Privacy notice

This notice explains what personal data the Mezcal website and its store trial handle, why, for how long, and what your rights are.

Last updated 5 October 2026.

Who we are

The controller is Just Another Lemon Oy, the company that makes Mezcal.

Business ID: 3646120-4
Postal address: Jollaksentie 81 B, 00850 Helsinki, Finland
Email: privacy@justanotherlemon.com

Email us about anything in this notice, including the rights listed below.

What we handle and why

Trial limits

What: When you start a trial or ask for a report, our server turns your IP address into a code with a secret key (a keyed one way hash) and counts how many trials and report requests that code made today. For an IPv6 address we use only its network part (the first half, a /64), not the full address. We never store your IP address itself. For each trial we also store a random trial ID, the store address and how many store searches it used. These contain no IP address.
Why: To keep the free trial available to everyone, stop misuse and limit the load on the stores we query.
Legal basis: Our legitimate interest (GDPR Article 6(1)(f)).
How long: We delete these records after 7 days. The deletion runs automatically when trials are started.

Human check

What: Before a trial starts, Cloudflare Turnstile checks that you are a person. It loads only when you start typing a store address on our pages. It runs in your browser from challenges.cloudflare.com and reads technical signals from your browser and device, together with your IP address. To confirm the result, our server sends it and your IP address to Cloudflare. We get back only a pass or a fail.
Why: To protect the trial and the stores from automated use.
Legal basis: Our legitimate interest (GDPR Article 6(1)(f)).
How long: We store nothing from the check. Cloudflare handles the signals as described in its Turnstile privacy policy.

Report requests

What: If your store is too big for the browser trial, you can ask us to email you a report on your full catalog. We store your email address, the store address, the estimated number of products, the time of the request and the same IP code as above (it limits requests per day).
Why: To make and send you the report you asked for. We use your email address only for this report.
Legal basis: Your consent, given when you send the request, and taking the step you asked for (GDPR Article 6(1)(a) and (b)).
How long: We delete the request after the report has been sent. You can withdraw your consent at any time by emailing us, and we delete the request.

Language choice

What: When you click EN or FI, your browser stores your choice in a cookie. When you open the front page without a choice, our server reads the country that Cloudflare works out from your IP address and sends visitors from Finland to the Finnish page. The country is not stored.
Why: To show the site in your language and not redirect you after you have chosen.
Legal basis: Needed for a feature you use (our legitimate interest, GDPR Article 6(1)(f)). See Cookies and browser storage.
How long: The cookie lasts 1 year. The country is used for that one request only.

Hosting and request logs

What: The website and the trial run on Cloudflare Pages. To deliver the pages and protect them from attacks, Cloudflare processes technical data about every request, such as your IP address, browser type, the address you opened and the time. Our own code writes no request logs, and we have not turned on log storage of our own.
Why: To run the website securely.
Legal basis: Our legitimate interest (GDPR Article 6(1)(f)).
How long: We keep no request logs. Cloudflare keeps its own operational and security data as described in its privacy policy.

What happens in the store trial

Your browser loads the store’s public product list straight from the store. The store sees that request like any visit to its site. The product list stays in your browser. We do not store it on our servers.
Mezcal’s results are searched inside your browser.
For the column with the store’s own search, the text you search for goes through our server to the store’s search, or to the search service the store uses (for example Boost). We also read the store’s front page and sitemap once to learn its name, search service and size. Our server does not pass your IP address to the store.
To spare the store, Cloudflare caches these answers for 10 minutes (searches) and 24 hours (store name, search service and size). The cache holds the search text and the store’s public data, not who searched.
Please do not type personal information into the search box.

Visit statistics

What: We use Cloudflare Web Analytics to count visits to this site. It adds a small script from static.cloudflareinsights.com to the pages. It uses no cookies and no browser storage, does not follow you across sites and does not build a profile of you. We get only totals, such as page views, visits, countries, browsers and the sites visitors came from, and we cannot tell who you are from them. Like any request on the internet, loading the script and sending the visit reaches Cloudflare, which handles it as described in its privacy policy.
Why: To see how many people visit and which pages they use, so we can improve the site.
Legal basis: Our legitimate interest (GDPR Article 6(1)(f)).
How long: We store nothing ourselves. Cloudflare keeps the totals as described in its privacy policy.

We use no advertising or tracking tools. The fonts are served from our own site, so loading a page sends nothing to font services.

