Privacy notice

Who is the controller

The controller of your personal data is Athene Holdings OÜ, registry code 14493325, Tartu 50706, Estonia. Privacy questions go to support@meridiarc.com. No data protection officer is appointed, so requests are handled by the operator directly.

What is collected, and why

Account email and name, to identify you and to contact you about the service (performance of the contract). If you sign in with Google, we also store the identifier Google uses for your account: an opaque string that lets us recognise you when you return, and which carries none of the contents of your Google account. An account created that way has no password at all. Authentication and session records, including failed login counts, to keep accounts secure (legitimate interest). Saved charts, watchlists and interface preferences, so the product works as you left it (performance of the contract). Payment records, held by Stripe, to take payment and meet accounting law (contract and legal obligation).

Processors

Stripe Payments Europe processes payments and holds card data. MeridiArc receives only the status of a payment and the last four digits. Resend delivers transactional email and processes the address it is sent to. Google Ireland Limited acts as an identity provider, and only if you choose to sign in with Google: Google confirms to us that the address is yours and gives us your name, and Google learns that you use MeridiArc. Signing in with an email address and a password involves Google in nothing. Functional Software, Inc. (Sentry) receives browser and server error reports through its European region, and only what an error carries: the fault, the page and the browser version. The application itself runs on a virtual private server rented by Athene Holdings OÜ.

Processors act on documented instructions under Article 28 agreements.

How long it is kept

Account data is deleted when you delete the account. Payment and invoice records are kept for seven years, as Estonian accounting law requires. Session and security logs are kept only as long as they are needed to investigate abuse.

Your rights

You may request access to your data, correction of it, erasure, a portable copy, restriction of processing, and you may object to processing based on legitimate interest. Write to support@meridiarc.com and the request is answered within one month.

Cookies and session storage

Necessary. MeridiArc sets one cookie, meridian_session, which keeps you signed in and lasts thirty days at most. Your theme, layout and chart preferences are stored in the browser itself and never leave the device. Neither can be switched off, because without them there is no sign-in and no saved workspace. Neither is used to recognise you on any other site.

Analytics. Nothing beyond the necessary is collected today, and no advertising or cross-site tracking cookie is set. Measuring which pages help and which do not is the ordinary next step for a product this size, so we ask before rather than after: the banner offers Accept and Reject as two choices of equal weight, and analytics stay off unless you accept. Closing the banner is not consent, and neither is carrying on reading. If a tool is ever introduced it is named here, and the question is put again whenever what would be collected changes.

Error monitoring. When the site fails in your browser, Sentry receives the error, the page it happened on and the browser version. It sets no cookie, records no session replay, and is configured to send no personal identifiers. This runs on our legitimate interest in keeping the service working rather than on consent, so it is not behind the banner. You may object to it under your rights.

Changing your answer. Cookie settings, in the footer of every public page and in the account menu inside the app, reopens the banner. Rejecting takes effect immediately, and withdrawing is exactly as easy as accepting.

International transfers

Data is processed inside the European Economic Area wherever possible. Where a processor transfers data outside it, the transfer relies on the European Commission's standard contractual clauses.

Complaints

You may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, Tallinn, or to the supervisory authority of your own country.

Changes to this notice

Changes are published on this page with a new date at the top, and material changes are emailed to the address on your account.