you allow usage data. Nothing is sent and no identifier is created before you choose Allow usage data. If you allow it, the extension sends our server, with each event, a random install identifier created when you allow it, the extension’s version, its language (Finnish or English), the time and the name of the event, and for an event about a store, the store’s domain (for example kauppa.fi), never a page address. The events are: you allowed usage data (and whether the extension was new or updated); you allowed or refused a store; a store’s product list was read, or why not, with the number of products in rough ranges (such as 100 to 499) and the store’s search service; you switched between the store’s search and Mezcal; you opened one of the ready searches (which of the three); a search opened from the trial page in your store worked, or why not; you clicked the link to our site (“Want this in your store?”); you removed a store; and you removed the extension (Chrome then opens our page with the install identifier). For a page that is not a Shopify store no address is sent. We never receive the searches you type, page addresses, product details, your browser details or cookies. Like any website, our server sees your IP address with each request; it uses a keyed code of it only to limit how many events are accepted per day, and the IP address is not stored with the events.
Why
To learn which stores try Mezcal and ask for it, so we can offer it to them, and which features are used and where people get stuck, so we can improve the extension.
Legal basis
Your consent (GDPR Article 6(1)(a)). You can withdraw it at any time: turn off Send usage data in the extension’s window, or remove the extension. Withdrawing deletes the install identifier and any events not yet sent from your computer, and nothing more is sent.
How long
12 months, then deleted automatically. The daily counters with the keyed IP code: 7 days.
Limited Use
Our use of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We use it only for the purposes above, do not sell it, do not use it for advertising or to decide on credit, and do not share it with anyone except Cloudflare, which stores it for us.

Who else handles the data

We do not sell personal data or share it with anyone else.

Transfers outside the EU. Cloudflare and Google are US companies with global networks, so data can be processed in the United States and other countries. Both are certified under the EU-U.S. Data Privacy Framework, and their data processing terms include the EU standard contractual clauses.

How long we keep data

Your rights

You have the right to:

Email us to use these rights. We store IP addresses only as keyed codes, so to find those records we need your IP address and the date of your visit.

If you think we handle your data unlawfully, you can complain to the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), tietosuoja.fi.

Cookies and browser storage

The human check runs in a frame from Cloudflare. Cloudflare describes the signals it collects as strictly necessary for detecting bots.

We use no analytics or advertising cookies. Cloudflare Web Analytics sets no cookies and uses no browser storage. Everything above is needed for a feature you use, or leaves nothing on your device, so we do not ask for cookie consent.

For store owners

The trial reads only data that any visitor to your store can see: your public product list, your store’s own search, your front page and your sitemap. We limit how often we call each store every day, and we pause when a store asks us to slow down. Our server identifies itself with a user agent that includes our contact address. With the Mezcal Chrome extension, a visitor’s own browser reads your public product list and the store page they have open once they allow your store, at most once a day. If that visitor allowed the extension’s usage data, we learn that your store’s domain was tried with Mezcal.

If you do not want your store to be tried, email us your store’s address. We add it to our opt out list, which also covers its subdomains, and the trial will no longer start for it.

Changes

We update this notice when what we do changes. The date at the top shows the latest version.