1 · Scope
This policy explains how Meridian Co. handles personal data when you visit this website, evaluate the product, or use the Meridian observability console. It covers data we hold as a controller. Telemetry that our customers send through the console is handled as a processor, on their instructions, under the data processing agreement described in section 6.
2 · What we collect
- Account data — name, work email, organisation, and role, provided when an account or trial is created.
- Billing data — company details and billing contact. Card details are handled by our payment processor and never reach our systems.
- Product usage — which console features are used, and diagnostic logs needed to operate and secure the Service.
- Support correspondence — messages you send us and our replies.
- Website data — pages requested and coarse request metadata retained in server logs for security and capacity planning.
3 · What we do not do
This website sets no advertising or analytics cookies and loads no third-party trackers, fonts, or scripts. The only value stored in your browser is a theme preference, which stays on your device and is never transmitted to us.
We do not sell personal data, and we do not share it with third parties for their own marketing.
4 · Why we process it
We process account, billing, and usage data to provide the Service and to perform our contract with you. We process security and diagnostic data on the basis of our legitimate interest in keeping the Service available and protected against abuse. Where we send product email that is not strictly necessary, we do so with consent, and every message carries a one-click unsubscribe.
5 · Retention
Account data is kept for the life of the account and for one year afterwards. Billing records are kept for seven years where tax law requires it. Server and diagnostic logs are kept for ninety days. Customer telemetry is retained for the period stated in the applicable plan, and is deleted from active systems within thirty days of account closure and from backups within a further ninety.
6 · Processing customer telemetry
Where our customers send telemetry that contains personal data, they are the controller and we act on their documented instructions under a data processing agreement. That agreement covers sub-processors, security measures, breach notification, international transfer safeguards, and assistance with data subject requests. A current list of sub-processors is available on request, and customers are notified before a new one is engaged.
7 · Security
- Data is encrypted in transit and at rest.
- Access to production systems requires strong authentication and is limited to staff who need it.
- Administrative access is logged, and the audit log is available to customers on plans that include it.
- Our security posture is independently assessed, and the current report is available under NDA.
8 · Your rights
Depending on where you live, you may have the right to access the personal data we hold about you, to correct it, to have it deleted, to restrict or object to processing, and to receive it in a portable form. You may also withdraw consent at any time where processing relies on it.
To exercise any of these rights, contact us using the details in section 10. We will respond within one month. If you are unhappy with our response, you may complain to your local data protection authority.
9 · International transfers
We operate in multiple regions and may transfer personal data across borders. Where data leaves its region of origin, transfers are protected by appropriate safeguards, including standard contractual clauses where applicable. Customers on plans that include custom retention may pin their data to a specific region.
10 · Contact and changes
Privacy questions and rights requests can be sent to the address in the footer of this site, marked for the attention of the data protection contact. If this policy changes materially we will post the revision here and, where the change affects you, notify account holders directly.