Privacy Policy

Information you submit: Name, email address, city and state, and any note you provide. A Fleet Owner also gives a vehicle-count range and purchase stage. A Service Vendor gives trade categories, insurance status and team size, and may provide a phone number.

Information recorded with a submission: IP address, browser and device user-agent, submission time, a unique event identifier, a pseudonymous browser identifier, campaign and referrer attribution when present, and the result and score returned by our spam check. These fields help us secure the form, prevent duplicate submissions, understand which campaign produced an enquiry, and keep an auditable lead record.

Google reCAPTCHA: When you begin interacting with a form, we load Google reCAPTCHA to distinguish people from abusive traffic. Google receives device and usage signals and may store or access information on your device for that security purpose. Google’s Privacy Policy and Terms of Service apply. The script is loaded after form interaction rather than on every page.

Lead storage and notification: A submitted lead is stored in our database. We may also send its form details, attribution, event identifier and spam-check result to an internal Mersul recipient using our email-delivery provider so that we can respond. Our hosting, database, email and security providers process this information for us under their service terms.

Account and business information: Names, business name, contact details, roles, account credentials, permissions, licences, service categories, insurance records and account activity.

Identity, tax and payout information: Vendors will complete identity, tax and payout onboarding through Stripe Connect. Stripe may collect information such as an SSN, EIN, government identification and bank or debit-card details directly. Mersul expects to receive verification status, processor-issued account or payout identifiers, transaction details, and other information Stripe makes available to the platform. Such identifiers are pseudonymous, not anonymous. We do not intend to store raw bank-account or debit-card numbers.

Authorized vehicle information: Information made available by the vehicle manufacturer within the scopes an Owner grants, which may include VIN, vehicle status, precise or approximate location, charge state, tyre pressure, alerts, service information, authorization state and the outcome of permitted remote commands. We do not receive the Owner’s Tesla password.

Service and marketplace records: Dispatch location and status, Vendor location while actively performing a job, estimates, approvals, before-and-after photographs, messages, job timestamps, transaction and payout records, incident evidence, and ratings or feedback associated with completed work.

Operations and vehicle commands: Use authorized vehicle and job information to identify operating needs, route or dispatch work, provide job-scoped vehicle access, send an authorized navigation or other command, monitor completion, and maintain an audit trail.

Payments and compliance: Use Stripe Connect to onboard Vendors, verify identity, route payments and payouts, manage refunds or disputes, detect fraud, and meet tax-reporting and financial-record obligations. A Vendor’s use of Stripe is also governed by the applicable Stripe agreement and privacy notice presented during onboarding.

Between marketplace users: Give an assigned Vendor the vehicle and location details reasonably needed for an accepted job, such as exact coordinates, identifying vehicle information and the job scope. Give the Owner the Vendor and service records needed to oversee that job. We do not intend to disclose either party’s unrelated customer data.

Reliability Index and human review: Use objective job records, such as acceptance, ETA adherence, completion time and photo review, to calculate marketplace reliability and priority. The score may inform access, suspension or termination decisions. A Vendor may ask for an explanation, correct the underlying record and request human review. Except for an urgent safety, security or fraud restriction, we do not intend to make a final account-termination decision solely by automation.

Incidents and insurance: Use and disclose relevant telemetry, access logs, photos, communications and transaction records to the parties to a dispute and, where appropriate, insurers, underwriters, professional advisers, law enforcement or other authorities.

Vehicle manufacturers: Exchange authentication, authorization, telemetry and command information with Tesla or another supported manufacturer only as needed to provide the connection an Owner enables.

Cookie choice: mersul_consent stores your selection for 180 days. It is used whether you accept or reject optional measurement and advertising so we do not have to ask on every page.

First-party attribution and browser identifier: If you arrive with campaign parameters or from an outside referrer, mersul_attr records the landing page, campaign and first and most recent referring touch for 90 days. mersul_uid is a random, pseudonymous browser identifier kept for 12 months and used to associate events and deduplicate a form submission. The site currently sets these first-party values before a cookie choice is made. They are included with a form you submit, but are not sent to an advertising platform by Mersul unless advertising consent is active.

Spam protection: Google reCAPTCHA is loaded only after you interact with a form. It may use security storage such as _GRECAPTCHA and device or browser signals to assess abuse.

Google Analytics 4 — with consent: Measures visits, page use, referral sources and conversions. It commonly uses _ga and _ga_<id>, which may remain for up to two years.

Google Ads — with consent: Measures advertising conversions and can create an audience of prior visitors for retargeting. It commonly uses _gcl_* cookies, often for up to 90 days.

LinkedIn Insight Tag — with consent: Measures conversions, supports retargeting and provides aggregate audience information. LinkedIn may recognize a signed-in member, but does not give Mersul the identity of each person who viewed a page. Depending on the browser and configuration, LinkedIn cookies can include li_sugr, bcookie, lidc, UserMatchHistory and AnalyticsSyncHistory, with lifetimes from a session to approximately two years.

