Data protection

The controller is GR2 SA, the company that operates Merka. Swiss law applies, in particular the revised Federal Act on Data Protection, in force since 1 September 2023.

For any question about your data, write to contact@merka.ch. If you have an account, the support form is faster: there we already see your orders. No data protection adviser has been appointed; the law does not require one of a company this size, and it is the management that answers.

Your email address, essential for signing you in and notifying you of what concerns your sales and purchases. There is no password: a six-digit code is sent to you, and we keep only a hash of it, valid for fifteen minutes.

Your WhatsApp number, if you write to our bot. The Merka number answers searches over WhatsApp. What we then keep is your number, the language of your message and what you entrust to it: a search you want to follow ("alert pushchair") stays recorded until you remove it, and a request to be contacted is kept with your message so that someone calls you back. No Merka account is required.

Your username, your town and your language, which you choose. Along with your photo, that is all other members see of you. For professional sellers, the shop also shows the registered business name and UID; your private address and email address are never shown.

Your profile photo, if you sign in through Google or Facebook. It is then copied to our servers rather than displayed from theirs: without that, the provider would learn the IP address of every visitor who views one of your listings. Its metadata is removed at copy time.

Your listings, your orders, your messages, your questions, your offers and your reviews, which are the very substance of the service. A question asked on a listing is read only by you and the seller; a review, on the other hand, is public under your username.

The photos you upload. Before being stored, they are resized and ALL their metadata is removed, including the GPS coordinates your phone writes into them. The photo is also re-encoded before automatic analysis, so its metadata is not sent to the model.

The delivery address: name, street, additional line, postcode, town, country, and the phone number if you provide it. It is the most sensitive piece of data on the site. The seller sees it only for as long as it takes to dispatch: as soon as the sale is settled, they no longer have access to it. You can save an address in your profile so as not to retype it; that one belongs to you alone.

What relates to payment: the amount, the state of the order, the payment identifier at our provider, the fees withheld, and, for a seller, the fact that a change of bank details took place, never the details themselves. No card number ever reaches our servers.

A few technical traces, and they must be named: one session row per sign-in, a call counter per IP address to stop abuse, one row per listing viewed, per visitor and per day (for a visitor who is not signed in, it is not their IP address but an irreversible fingerprint of it and of their browser), and a log of calls to the analysis engine: your identifier, the model, the number of tokens, the estimated cost. Retention periods are below.

What moderation retains: when a text or a photo triggers a check, the reason and the excerpt in question are recorded with your identifier. A report you file is recorded too, with its photos, as is an account suspension and its reason. This log cannot be consulted from the site, which is what makes it useful, but you can ask us for a copy.

No banking data passes through our servers: payment takes place in an isolated frame provided by our provider, and we never see a card number.

No advertising tracker, no audience measurement tool, no social media button. We do not know where you come from or where you go next.

No sensitive data within the meaning of the law: no origin, no opinions, no health data, no religion, no biometric data. Nor do we ask for identity documents; it is our payment provider that verifies a seller's identity, on its own systems.

Each of these recipients corresponds to a call the code actually makes. There are no others.

Stripe, to collect and pay out. A seller provides them directly with their identity and bank details, as the law requires of any institution that pays out money; we do not store that information. For a buyer, we transmit the amount, the order identifier and their email address, which is used for the receipt. The card form is served by Stripe and runs in your browser: they see your IP address there.

Mistral, to analyse listing photos and, as a fallback, to translate. The re-encoded photo goes to them without metadata, and the listing text when translation falls to them. Your name, address and email address are never transmitted to them.

Infomaniak, which hosts the site, the database and the photos, in Switzerland, and which translates listings into the other national languages. A translated listing is a listing readable from one end of the country to the other; it is the text of the listing that goes out, nothing else.

swisstopo, when you type an address. Each entry of at least three characters goes to the federal register of buildings and dwellings to suggest the right address, and the full address goes there once more, to verify that it exists; one typo in a postcode and someone else's parcel goes astray. It is a service of the Confederation, hosted in Switzerland.

