Privacy Policy

1. Information we collect

a. Account information

When you or your organization signs up, we collect your name, email address, phone number (optional, used for login and account recovery), and a password. Passwords are never stored in plain text — they are hashed before storage, and we cannot recover or view your actual password.

b. Customer data

Our customers use the Service to create and manage the records of their business — including information about their organization, the people they work with, and the activity between them. The content and structure of these records belong to the customer that creates them; Mersuit stores and processes them solely to provide the Service. We describe our responsibilities — and yours — in more detail below and in our Terms of Service.

If the records you manage include information about other people — for example, the tenants you serve — you, not Mersuit, are responsible for having a lawful basis to collect and enter that information (for example, having informed them and obtained any consent required by applicable law). Mersuit processes this data solely to provide the Service to you — we do not use it for our own marketing, and we do not sell it. If you are a tenant and have questions about your data, your first point of contact is the business that manages your records, not Mersuit directly — though we will always respond to a direct request as described in "Your rights".

c. Payment information

The Service can record financial information our customers choose to record about their own activity. Mersuit does not process payment transactions and does not store card numbers, bank account credentials, or other payment-instrument secrets. Payment processing, where a customer arranges it, happens entirely outside Mersuit with the provider of their choice.

d. Technical and log data

Like most web services, we automatically log technical data needed to operate and secure the Service: IP address, browser/user-agent, request timestamps, and session identifiers (used to keep you signed in). We use a session cookie that is required for the Service to function — we do not use third-party advertising or analytics cookies.

2. How we use information

• To provide, operate, and maintain the Service — authenticating you, enforcing access permissions, and rendering the data your account is entitled to see.
• To communicate with you — transactional email such as invitations, password resets, and account notices.
• To maintain the security, integrity, and availability of the Service, including detecting and preventing abuse.
• To comply with legal obligations and to establish, exercise, or defend legal claims.
• To improve the Service — we do not use your data, or your tenants' data, to train third-party AI models or for advertising.

3. Who has access to your data

Access inside the Service is role-based and scoped to your organization. What an account can see and do depends on the role your organization assigns to it — and one customer's data is never visible to another customer.

Mersuit platform staff — a small number of engineers operate the Service and its infrastructure. We access customer data only when necessary to provide support you requested, investigate a security incident, or maintain the Service — never to browse it.

4. Third-party services

We use a small number of infrastructure providers to run the Service. We do not sell data to anyone, and we do not share it with third parties for their own marketing purposes.

• Amazon Web Services (AWS) — our hosting provider. The Service and its database run on AWS infrastructure.
• Resend — used to send transactional email (invitations, password resets, notices) on our behalf. Resend does not receive access to your account beyond the message content and recipient address needed to deliver that email.

We may disclose information if required by law, subpoena, or other legal process, or where we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

5. Data retention

We retain account and organization data for as long as your account is active. If you or your organization closes an account, we retain the data for a limited period afterward to allow for recovery from accidental deletion and to meet backup, accounting, and legal retention obligations, after which it is deleted or anonymized. Records subject to accounting or tax record-keeping rules may be retained longer where those rules require it. You may request earlier deletion as described in "Your rights" below, subject to those same obligations.

6. Security

We take reasonable technical and organizational measures to protect your data, including: encrypting data in transit with HTTPS/TLS, hashing passwords rather than storing them in plain text, enforcing role- and organization-scoped access at the server rather than relying on the interface alone, and restricting infrastructure access to the engineers who operate the Service. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Your rights

Depending on your relationship to us and your jurisdiction, you may have rights to access, correct, export, or request deletion of your personal data, and to object to or restrict certain processing. To exercise any of these rights, contact us at support@mersuit.com. If you are a tenant whose data was entered by a customer, we will generally direct you to that customer first, since they control the underlying record, but we will still respond to you directly on request.

8. Children's privacy

The Service is intended for business use by adults and is not directed at children. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

9. International data

Our infrastructure is hosted on AWS. Depending on the AWS region in use, your data may be processed or stored in a country other than the one you or your tenants are located in. We take steps to ensure any such transfer is consistent with this Policy and applicable law.

10. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above and, where appropriate, notify account holders by email. Continued use of the Service after a change becomes effective constitutes acceptance of the revised Policy.

11. Governing law

This Policy is governed by the laws of the People's Republic of Bangladesh, without regard to its conflict-of-laws principles. See our Terms of Service for the full governing-law and dispute-resolution terms that apply to your use of the Service.

12. Contact us

Questions about this Privacy Policy or how we handle data can be sent to support@mersuit.com.