Privacy Policy

Meridiaan is the controller of the personal data collected through this website and the service of the same name.

For any privacy-related request you can contact us at privacy@meridiaan.io.

We collect only the data strictly necessary to provide the service:

Registration data: name, email address, and password (hashed) provided when creating an account.

Usage data: requests made to the MCP server, timestamps, Workspace and Document identifiers. Used to count the quotas included in your plan and to detect anomalies.

Technical and diagnostic data: IP address, browser type, and operating system, collected automatically in system logs for security and diagnostics. This also covers the malfunction events collected by the site: which operation failed, on which page, with what outcome, the identifiers of the organization and Workspace involved and, when you are signed in, an internal identifier for your account. **Not your email address**: that identifier alone does not say who you are, and reaching you from it means opening the account records. We do not collect the text of your content. This data serves to reconstruct a fault and to tell it apart from an attempted abuse, and is held in Application Insights, the Microsoft Azure diagnostics service, on a resource of our own inside the European Union.

Data from failed sign-in attempts: when a sign-in is refused we record the IP address the request comes from and the email address entered in the attempt, as it was typed and without verifying it. This data serves only the security of access, that is telling a typo apart from someone repeatedly trying to get in, and not to analyse your behaviour. It is held in Application Insights, on a resource of our own inside the European Union, and deleted within 90 days.

Payment data: if you buy a paid plan, payment happens on Paddle, which collects your billing details and payment method directly. We never see or store your card details: from Paddle we receive only the subscription and customer identifiers and the status of the subscription, which we need to apply the plan to your organization.

Data submitted through the contact form: name, email address, and message text you send us from the Contact page. Used solely to reply to you.

We do not collect sensitive data and we do not profile users for advertising purposes.

Processing is based on the performance of a contract (Art. 6(1)(b) GDPR) for the data needed to provide the service, including the subscription data received from Paddle, and on legitimate interest (Art. 6(1)(f) GDPR) for technical security and diagnostic data and for data submitted through the contact form, processed in order to respond to the requests received.

Account data is retained for the entire duration of the contractual relationship and deleted straight away when you delete your account, unless a longer period is required by law. What remains is the organization's usage counters, which carry only identifiers and neither your name nor your address, and the content you wrote in other people's Workspaces, which stays with them with an unknown author. Payment receipts stay with Paddle. Technical logs are deleted within 90 days. Messages sent through the contact form are retained for as long as needed to handle the request and in any case no longer than 24 months.

We do not sell or transfer your data to third parties. We use cloud infrastructure providers (hosting, database, diagnostics) that process data as processors under GDPR-compliant agreements. These include Microsoft Ireland Operations Ltd., which hosts the service and collects diagnostic data through Application Insights on resources located inside the European Union. Usage statistics are collected through Simple Analytics (Netherlands), which sets no cookies, does not fingerprint visitors and keeps the data inside the European Union; the addresses of pages inside the signed-in area reach it with their identifying parts replaced by an asterisk, so it does not receive which Workspaces or which Documents you opened. Payments for paid plans are handled by Paddle.com Market Limited (United Kingdom), acting as reseller (Merchant of Record): it concludes the purchase contract with you, issues the tax documents and processes payment and billing data as an independent controller, under its own privacy notice. The contact form is handled by Formspree Inc. (United States), which receives the data submitted through the form as a processor, for the sole purpose of delivering the message to us. An up-to-date list of sub-processors is available on request.

Some providers may process data outside the European Economic Area; these include Formspree Inc., based in the United States, for data submitted through the contact form, and Paddle, based in the United Kingdom, for payment data. The United Kingdom is recognised by the European Commission as providing an adequate level of protection. In the other cases we rely on the Standard Contractual Clauses approved by the European Commission, or on providers certified under equivalent frameworks.

You have the right to:

Access: obtain confirmation of processing and a copy of your data.

Rectification: correct inaccurate or incomplete data.

Erasure: delete your account at any time from your User page, or request deletion of your data ("right to be forgotten"), subject to legal obligations. Deletion from the interface is immediate.

Restriction: request suspension of processing in certain cases.

Portability: receive your data in a machine-readable format.

Objection: object to processing based on legitimate interest.

To exercise these rights, write to privacy@meridiaan.io. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).

We use only technical cookies necessary for the operation of the service (session management). We do not use profiling or third-party tracking cookies. For more details, see our Cookie Policy.

We may update this policy to reflect changes in the service or in applicable law. In the event of material changes we will notify you by email or with a prominent notice within the product. The date of the last revision is shown at the bottom.