Personal demo pages

What: We send some online stores a private link to a demo page with a ready-made search comparison on the store’s own products and public facts about the store and the company, with their sources. When the page is opened we store only which page was opened and when. We store no IP address, no browser details and no cookies, and we do not know who opened the page. For the first opening we get a notice with the store’s name and the time.
Why: To know whether the demo has been opened, so we can follow up at the right time.
Legal basis: Our legitimate interest (GDPR Article 6(1)(f)).
How long: The link works for 30 days. The page and its opening times are deleted 90 days after that.

Mezcal Chrome extension

What: The extension shows Mezcal’s search on a store’s own pages in your Chrome. It works only on stores you allow one at a time in Chrome’s own permission prompt. For an allowed store it reads the public product list (titles, brands, tags, prices, pictures and addresses of up to 2,000 products) and the front page straight from the store, without cookies. It keeps the products, the store’s name, its search service and currency, and your switch position in the extension’s storage on your computer. On the store’s search page it reads the text you searched for, to show Mezcal’s results, and does not keep it. The product list stays on your computer: the extension sends nothing to us or to anyone else. When you open a search from the trial page in your store, the trial page passes the extension only the store’s address and the search text, inside your browser. The extension uses them to open that store’s search page and does not keep them. To show the right button, the trial page also asks the extension whether it is installed; that question stays inside your browser too.
Why: To let you try Mezcal on your own store’s pages.
Legal basis: We receive no data from the extension, so we do not process personal data through it. We do not sell this data, use it for advertising or share it with anyone.
How long: The product list is read again after 24 hours. Removing a store’s permission in Chrome deletes that store’s data, and removing the extension deletes all of it.

Who else handles the data

Cloudflare, Inc. hosts the website, runs the trial’s server code, database and cache, and provides the human check and the visit statistics. It processes the data on our behalf under its data processing terms. For the human check, Cloudflare also uses the signals as its own controller to improve its bot detection. We have asked Cloudflare to keep the trial database in Western Europe.
The store you try, and the search service it uses, receive the requests described above. They handle their own visitor data under their own privacy notices.

We do not sell personal data or share it with anyone else.

Transfers outside the EU. Cloudflare is a US company with a global network, so data can be processed in the United States and other countries. Cloudflare is certified under the EU-U.S. Data Privacy Framework, and its data processing terms include the EU standard contractual clauses.

How long we keep data

Hashed IP counters and trial records: 7 days.
Report requests: until the report has been sent.
Demo pages and their opening times: 90 days after the link expires.
Emails you send us: as long as needed to handle your matter.
The language cookie: 1 year in your browser. Browser storage: see below.
Request logs: none kept by us.

Your rights

You have the right to:

get a copy of the personal data we hold about you
have incorrect data corrected
have your data deleted
object to processing based on our legitimate interest
restrict processing in some cases
withdraw your consent for a report request at any time

Email us to use these rights. We store IP addresses only as keyed codes, so to find those records we need your IP address and the date of your visit.

If you think we handle your data unlawfully, you can complain to the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), tietosuoja.fi.

Cookies and browser storage

mezcal_lang (cookie, 1 year): your language choice, set only when you click EN or FI.
mezcal_lang_banner_dismissed (local storage): remembers that you closed the “also in Finnish” banner. It stays until you clear your browser’s site data.
Session storage during a trial: the page keeps your current trial for the store you entered, so that reloading the page does not start a new one. It is deleted when you close the tab and is not used after the trial ends.
mezcal-extension-handoff (session storage): when you click Add to Chrome, the store’s address and your search, so the trial page can open that search in your store once the extension is added. It is deleted when it is used, after 30 minutes, or when you close the tab.

The human check runs in a frame from Cloudflare. Cloudflare describes the signals it collects as strictly necessary for detecting bots.

We use no analytics or advertising cookies. Cloudflare Web Analytics sets no cookies and uses no browser storage. Everything above is needed for a feature you use, or leaves nothing on your device, so we do not ask for cookie consent.

For store owners

The trial reads only data that any visitor to your store can see: your public product list, your store’s own search, your front page and your sitemap. We limit how often we call each store every day, and we pause when a store asks us to slow down. Our server identifies itself with a user agent that includes our contact address. With the Mezcal Chrome extension, a visitor’s own browser reads your public product list and front page once they allow your store, at most once a day.

If you do not want your store to be tried, email us your store’s address. We add it to our opt out list, which also covers its subdomains, and the trial will no longer start for it.

Changes

We update this notice when what we do changes. The date at the top shows the latest version.