Privacy Notice

1. Who controls your data

Meridian, a Birdsight.io company, is the controller of personal data processed to provide Meridian BIA. This means we decide why and how that personal data is used.

2. Data we collect

• Account data: name, email address, password credentials in protected form, job title and company.
• Service content: departments, application names, owners, descriptions, dependencies, business-impact assessments, risk scores and reports you choose to store.
• Support data: messages, feedback and information you provide when seeking help.
• Technical and usage data: IP address, browser and device information, timestamps, security events, feature interactions, error and diagnostic information.
• Preference data: theme, tutorial completion and similar settings stored in your browser or account.

3. Why we use it and our legal bases

• To create your account, provide, synchronise and support the service, and manage your subscription under our contract with you.
• To protect accounts, prevent fraud, diagnose faults and improve the service based on our legitimate interests in operating a secure and useful product.
• To comply with tax, accounting, legal and regulatory duties where processing is required by law.
• To send optional marketing communications only where we have consent or another lawful basis. You may opt out at any time.

4. AI-assisted assessments

When you request an AI suggestion, relevant application details and assessment context are sent to our AI service provider to generate the draft. Do not include unnecessary personal, confidential or sensitive information in prompts or application descriptions. AI suggestions are not saved to the register unless you choose to apply and save them.

5. Who receives data

We share data only as needed with service providers supporting cloud hosting, authentication, AI processing, security, diagnostics and customer support; professional advisers such as lawyers and accountants; and authorities where law requires it. Paddle acts as Merchant of Record and independently handles purchase, subscription, payment, tax and invoice information. See Paddle's own privacy notice for its processing.

We do not sell your personal data.

6. International transfers

Some providers may process data outside the United Kingdom or European Economic Area. Where required, we use recognised safeguards such as adequacy decisions or approved standard contractual clauses.

7. Retention

We keep account and service data while your account is active and for a reasonable period afterwards to meet backup, security, dispute and legal obligations. Payment and accounting records may be retained for legally required periods. When data is no longer needed, we delete or anonymise it. You can delete your register from your profile; residual encrypted backups expire through normal backup cycles.

8. Security

We use appropriate technical and organisational safeguards, including encryption in transit, access controls, account authentication and restricted access to production systems. No online service can guarantee absolute security, so you should use a strong, unique password and protect access to your account.

9. Cookies and local storage

Meridian uses essential browser storage and similar technologies for sign-in, security, theme preferences, tutorial status and core service operation. These are necessary to provide features you request. We do not currently use marketing cookies. If optional analytics or marketing cookies are introduced, we will provide controls and request consent where required. You can clear stored data through your browser, although doing so may sign you out or reset preferences.

10. Your rights

Depending on where you live, you may have rights to access, correct, erase, restrict or object to processing; receive portable data; withdraw consent; and complain to your local data-protection authority. UK and EEA requests are ordinarily answered within one month, subject to lawful extensions. Some information may be retained where the law requires it or a legal exception applies.

Use Meridian's published support channel to make a privacy request. We may need to verify your identity before acting on it.

11. Changes to this notice

We may update this notice when our service or legal obligations change. The date above shows the latest revision. We will provide reasonable notice of material changes where appropriate.