Meridian Intelligence LLC

1. Company Information

2. Information We Collect

2.1 Financial Data (via Plaid)

We collect the following consumer financial data through Plaid's API:

• Bank account information: institution name, account type, last 4 digits of account number
• Account balances: current and available
• Transaction history: up to 24 months including merchant name, amount, date, and category
• Recurring transaction data: subscriptions and recurring payments
• Investment holdings and balances

2.2 What We Do NOT Collect

• Bank login credentials or passwords
• Full account numbers or routing numbers
• Social Security Numbers or government identification numbers
• Payment card numbers
• Biometric data

2.3 Account and Profile Data

• Name and email address (from Sign In with Apple)
• Industry profile and income goals entered during onboarding
• Tax estimates, transaction categories, and financial scenarios you create

2.4 Device and Usage Data

• Device type and iOS version
• App usage patterns for product improvement only — not sold or shared
• Crash reports and performance diagnostics
• IP address (logged by Supabase infrastructure for security purposes only)

3. Lawful Basis for Processing (GDPR Article 6)

If you are located in the EEA, UK, or Switzerland, we rely on the following legal bases:

4. AI System Disclosure (EU AI Act Transparency)

4.1 Nature of the AI System

• The AI assistant provides informational guidance only — it does not make binding financial decisions on your behalf
• All tax estimates are approximations and should be verified with a qualified professional
• Transaction categorization suggestions can be reviewed and overridden by you at any time
• The AI system does not have access to your raw bank credentials

4.2 Human Oversight

All consequential financial outputs (tax estimates, deduction recommendations, CPA packages) are presented for your review before any action is taken. No AI output is applied automatically without your confirmation.

4.3 Data Used by the AI

When you interact with the AI assistant, your message and a limited window of conversation history are sent to Anthropic's API to generate a response. Your financial data (bank transactions, balances) is NOT sent to Anthropic. Anthropic does not store your data beyond the immediate request per their zero-data retention API agreement.

5. How We Use Your Information

• Deliver AI-powered tax estimates, deduction tracking, and financial guidance
• Auto-import and categorize transactions from connected bank accounts
• Generate quarterly tax payment reminders and financial health scores
• Produce CPA-ready tax preparation packages
• Send notifications about tax deadlines and financial events you have opted into
• Improve app features, fix bugs, and enhance the user experience
• Detect and prevent fraud, security incidents, and abuse

6. Data Retention Schedule

7. Data Deletion

7.1 User-Initiated Deletion

You may request deletion of your account and all associated data at any time:

• In-app: Settings → Delete Account
• Email: systems.meridian@proton.me

Upon a verified deletion request, Meridian will:

• Immediately revoke all Plaid access tokens
• Remove all transaction and balance data from active databases within 7 days
• Purge all remaining data from backup systems within 30 days
• Send written confirmation to your registered email address upon completion

7.2 Account Inactivity

Accounts inactive for 24 consecutive months will be flagged for deletion. You will receive 30 days written notice before deletion is executed.

7.3 Subscription Cancellation

Upon cancellation, Meridian retains your data for 90 days to allow reactivation. After 90 days, all financial data is permanently purged. Account credentials may be retained for up to 12 months.

8. Data Security

• All data stored in Supabase (hosted on AWS) with AES-256 encryption at rest
• All data in transit encrypted using TLS 1.2 or higher
• Plaid access tokens stored server-side only — never transmitted to or stored on user devices
• Row-level security (RLS) policies ensure users can only access their own data
• Administrator access to production systems requires multi-factor authentication (MFA)
• Access to financial data is limited to the minimum necessary for service delivery
• AI API requests authenticated with per-user session tokens and rate-limited to prevent abuse

9. Your Rights

9.1 All Users

9.2 California Residents (CCPA / CPRA)

• Know what personal information we collect, use, and disclose
• Delete your personal information (subject to certain exceptions)
• Opt out of the sale of your personal information — we do not sell data
• Non-discrimination for exercising your privacy rights
• Correct inaccurate personal information

9.3 EEA, UK, and Switzerland Residents (GDPR / UK GDPR)

In addition to the rights above, you have the right to:

• Object to processing based on legitimate interests (Article 21)
• Restrict processing in certain circumstances (Article 18)
• Withdraw consent at any time where processing is based on consent (Article 7)
• Lodge a complaint with your local supervisory authority (e.g., your national Data Protection Authority)
• Not be subject to solely automated decision-making with legal or similarly significant effects (Article 22)

10. Third-Party Data Sharing and Processors

Meridian does not sell, rent, or share your financial data with third parties for marketing or advertising purposes.

11. International Data Transfers

Meridian is a US-based company. Your data is stored on servers in the United States. If you are located in the EEA, UK, or Switzerland, your data will be transferred to and processed in the United States.

We rely on the following transfer mechanisms:

• Standard Contractual Clauses (SCCs) as adopted by the European Commission where applicable
• The EU-US Data Privacy Framework where our processors participate
• Adequacy decisions of the European Commission where available

12. Children's Privacy

Meridian is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are located in the EEA, we do not knowingly collect data from children under 16 without verifiable parental consent. If we become aware that we have collected such information, we will delete it promptly.

13. Regulatory Compliance

This policy is designed to comply with:

• California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)
• Gramm-Leach-Bliley Act (GLBA) — Safeguards Rule
• Federal Trade Commission Act (FTC Act)
• General Data Protection Regulation (GDPR) — EU 2016/679
• UK General Data Protection Regulation (UK GDPR)
• EU AI Act (Regulation EU 2024/1689) — Transparency obligations for limited-risk AI
• Apple App Store Review Guidelines — Section 5 (Privacy)
• Plaid Developer Policy and Data Use Requirements

14. Changes to This Policy

We will review and update this policy at minimum annually, or when significant changes occur to our data processing practices, applicable laws, or third-party integrations. We will notify you of material changes via email or in-app notification at least 30 days before changes take effect.

15. Contact Us