Swiss Post, for the carriage of the parcel: on every paid sale, we send its interface the delivery address and the seller's address to produce the label that the seller prints and hands over with the parcel. We also query its tracking, automatically and several times a day, with the parcel number alone: it is the recorded delivery that starts the dispute period and then releases the payout. A return during a dispute is tracked the same way.

Open Library, MusicBrainz and the Bibliothèque nationale de France, when you scan the barcode of a book or a record to fill in the listing in one move: only the thirteen digits of the code go out, nothing that concerns you. The BnF catalogue is queried for books the others do not know.

Google, Facebook or Apple, only if you choose to sign in through them: they then return your verified email address and, where applicable, your photo. The payment page now loads the font from our own servers, including inside Stripe's frame.

Meta Platforms (WhatsApp Business), for everything that goes through WhatsApp: your messages to the bot and its replies, the alerts we send you, and the activity feed we send to our own administrator, which mentions the email address of every new sign-up, the title and price of a listing published or paid for, and the number of anyone asking to be called back. Meta therefore sees those numbers and contents; it is an American company.

Your browser's notification service (Google, Apple or Mozilla depending on the device), only if you turn notifications on: we hand it a subscription address it gave us and a message encrypted for your device, which it cannot read. Only three events trigger one: an offer, a question, a sale.

Twilio, provided for in the code for an "item sold" text message to a seller who gave a mobile number, but not connected to date: as long as it is not, no text message goes out and nothing is passed to it.

No one else. We neither sell nor rent any data, and we pass none on for advertising purposes.

Your published listings can be read, without an account, through our catalogue feeds, our public API and our connector for assistants (MCP). These channels return the content of the listing: title, description, price, condition, category, the town given in the listing, photos, the link to the listing and whether it comes from a professional shop. They never return your name, your username, your e-mail address, your number, your postal address or your account identifier.

Whoever queries these channels therefore learns nothing about you. Of them, we keep only a salted, truncated fingerprint of the IP address, for thirty days at most, to count calls and stop abuse. A withdrawn or sold listing disappears from these channels on the next read.

Hosting, the database, the photos and translation stay in Switzerland. Leaving it: Stripe, whose entity serving us is Irish and whose group is American; Mistral, in France, which receives listing photos; the Bibliothèque nationale de France, which, like the American Open Library and MusicBrainz, receives only a barcode; Meta Platforms, American, through which everything sent over WhatsApp passes; and your browser's notification service (Google, Apple or Mozilla, American), which receives only an encrypted message. Ireland and France are among the states whose protection the Federal Council recognises as adequate.

Your account and your listings remain as long as you keep them. Orders and the exchanges relating to them are kept beyond that, because they serve as evidence in a dispute and because accounting law requires it. The detail, category by category:

Three mechanisms operate without human intervention, and you should know it. A model reads your photos to draft the listing, suggest a category and estimate the parcel size: it is only a suggestion, you correct everything before publishing.

A word filter and the reading of the photo can refuse a publication or flag it for review. And in a dispute, no decision is automatic: a person examines every case and decides.

In each of these cases, write to us: a person will re-examine the decision.

The database separates rights row by row: a query made on your behalf cannot read what belongs to someone else, even if the code gets it wrong. Session tokens and sign-in codes are stored only as hashes; a leak of the database would not allow anyone to sign in to any account. Photos lose their metadata. Access to the operations console is restricted to a list of addresses kept outside the database.

You can consult your data, correct it, have it deleted, object to a processing operation and request a copy. The username, town, language, photo and saved address can be changed from your profile; for the rest, write to us. There is no button yet, it is done by hand, and we reply within thirty days.

Deleting an account cannot carry with it the deletion of completed orders: they bind another person than you, the records of a sale must remain available in the event of a dispute, and accounting law retains them for ten years. What remains is then reduced to what those obligations require.

If you reside in the European Union, the GDPR additionally applies to what concerns you: the same rights, plus portability and the possibility of applying to the supervisory authority of your country.

In Switzerland, you can contact the Federal Data Protection and Information Commissioner, in Bern.