Meridian Semantic Privacy Policy

Last updated: [PLACEHOLDER: effective date]

This policy explains what information [PLACEHOLDER: legal entity name] ("Meridian", "we", "us") collects when you use the Meridian Semantic service at app.meridiansemantic.com and our related websites (together, the "Service"), how we use it, who we share it with, and the choices you have.

Meridian is a business-to-business product. Our customers are companies and software teams, and most of the information we handle arrives because a customer connected their tools (such as GitHub or Slack) to a Meridian workspace. This policy is written with that in mind: it distinguishes between the information Meridian decides how to use (where we act as a data controller) and the information we process only on our customers' instructions (where we act as a data processor or service provider).

1. Who we are

Meridian Semantic is a deployment-intelligence platform: it shows engineering and product teams what is deployed where, and what changed, by ingesting deployment, release, pull-request, and commit activity from the tools they already use, and layering plain-language AI summaries, changelogs, and a chat assistant on top.

The Service is operated by [PLACEHOLDER: legal entity name], a company incorporated in [PLACEHOLDER: state of incorporation], with its registered address at [PLACEHOLDER: registered address].

For privacy questions, contact [email protected]. [PLACEHOLDER: EU/UK representative — insert Article 27 representative details, or delete this sentence if not required.]

2. Our two roles: controller and processor

Meridian as controller. For account data (your name, email address, sign-in credentials, workspace membership and role), billing and contact information, and usage, security, and log data about how the Service is used, Meridian determines the purposes and means of processing and acts as the data controller.

Meridian as processor. For "Customer Content" — the repository metadata, deployment data, and related material a customer's workspace ingests or uploads (described in Section 3.2) — the customer is the controller and Meridian processes it only to provide the Service under our agreement with the customer. This includes personal data that appears inside Customer Content, such as the names, usernames, and email addresses of software contributors who may not themselves be Meridian users. If you believe your personal data appears in a customer's workspace and you want it accessed, corrected, or deleted, the customer that operates that workspace is the primary point of contact; we will support them in responding (see Section 10.3).

A Data Processing Addendum governing our processor role is available at [PLACEHOLDER: DPA link].

3. Information we collect

3.1 Account data

When you or your workspace admin create your account, and as you use the Service, we collect:

Profile information: your name, email address, and (optionally) an avatar image URL and external-service handles such as a GitHub username or Slack user ID.
Sign-in data: if you sign in with Google, we receive your Google account's basic profile (name, email address, profile picture URL) under the email and profile scopes, along with the stable identifier Google assigns to your account. If you use a password, we store it only as a salted bcrypt hash — we cannot read your password.
Workspace membership: which workspace(s) you belong to, your role in each (admin, deployer, approver, or viewer), and invitation records (including the email address an invitation was sent to).
Preferences: UI settings such as theme and timezone.

3.2 Workspace content (Customer Content)

When a customer connects integrations or uses the API, Meridian stores content on the customer's behalf. Meridian is built around repository metadata — it does not clone customer repositories, and the data it ingests from GitHub does not include source-code file contents or diffs. Workspace content includes:

From GitHub (via the customer-installed GitHub App): repository names and descriptions, branch names, commit SHAs and full commit messages, commit author handles and email addresses, pull-request titles and descriptions, change-size counts, labels, release tags and release notes, CI workflow-run and deployment status data. Note that commit and pull-request records naturally include personal data of the customer's contributors (names, usernames, email addresses), including people who have no Meridian account.
From the deploy-sync API: deployment records (project, environment, version, status, actor handle) that the customer's own CI pushes to us.
Codebase knowledge graphs (optional): customers may run an open-source analyzer in their own CI — using their own compute and their own AI-provider credentials, so the analyzer does not transmit their source code to Meridian — and upload the resulting knowledge graph (file paths, component summaries, and relationships) to their workspace via the API. The contents of that upload are produced and controlled by the customer's tooling; customers should ensure their pipeline does not include material they do not want stored in Meridian.
AI-generated and conversational content: changelogs, summaries, and feature pages Meridian generates from the data above, plus the questions users ask Meridian's chat assistant and the answers it gives.
Workspace configuration: project and environment definitions, team names, feature-flag states, notification settings, and similar operational configuration.