Meta Pixel — when enabled and with consent: Measures conversions and supports retargeting on Facebook and Instagram. Meta may match a visit to a Meta account. It commonly uses _fbp and, after a Meta ad click,_fbc, often for up to 90 days. The tag loads only when a Meta identifier is configured and advertising consent is active.

Consent Mode: Google advertising and analytics permissions default to denied before a Google measurement tag is permitted to load. We update those settings only after an affirmative choice.

Changing your choice: Use the Cookie settings link in the footer. Rejecting or withdrawing prevents Mersul from loading the optional tags on later page views. Cookies already placed by another platform may remain until they expire or you remove them using your browser or that platform’s controls.

Global Privacy Control: If no Mersul cookie choice is already stored and your browser sends a Global Privacy Control signal, the site treats optional analytics and advertising as refused and hides the banner. A saved explicit cookie choice continues to control until you change it or it expires.

Consent: Optional analytics, advertising, retargeting and any server-side advertising matching enabled in the future. Consent may be withdrawn at any time.

Legitimate interests: Responding to an enquiry, keeping an accurate lead record, attributing a submitted enquiry, securing the site, detecting spam and fraud, deduplicating submissions, defending legal claims, and improving the service. We consider the nature of the data, the visitor’s expectations and the available controls before relying on this basis.

Contract: Creating and administering a platform account and performing the dispatch, access, marketplace and payment services a platform user requests.

Legal obligation: Identity, tax, accounting, sanctions, fraud-prevention, lawful-request and other records we must process or retain under applicable law.

Service providers: Providers that host the website and API, store database records, deliver internal or user-facing email and SMS, protect forms, analyze approved traffic, support advertising, process payments, or provide security and professional services. They receive only the information reasonably needed for the service we ask them to perform.

Named integrations: Google processes reCAPTCHA data and, with consent, Google Analytics and Google Ads data. LinkedIn and, when enabled, Meta process advertising data with consent. Stripe will process identity, payment, payout and tax data for platform accounts. Tesla will process account and vehicle requests made through an authorized Fleet API connection.

Marketplace and claim recipients: Owners, assigned Vendors, insurers and underwriters receive the job or incident information described in section 4 when the platform is active.

Legal and business events: We may disclose information when reasonably necessary to comply with law, protect rights or safety, investigate abuse, or complete a financing, acquisition, reorganization or sale, subject to appropriate confidentiality and notice where required.

Early-access records: Form details and the technical and attribution fields stored with them are kept until you ask us to delete them or for two years after our last substantive contact, whichever is earlier, unless a shorter period is required or a limited record must be retained for a legal claim, security investigation or compliance obligation. Unsubscribe and opt-out records may be retained to ensure we honor the request.

Cookies: Mersul cookie lifetimes are stated in section 5. Optional provider cookies follow the provider’s configured or published expiration and may be removed earlier through browser controls.

Future platform records: Before commercial activation, we will publish retention periods for account, payment, tax, job, photo, location, vehicle, incident and audit records. They will reflect operational need, dispute windows and legal retention duties. Raw high-frequency data will be aggregated or deleted when detailed data is no longer needed.

Deletion and backups: Deletion from active systems may not remove information immediately from encrypted backups. Backup copies are isolated from ordinary use and expire on their normal cycle, unless preservation is legally required.

Security: We use administrative, technical and organizational measures appropriate to the nature of the information. Planned manufacturer API traffic uses the security required by that provider, and payment information is handled through Stripe. No internet transmission or storage system can be guaranteed completely secure.

Submitting a request: Email support@mersul.com and describe the request. We may ask for information reasonably needed to verify your identity and authority. An authorized agent may submit a request where applicable. We aim to respond within 30 days and will always respond within the period required by applicable law. If we deny a request, our response will explain why and how to appeal where an appeal right applies.

Deletion and correction: You may ask us to correct or delete an early-access record. Some information may be retained when an exception applies, including security, legal-claim, tax, accounting or opt-out records.

Advertising choices: Reject or withdraw advertising consent through Cookie settings. Where required, we treat a recognized opt-out preference signal such as GPC as an opt-out for that browser or device, subject to the saved-choice behavior explained in section 5.

Email choices: Use the unsubscribe link in a marketing email or contact us. Transactional or direct responses to a request you made may still be sent. We may keep a minimal suppression record so the marketing opt-out remains effective.

No discrimination: We do not charge a fee or provide a lower level of service merely because you exercised a privacy right, except where a difference is reasonably related to information that is necessary to provide a requested feature and the law permits it.

United States processing: Mersul is based in the United States and current lead records are processed there. If you contact us from another country, your information is transferred to the United States, where privacy law may differ. Where a restricted international transfer requires a safeguard, we use the applicable provider terms and recognized contractual or other transfer mechanism. Contact us to request information about an applicable safeguard.

Children: The site and planned platform are intended for businesses and adults. We do not knowingly collect personal information from anyone under 18 and will delete it if we discover that we have done so, subject to any obligation to preserve a limited record.

Changes: The date at the top identifies the current version. If a change materially affects what we collect, why we use it or who receives it, we will provide notice on the site and, where appropriate, directly to people whose contact information we hold. We will request fresh consent when the law requires it.