Privacy Policy

Effective Date: May 28, 2026 · Last Updated: October 11, 2026 · Version 2.1

Meridian AI is committed to protecting your privacy and being transparent about our data practices. This Privacy Policy explains what data we process, why we process it, who we share it with, and the rights you have. By using the Meridian AI platform, you agree to the practices described here.

1. Who We Are

Meridian AI ("Meridian," "we," "us," "our") provides a software platform for cross-border deal teams operating in the Gulf-US investment corridor. This Privacy Policy applies to data we process when you visit our website (meridianai.fyi) or use our platform. For privacy questions, contact us at privacy@meridianai.fyi. We do not currently have a formal Data Protection Officer; questions are reviewed by our principal team and answered within 30 days.

2. What Data We Collect

Account data: name, email address, organization name, job title, and password (stored as a bcrypt hash). Phone number only if you provide it for SMS notifications. Profile data: optional avatar, email signature, corridor preferences, language preference, multi-factor authentication settings, and notification preferences. Deal and content data: deal records, stakeholders, contacts, documents you upload, meeting notes, draft communications, regulatory assessments, due-diligence reports, and any other content you create within the platform. AI interaction data: the prompts you send to our AI agents and the responses they return. These include any document text or deal data you reference in a prompt. Contact data you add: names, email addresses, phone numbers, organizations, roles and notes about the people and companies you track. When you run enrichment or a briefing on a contact, the details needed for the lookup (name, organization, email address or LinkedIn URL) are sent to the enrichment providers listed on our Sub-Processors page. OAuth and integration data: when you connect a Google or Microsoft account, or your organization connects Slack, WhatsApp Business or Twilio, we receive access tokens or credentials scoped to the permissions granted. OAuth tokens are stored encrypted at rest (AES-256-GCM). The Google connection is used for sign-in, calendar sync and contacts import, and the Microsoft connection for calendar sync and contacts import. Meridian does not read or import your mailbox, and Gmail read and send permissions are not requested today. The Microsoft connection requests calendar and contacts permissions only (plus basic sign-in profile scopes); Meridian does not read, import or send mail through your Outlook mailbox. Calendar events and contacts are synced only if you enable those connections. Email you send: messages you compose, reply to, forward or send from a draft to external recipients are sent from your Meridian address through Resend, our email provider, which receives the sender, recipients, subject and message body. Usage and technical data: HTTP request logs (URL, status, user agent, IP address, timing), error reports, AI request token counts and costs, and product-usage events (page views and feature use, recorded with your user and organization ID and a per-browser identifier). We use this to operate, debug, improve, and bill the service. Cookies and similar technologies: a session cookie for authentication (HttpOnly, SameSite=Lax, Secure in production), a CSRF protection token, short-lived state cookies while you connect an integration, and an access cookie for the password-protected documentation area. Preferences such as language, theme and dashboard layout are stored in your browser's local storage, not in cookies. We do not use third-party advertising or cross-site tracking cookies. We do not knowingly collect data from individuals under 18.

3. Why We Process Your Data (Legal Basis)

Under the GDPR Article 6 and equivalent provisions in the Saudi PDPL and UAE PDPL, our lawful bases for processing are: - Contract performance (Art. 6(1)(b)): processing necessary to provide the platform you have purchased, including account creation, deal management, AI agent execution, integration sync, billing, and customer support. - Legitimate interests (Art. 6(1)(f)): product-usage analytics to improve the product; security monitoring (detecting unauthorized access); fraud prevention; debugging logs. You may object to processing on this basis at any time (see Section 7). - Consent (Art. 6(1)(a)): we do not currently rely on consent for any processing, and the platform does not yet record consent choices. If we introduce a consent-based feature (for example marketing email), we will ask first, record your choice, and let you withdraw it at any time. - Legal obligation (Art. 6(1)(c)): retention of billing records (per tax law), responding to subpoenas, and AML/KYC checks where applicable. We do not rely on consent as the lawful basis for core platform functionality — providing the service is performed under contract.