3.3 Integration credentials

To operate integrations, we handle certain credentials:

Slack: when a customer connects Slack, we store the workspace's bot token and signing secret, encrypted at the database-column level.
GitHub: we do not store per-installation GitHub access tokens; short-lived tokens are generated on demand for each API interaction and are not persisted. The GitHub OAuth token used during the connection flow is used once for verification and discarded.
Meridian API keys: API keys you create are stored only as SHA-256 hashes (plus a short display prefix); we cannot recover a full key after it is shown to you once.

3.4 Payment data

The Service currently does not collect payment card information. When paid plans launch, payments will be processed by Stripe, a third-party payment processor: your card details will be provided directly to Stripe and will not be stored on Meridian's systems. We expect to store only billing-related records such as your plan, a Stripe customer reference, subscription status, and invoicing contact details. Stripe's processing is described in its own privacy policy.

3.5 Usage and log data

When you use the Service, we automatically collect:

Session and device data: IP address, browser user-agent string, and sign-in/session timestamps.
Request logs: structured server logs of requests, tagged with workspace and user identifiers, used for operations and troubleshooting. Sensitive request parameters (passwords, tokens, email fields, and similar) are filtered from logs.
Audit logs: a security audit trail of privileged actions in a workspace (for example, member invitations and deploy approvals), including the acting user, action, timestamp, IP address, and user agent. Workspace admins can view their own workspace's audit log.
Error reports: if an error occurs, technical details (stack traces and request context) are sent to our error-tracking provider, tagged with pseudonymous account and user IDs; our configuration disables the provider's default collection of personal information.
AI usage telemetry: for each AI feature invocation we record the model used, token counts, estimated cost, latency, and error status — not the prompt or response text (chat conversations themselves are stored as workspace content per Section 3.2).

3.6 Cookies

We use only cookies necessary to operate the Service:

A session cookie that keeps you signed in. It is a signed, HTTP-only, secure cookie referencing a server-side session record that expires after 30 days.
A transient application cookie used for security functions (such as protection against request forgery) and short-lived flows like accepting an invitation.

We do not use advertising cookies, and the app does not embed third-party analytics or tracking SDKs.

4. How we use information

We use the information described above to:

Provide and operate the Service — authenticate you, maintain your workspace, ingest and display your team's deployment data, deliver notifications, and respond to API requests.
Provide AI features — generate changelogs, summaries, feature pages, and chat answers from your workspace's ingested metadata (these features currently run without sending your data to any third-party AI provider — see Section 6).
Secure the Service — detect and prevent abuse, enforce rate limits, maintain audit trails, and investigate security incidents.
Support you — respond to questions and troubleshoot problems.
Bill customers — administer plans, meter usage of AI features, and (once paid plans launch) process subscription payments through our payment processor.
Improve the Service — understand aggregate usage and reliability through our own logs and error reports.
Communicate with you — send transactional messages such as invitations, security notices, and service updates.
Comply with law — meet legal, accounting, and regulatory obligations.

We do not sell your personal information, and we do not share it with third parties for their own purposes or for advertising. We do not use Customer Content to advertise to anyone, and we do not use your data — or allow anyone else to use it — to train AI models. The only third parties that process your data are the infrastructure subprocessors listed at /legal/subprocessors, and they may process it solely to run the Service on our instructions. Meridian's AI features do not currently send your data to any third-party AI provider.

