Privacy Policy

What the browser extension handles

The optional extension runs on tienda.mercadona.es and reads your existing Mercadona session token from your browser so it can connect your account to mundomerca for basket sync and checkout.

• Your Mercadona access token is passed to the mundomerca app only to perform actions you request (syncing your basket).
• Your Mercadona refresh token never leaves the extension and is not shared with the web page or our servers.
• Your Mercadona password is never read, seen, or stored.
• Tokens are held in your browser’s local extension storage; the extension does not track your browsing or act on any other site.

What the web app collects

• Search queries — processed to return results. Query text is sent to OpenAI to compute a semantic embedding; it is not used to identify you.
• Basket and preferences (e.g. allergens you avoid) — used to provide the service; dietary preferences are kept in your browser.
• Postcode — if you enter it, we check delivery availability with Mercadona; it is stored locally in your browser.
• Product catalogue data — public product, price, and category information sourced from Mercadona’s public API and stored to power fast search and price history.

How we use data

To operate and improve the service: run search, sync your basket to your Mercadona account on your instruction, check delivery for your postcode, show price history, and apply your dietary preferences.

What we don’t do

• We do not sell or rent your personal data.
• We do not use your data for third-party advertising or to build advertising profiles.
• We do not use your data to determine creditworthiness or for lending.
• We do not use your data for any purpose unrelated to the shopping features above.

Sharing

We share data only with infrastructure providers needed to run the service (e.g. OpenAI for search embeddings, and our hosting provider), and with Mercadona’s own API when you ask us to check delivery or sync your basket. We disclose data if required by law.

Retention & your choices

• Remove the extension at any time to stop token access.
• Clear your browser storage to remove locally-held data (tokens, preferences, postcode).
• Contact us to request deletion of any account data we hold.

Contact

Questions about this policy or your data? Email us: [email protected]