4. Sub-Processors and Data Sharing

To provide the platform, we share data with a defined set of sub-processors. The full current list — with each vendor's name, location, purpose, and category of data shared — is maintained at our [Sub-Processors page](/sub-processors). We will notify customers via email at least 30 days before adding a new sub-processor that materially changes the categories of data shared. Recipients by category (locations, purposes and the data each one receives are on the Sub-Processors page): - Infrastructure & Hosting: Vercel Inc.; Railway Corp.; Amazon Web Services, Inc.. - AI Processors: Anthropic, PBC; OpenAI, LLC. - Communications & Messaging: Resend Inc.; Twilio Inc.; Meta Platforms, Inc. (WhatsApp Business API); Slack Technologies, LLC; LiveKit, Inc.; 650 Industries, Inc. (Expo); Browser push services (Google, Mozilla, Apple). - Identity & Productivity Integrations (OAuth): Google LLC; Microsoft Corp.. - Payments: Stripe, Inc.. - Observability: Functional Software, Inc. (Sentry). - Contact & Company Enrichment: People Data Labs, Inc.; Apollo.io; Nubela Pte. Ltd. (Proxycurl); OpenCorporates Ltd.; OpenOwnership; Crunchbase Inc.; Magnitt; Newscatcher API; GDELT Project; Free Law Project (CourtListener); U.S. Securities and Exchange Commission (EDGAR). - Companion Services: Meridian Capital. The Sub-Processors page also lists public datasets we download (such as sanctions lists), integrations that are built but not yet active, and our source-control provider. None of them receives your data. AI processing: Anthropic (Claude) powers every agent, chat, drafting and classification feature. OpenAI is used only to transcribe meeting recordings you upload (Whisper speech-to-text), when transcription is enabled. No other AI provider receives your data. When you send a prompt to an AI agent, that prompt and the relevant deal or document context are transmitted to Anthropic, which returns the response we display to you. We have selected AI providers that contractually agree not to train their public models on customer prompts and responses. Other disclosures: we may share data with legal authorities when required by valid legal process; with a successor entity in connection with a merger or acquisition (you would be notified at least 30 days in advance); and with members of your own organization who have been granted access by your administrator. We do not sell personal data and we do not use customer deal content or AI prompts to train any AI model.

5. International Data Transfers

Customer data is hosted in the EU (database, cache, background worker and document-processing services on Railway's EU West region in the Netherlands) and in the United States (the web application on Vercel; uploaded files and database backups on AWS S3). If you are based in the Gulf, the European Union, or another jurisdiction, your data will be transferred to and processed in these regions, and service providers listed on our Sub-Processors page may process it in the locations shown there. For transfers from the EEA, United Kingdom, and Switzerland to the United States, we rely on the Standard Contractual Clauses (SCCs) issued by the European Commission, supplemented by our security measures (Section 6 below). For transfers from the Kingdom of Saudi Arabia, we comply with the data-export provisions of the PDPL. For transfers from the United Arab Emirates, we comply with the UAE PDPL. Hosting in a specific region, for example in the Gulf, is not offered today; it is a roadmap item for Enterprise contracts. If it is a requirement for your organization, contact privacy@meridianai.fyi.

6. Security Measures

We implement technical and organizational measures to protect your data. Current practices: - Encryption in transit: TLS 1.2+ for connections to the platform (HTTPS); HSTS enabled on production domains. Whether the application's connections to its database and Redis are encrypted depends on our hosting configuration (Railway), which we have not independently verified. - Encryption at rest: AES-256-GCM for sensitive credentials (OAuth tokens, integration keys); AWS S3 server-side encryption for backups. Encryption of the database storage at rest is a control of our hosting provider, Railway, that we have not independently verified. - Access controls: per-organization scoping enforced in application queries (routes filter by the signed-in user's organization, mostly through shared query helpers, and automated cross-tenant isolation tests cover the main routes; the database itself does not enforce tenancy, so a route that omits the filter is not protected by it); role-based access control with 5 roles (Owner, Admin, Collaborator, External Advisor and Viewer); session-based authentication with HttpOnly cookies; optional multi-factor authentication via TOTP. - Token rotation: refresh tokens rotate on every use with reuse-attack detection. Compromised token chains automatically invalidate downstream tokens. - Audit logging: significant actions (integration connect/disconnect, data export, account deletion, password changes, AI agent runs, document signature events) are logged with actor identity, IP address, and timestamp. E-signature audit events use a SHA-256 hash chain. - Sub-processor due diligence: each sub-processor is reviewed for security posture and data-processing terms before integration. - Vulnerability management: dependency scanning via Dependabot; security alerts triaged within seven days of disclosure. - Incident response: documented procedure for detection, containment, and notification. We will notify affected customers within 72 hours of a confirmed personal-data breach. We are not currently SOC 2 certified. Formal third-party certification is on our roadmap. We are happy to share our security questionnaire responses upon request — email security@meridianai.fyi.

7. Your Rights

Depending on your jurisdiction (GDPR, CCPA/CPRA, Saudi PDPL, UAE PDPL, and equivalent regimes), you may exercise the following rights: - Access: request a copy of the personal data we hold about you. - Rectification: request correction of inaccurate or incomplete data. - Erasure ("right to be forgotten"): request deletion, subject to legal retention obligations described in Section 9. - Restriction: request that we limit processing in specific circumstances. - Objection: object to processing carried out on the basis of legitimate interests. - Portability: receive your data in a structured, machine-readable format and transmit it to another controller. - Withdraw consent: where processing relies on consent. - Complaint: lodge a complaint with your local supervisory authority (EU: your national DPA; California: Office of the Attorney General; Saudi Arabia: SDAIA; UAE: respective DIFC/ADGM/federal authority). To exercise any right, email privacy@meridianai.fyi with sufficient information to verify your identity. We respond within 30 days. Verification is required to prevent unauthorized disclosure. You can download a JSON export of your data at any time via Settings → Security → Export My Data. It covers your profile, the deals you created and their stakeholders, the metadata of the documents you uploaded (name, type, size, status and tags; the files themselves are not included), your messages and AI chat history, notifications, and your audit-log entries; for anything else, or for an organization-wide export, email privacy@meridianai.fyi. You can close your account at any time via Settings → Security; see Section 9 for what happens to your data.