5. Legal bases (EEA/UK)

Where the GDPR or UK GDPR applies and Meridian acts as controller, we rely on:

Performance of a contract — to provide the Service you or your organization signed up for, including account creation, authentication, and support.
Legitimate interests — to secure the Service (session records, audit and request logs, abuse prevention), to operate and improve it (error tracking, aggregate usage measurement), and to communicate with business customers, balanced against your rights and interests.
Consent — where required, for example for optional communications; you can withdraw consent at any time.
Legal obligation — where we must retain or disclose information to comply with law.

Where Meridian acts as processor for Customer Content, the customer is responsible for establishing the legal basis for the personal data it brings into the Service (including its contributors' data in ingested Git metadata).

6. How we share information; subprocessors

We share personal data only as described here. We maintain a current list of our subprocessors — the vendors that process customer data on our behalf — at /legal/subprocessors, including each vendor's role and processing location, and we update that page when the list changes.

Hosting and infrastructure. The Service runs on Fly.io in the United States, which hosts our application and database (all Service data at rest). Cloudflare provides DNS, TLS, and network proxying for traffic to the Service.
AI features. Meridian's AI-assisted features (changelogs, summaries, feature pages, and the chat assistant) do not currently send your data to any third-party AI provider; no AI vendor appears on our subprocessor list. If we engage a third-party AI provider in the future, we will list it as a subprocessor and give advance notice before it begins processing your data, and we will never send it your repository source code.
Error tracking. Sentry receives error reports as described in Section 3.5.
Payment processing. Once paid plans launch, Stripe will process payments as described in Section 3.4.
Email delivery. We will use a transactional email provider to deliver invitations and account notices; the provider in use is listed on the subprocessor page. [PLACEHOLDER: no email provider is wired up in production today (Resend is the planned vendor) — confirm the live provider and this sentence's tense at publication.]
Services you connect. When your workspace connects GitHub or Slack, data flows to and from those platforms at your direction — for example, deploy notifications posted to your Slack channel contain project names, environments, short commit SHAs, statuses, and actor handles. Your use of those platforms is governed by their terms and privacy policies.
Your workspace. Information you contribute to a workspace (your profile, activity, chat questions, approvals) is visible to other members of that workspace according to their roles.
Legal and safety. We may disclose information if we believe in good faith it is required by law or legal process, or necessary to protect the rights, safety, or property of Meridian, our customers, or others. Where legally permitted, we will notify the affected customer before disclosing Customer Content in response to legal process.
Corporate transactions. If Meridian is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction; this policy will continue to apply until it is amended per Section 12.

7. International transfers

Meridian processes and stores data in the United States. If you use the Service from outside the US, your information will be transferred to and processed in the US and in other locations where our subprocessors operate.

For personal data originating in the EEA, UK, or Switzerland, we commit to relying on appropriate safeguards recognized under applicable law — including the European Commission's Standard Contractual Clauses (and the UK Addendum or IDTA, as applicable), which we will incorporate into our Data Processing Addendum and require of relevant subprocessors.

8. Retention and deletion

We keep personal data only as long as needed for the purposes above, and we are transparent that today several deletion processes are handled by our team on request rather than through self-serve controls:

Account and workspace deletion. The Service does not yet offer a self-serve "delete my account" or "delete this workspace" button. To have a user account or an entire workspace and its Customer Content deleted, the workspace admin (for workspace data) or the individual user (for their own account) should email [email protected]; we will verify the request and carry out the deletion. [PLACEHOLDER: retention schedule — confirm target turnaround, proposed: within 30 days of a verified request.]
Disconnecting integrations. Disconnecting GitHub or Slack stops new data from flowing but does not by itself delete previously ingested data or stored integration credentials; historical data remains available in the workspace. If you want ingested data or stored integration credentials deleted after disconnecting, contact us as above.
Repository data. If a connected repository is deleted on GitHub, Meridian deletes its ingested commits, pull requests, and releases automatically.
Sessions. Server-side sessions expire after 30 days; signing out ends the current session immediately.
Audit logs. Audit-trail records are stored in an append-only form as a security control and are retained for the life of the workspace [PLACEHOLDER: retention schedule — confirm whether a maximum audit-log retention period will be adopted]. Where we delete a workspace, we will delete or irreversibly anonymize its audit records as part of the deletion process, subject to any legal hold.
Operational logs and error reports. Request logs and error reports are retained for limited operational periods [PLACEHOLDER: retention schedule — set concrete log and error-report retention windows once confirmed with hosting and error-tracking vendors].
Backups. Deleted data may persist in database backups for a limited period before rolling off [PLACEHOLDER: retention schedule — confirm backup retention window, and backup encryption posture, with hosting vendor].
Billing records. Records we must keep for tax, accounting, or legal compliance are retained as required by law.

