This Privacy Policy explains how WebKitchen Development Studio Ltd ("WebKitchen", "we", "us", "our"), the makers of Meridian ("Meridian", "the Service"), collect, use, disclose, and protect personal data when you visit our website, sign up for early access, or use the Service. By using Meridian, you agree to the practices described here.
This policy is written to align with the principles of the Nigeria Data Protection Act (NDPA) 2023, the EU General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA), so it applies consistently regardless of where you access Meridian from.
1. Who we are
Meridian is a product of WebKitchen Development Studio Ltd. We are the data controller for personal data processed through the Meridian website and platform, unless you use a bespoke, self-hosted instance — see Section 12.
2. What we collect
We collect the following categories of personal data:
- Account and contact data — name, email address, phone number, billing address, and authentication credentials.
- Calendar and planning data — events, goals, reminders, notes, venture and project labels, travel plans, and relationship/contact entries you create or import into Meridian.
- Payment data — billing tier, transaction history, and limited payment metadata. Full card and bank details are processed directly by our payment processor and are never stored on our servers.
- Communications data — messages you send us via email, WhatsApp, or support channels, and records of reminders we send to you.
- Usage and device data — IP address, browser type, device identifiers, pages visited, and general usage patterns, collected automatically when you use our website or app.
- Third-party integration data — if you connect Google Calendar or other services, we access only the data scopes required to provide that integration.
3. How we use your data
We use personal data to:
- Create and administer your Meridian account and workspace.
- Deliver the core features of the Service — calendar views, reminders, goal tracking, relationship logs, and travel planning.
- Send reminders and notifications via email, in-app messaging, and WhatsApp, where you have enabled those channels.
- Process subscription billing and send invoices or payment notices.
- Provide customer support and respond to your enquiries.
- Power the AI scheduling assistant (Principal tier), which processes natural-language requests you submit to set reminders and events. These requests may be sent to Anthropic's Claude API for processing — see Section 5.
- Maintain security, detect fraud, and prevent abuse of the Service.
- Improve Meridian through aggregated, anonymised analysis of usage patterns.
We do not sell your personal data, and we do not use your data for third-party advertising.
4. Legal basis for processing
Where applicable law requires a legal basis, we rely on one or more of the following: performance of a contract (providing the Service you subscribed to), your consent (for example, enabling WhatsApp reminders or connecting third-party calendars), legitimate interest (security, fraud prevention, service improvement), and compliance with legal obligations (such as tax and billing records).
5. Sharing and disclosure
We do not share personal data with third parties except in the following circumstances:
- Service providers — infrastructure hosting, payment processing, email and WhatsApp delivery providers, and Anthropic (for AI scheduling assistant requests on the Principal tier). These providers are bound by confidentiality and data protection obligations and may only use your data to provide the relevant service to us.
- Legal compliance — where required to comply with a legal obligation, court order, or lawful request from a regulatory authority.
- Business transfers — if WebKitchen is involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, subject to equivalent privacy protections.
- With your direction — where you explicitly request or consent to a disclosure (for example, sharing calendar data with a third-party integration you authorise).
6. International data transfers
Meridian's infrastructure may process or store data outside Nigeria. Where personal data is transferred internationally, we take reasonable steps — including contractual safeguards with our infrastructure and service providers — to ensure it receives a level of protection consistent with this policy and applicable data protection law.
7. Data retention
We retain personal data for as long as your account is active, and for a reasonable period afterward to comply with legal, accounting, and tax obligations, resolve disputes, and enforce our agreements. When you close your account, we delete or anonymise personal data within 90 days, except where retention is required by law.
8. Security
We apply industry-standard safeguards to protect personal data, including encryption in transit, access controls, rate-limited authentication, session protections, and routine security review of the platform. No system is completely secure, and we cannot guarantee absolute security, but we work to minimise risk and respond promptly to any suspected breach.
9. Your rights
Depending on your jurisdiction, you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Request deletion of your data, subject to legal retention requirements.
- Object to or restrict certain processing, including direct marketing.
- Request a portable export of your data in a structured, machine-readable format.
- Withdraw consent at any time where processing is based on consent (for example, disabling WhatsApp reminders).
- Lodge a complaint with your local data protection authority.
To exercise any of these rights, contact us at privacy@webkitchen.dev. We will respond within 30 days.
10. Cookies and tracking
Our marketing website uses minimal, essential cookies to remember basic preferences and to understand aggregate visitor traffic. We do not use third-party advertising trackers. The Meridian application itself uses session cookies necessary to keep you securely logged in.
11. Children's privacy
Meridian is intended for business and professional use by adults. We do not knowingly collect personal data from anyone under the age of 18. If we become aware that we have done so, we will delete that data promptly.
12. Bespoke instances
For clients on a bespoke, self-hosted Meridian instance, data ownership and processing responsibility sits with the client as data controller on their own infrastructure. WebKitchen acts as a data processor only to the extent we provide development, hosting setup, or support services under a separate agreement with that client.
13. Changes to this policy
We may update this policy from time to time to reflect changes in our practices or legal requirements. Material changes will be communicated by email or in-app notice before they take effect. The "Last updated" date at the top of this page always reflects the current version.
14. Contact us
For any privacy questions, requests, or concerns, contact us at privacy@webkitchen.dev or hello@webkitchen.dev.