8. Cookies and Tracking

We use the following cookies and similar technologies: - Strictly necessary (cannot be disabled): authentication session cookie, CSRF protection token, security cookies. - Strictly necessary, temporary: state cookies set while you connect an integration (expire after about 10 minutes), and an access cookie for the password-protected documentation area. - Preferences (browser local storage, not cookies): language, theme, dashboard layout. Clearing your browser storage resets them; the platform remains functional. - Product-usage identifiers (browser storage, not cookies): while you are signed in, the platform keeps a random per-browser identifier in local storage and a per-visit identifier in session storage, sent with the product-usage events described in Section 2. Clearing your browser storage resets them. - Analytics: Vercel Web Analytics and Speed Insights measure page views and page performance without cookies, and our own product-usage events (Section 2) are stored in our database. We do not use third-party analytics or advertising SDKs that track you across sites (no Google Analytics, no Meta Pixel, no advertising cookies). Because we do not track you across sites or sell personal data, the platform does not currently change its behaviour in response to Do Not Track or Global Privacy Control signals.

9. Data Retention

Automated today. A scheduled clean-up job runs daily at 03:00 UTC: - Deals, contacts, documents, regulatory items, agents, message threads and notifications that you delete are hidden immediately (soft-deleted) and permanently removed from the primary database 90 days after deletion. - Notifications are deleted 180 days after they are created. - Expired password-reset tokens are deleted, and AI chat messages attached to a permanently removed deal are deleted with it. - Files attached to permanently removed documents are not yet deleted from file storage automatically; we remove them on request. Account closure. Closing your account (Settings → Security) takes effect immediately: your credentials, sessions, multi-factor settings, integrations and synced calendar events, notifications, AI chat messages and drafts, preferences and meeting recordings are deleted, and your profile is replaced by an anonymous record. Work you created for your organization (deals, tasks, meetings, documents) stays with the organization, attributed to "Deleted User". Security audit-log entries are kept for security and legal compliance, de-identified: entries you made are detached from your account, with the IP address removed and your name and email replaced, and entries about your account lose their details and IP address. Entries recorded by other users that mention you (for example, the invitation that added you, which records your email address) are not changed. Integrations. When you disconnect Google, Meridian deletes the stored tokens and also asks Google to revoke them (best effort). When you disconnect Microsoft, Meridian deletes the stored tokens only and does not revoke them at Microsoft; to end Meridian's access at Microsoft as well, remove Meridian's consent in your Microsoft account's app permissions. Policy targets (not yet automated). The following are retention targets we have set. No job enforces them yet, so records can remain in our systems beyond these periods until automated deletion is in place. - Deal and content data after your subscription ends: you may export within 30 days, after which we delete it. - Backups: database backups are to be kept for no more than 90 days; deleted data can persist in a backup until that backup is removed. - AI usage and cost records: kept for 12 months for cost attribution, then aggregated. - Billing and tax records: kept for 7 years per US tax law (IRS Publication 583); payment details are held by Stripe. - Audit and security logs: kept for 24 months, then archived for a further 24 months; hash-chained signature audit logs are kept for 7 years for legal admissibility. - Anonymized aggregate metrics: kept indefinitely. You may request earlier deletion at any time, subject to legal-retention exceptions.

10. Children's Privacy

The Meridian AI platform is a business-to-business product not directed to individuals under 18. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact privacy@meridianai.fyi and we will delete it promptly.

11. Changes to This Policy

We may update this policy to reflect changes in our practices, technology, sub-processors, or legal requirements. For material changes: - We will notify account holders via email at least 30 days before the changes take effect. - We will post a notice on the platform. - The "Last Updated" date at the top of this page will reflect the most recent revision. Non-material changes (typos, clarifications, formatting) may be made without notice. The current version always takes effect on the date posted. Historical versions are available upon request.

12. Contact

For privacy questions, requests, or to report a concern: - Privacy questions and data subject requests: privacy@meridianai.fyi - Security disclosures: security@meridianai.fyi - Billing or account questions: support@meridianai.fyi - Legal notices: legal@meridianai.fyi We respond to verified privacy requests within 30 days. Security disclosures receive an acknowledgment within 48 hours.