Where full deletion of a specific record is not technically practicable in place, we will anonymize it so it no longer identifies you.

9. Security

We take the security of your data seriously. Our security program is designed to align with the SOC 2 Trust Services Criteria, and we are preparing for a SOC 2 Type II audit. Current measures include:

Encryption in transit. All traffic to the Service is encrypted with TLS (minimum TLS 1.2), enforced at every layer.
Credential protection. Passwords are stored as bcrypt hashes; API keys are stored as SHA-256 hashes; stored Slack credentials are encrypted at the database-column level; our own application secrets are stored in encrypted configuration unlocked only at runtime.
Access control. Role-based access within each workspace, tenant isolation enforced in the application's authorization layer, scoped and rate-limited API keys, and admin-only access to sensitive settings and audit logs.
Auditability. An append-only audit trail of privileged workspace actions, enforced at the database level.
Secure development. Automated static security analysis and dependency vulnerability scanning run in our continuous-integration pipeline on every code change, and webhook payloads from integrated services are cryptographically verified.

No system is perfectly secure, and we cannot guarantee absolute security. For a fuller description of our security practices, see app.meridiansemantic.com/security. To report a security concern or suspected vulnerability, contact [email protected]. If we become aware of a breach of security affecting your personal data, we will notify affected customers and authorities as required by applicable law.

10. Your rights

10.1 If you are in the EEA, UK, or Switzerland

Where Meridian is the controller of your personal data, you have the right to request access to your personal data, correction of inaccurate data, deletion, restriction of processing, a portable copy of data you provided, and to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time without affecting prior processing. To exercise these rights, email [email protected]; we will verify your identity and respond within the timeframe required by law. You also have the right to lodge a complaint with your local supervisory authority.

10.2 If you are a California resident

The CCPA/CPRA gives California residents the rights to know what personal information we collect, use, and disclose; to access and obtain a copy of it; to correct inaccurate information; to delete it (subject to exceptions); and to not receive discriminatory treatment for exercising these rights. Meridian does not sell personal information and does not share personal information for cross-context behavioral advertising, and we have no actual knowledge of doing either for consumers under 16. We do not use or disclose sensitive personal information for purposes requiring a right to limit. To exercise your rights, email [email protected]; you may use an authorized agent, in which case we will verify the agent's authority and your identity.

10.3 Data in a customer's workspace

If your personal data appears in Customer Content (for example, your name or email address in commit metadata ingested from a customer's repositories), Meridian processes it on that customer's behalf. Please direct requests to the organization that operates the workspace; if you contact us instead, we will refer your request to that customer and assist them in responding as required by our agreement and applicable law.

11. Children

The Service is a business tool and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a person under 16 has provided personal data to us, contact [email protected] and we will delete it.

12. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify customers by email or an in-product notice before the changes take effect, and we will update the "Last updated" date above. The current version will always be available at app.meridiansemantic.com/legal/privacy.

13. Contact

Privacy questions and rights requests: [email protected]
Security reports: [email protected]
Legal notices: [email protected]

[PLACEHOLDER: legal entity name]
[PLACEHOLDER: registered address]