Meridian

Data Processing Agreement

Last updated: July 2026 · Applies to EU/EEA users

Meridian stores your work-log data locally in your browser and has no server-side database of user accounts. This Data Processing Agreement (DPA) describes the limited processing that does occur (through the optional Google Sheets connection, AI assistant, and paid plan checkout) for users in the EU/EEA where GDPR applies.

1. Parties

Data Controller: You, the individual using Meridian to process your own work data.
Data Processor: Meridian ("we", "us"), insofar as any personal data is processed through the optional features described below.

2. Subject Matter and Duration

We process personal data solely to provide the specific Meridian feature you use, as described in our Terms of Service and Privacy Policy. Processing is transient: it lasts only as long as needed to fulfil the request (e.g. fetching a sheet, generating an AI reply, verifying a payment), since we do not retain a persistent record of it afterward.

3. Nature and Purpose of Processing

Category	Data Type	Purpose
Google Sheets data	Work-log rows (dates, projects, hours, tasks) from a sheet you connect	Displaying your data and generating reports
Google OAuth token	Read-only Sheets access token	Fetching your sheet data on request, stored only as an encrypted cookie in your own browser
AI chat input	Your question and aggregate stats already visible on screen	Generating an AI-written response via Anthropic's Claude API
Payment confirmation	Razorpay order ID, payment ID, and signature (no card or other payment details)	Verifying a Monthly/Annual plan payment so the browser that paid unlocks AI features

4. Our Obligations as Data Processor

Where we do process personal data under this DPA, we commit to:

Process personal data only on your documented instructions, i.e., to provide the feature you actively used.
Not retain your work-log content, AI chat questions, or Google Sheets data on our servers beyond the request needed to serve it.
Implement reasonable technical measures: encrypted transport (TLS) for all requests, and encrypted, httpOnly storage of the Google OAuth token.
Notify affected users without undue delay if we become aware of a personal data breach affecting data we process.
Assist you, where technically feasible, with data subject requests such as access or deletion.

5. Sub-processors

The following third parties may process data as part of the features you use. All are established providers with their own privacy and security commitments:

Sub-processor	Purpose	Notes
Google	Sheets data access (only if you connect a sheet)	You control access and can revoke it at any time
Anthropic	AI assistant responses (Claude API)	Data is not used to train Anthropic's models
Razorpay	Payment processing (Monthly/Annual plan)	PCI-DSS compliant; we never see card or other payment details
Vercel	Application hosting and serverless functions	Serves the app and the endpoints above

We will update this list if a new sub-processor is introduced. You may raise questions or objections at privacy@meridian.app.

6. International Data Transfers

Anthropic processes AI chat requests in the United States. Where required, this transfer relies on Standard Contractual Clauses (SCCs) as the lawful transfer mechanism. See Anthropic's privacy policy for details.

7. Security Measures

TLS encryption for all data in transit between your browser and our serverless backend.
The Google OAuth token is stored as an encrypted, httpOnly, browser-only cookie, never written to a database.
No persistent server-side database of user work-log content, chat history, or account profiles exists to be breached.
Access to the hosting and API provider accounts is restricted to the developer operating Meridian.

8. Your Rights as Data Controller

Since most Meridian data lives in your own browser, you retain direct control over it. You may at any time:

View, export (CSV/PDF), or delete your locally stored data via Settings → Danger Zone.
Revoke Google's access from Settings or from your Google Account permissions page.
Request confirmation of any data we may hold that isn't described above by emailing privacy@meridian.app.

9. Governing Law

This DPA is governed by the laws of India for matters concerning our obligations as processor, and by the GDPR (Regulation (EU) 2016/679) for matters concerning the rights of EU/EEA data subjects.

10. Contact

For DPA-related enquiries: privacy@meridian.app.