Privacy Policy

VeraTenet LLC d/b/a Meridian Edge  |  Effective Date: March 1, 2026  |  Version 2.0

VeraTenet LLC ("Company," "we," "our," or "us") operates the Meridian Edge platform and related services. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Services.

By using our Services, you consent to the collection and use of your information as described in this Privacy Policy. If you do not agree with this Policy, please do not use our Services.

Section 1 — Information We Collect

We collect the following categories of information:

Section 2 — Information We Do NOT Collect

Section 3 — How We Use Your Information

We use the information we collect to:

• Create and manage your account and API access
• Process payments and manage your subscription
• Provide, maintain, and improve the Services
• Send transactional communications (account confirmations, billing receipts, API key delivery)
• Send service-related announcements and updates
• Monitor and enforce our Terms of Service and API usage limits
• Detect, prevent, and investigate fraud, abuse, or security incidents
• Comply with legal obligations and respond to lawful requests
• Analyze aggregate usage patterns to improve the Services

We do not sell your personal information to third parties for their marketing purposes.

Section 4 — Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), United Kingdom, or other jurisdictions with similar requirements, our legal bases for processing personal information include:

• Contract performance: Processing necessary to provide the Services you have subscribed to
• Legitimate interests: Security monitoring, fraud prevention, service improvement, and aggregate analytics
• Legal compliance: Processing required to fulfill legal obligations
• Consent: Where you have expressly provided consent, such as for marketing communications

Section 5 — Information Sharing and Disclosure

We share your personal information only in the following circumstances:

5.1 Service Providers

We share information with a limited number of third-party service providers who assist us in operating the Services. Our current service providers with access to personal data are:

These service providers are contractually obligated to use your information only as necessary to provide their services to us and in accordance with applicable privacy laws.

5.2 Legal Requirements

We may disclose your information if required to do so by law, regulation, or legal process, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of VeraTenet LLC, our users, or the public.

5.3 Business Transfers

If VeraTenet LLC is involved in a merger, acquisition, or sale of all or a portion of its assets, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice on the Services prior to your information being subject to a different privacy policy.

5.4 With Your Consent

We may share your information with third parties when you have given us explicit consent to do so.

Section 6 — Data Retention

We retain your personal information for as long as necessary to provide the Services, fulfill the purposes described in this Policy, and comply with legal obligations. Specifically:

• Account data: Retained for the duration of your account plus 7 years after account closure (for legal and tax compliance)
• API access logs: Retained for 12 months for security and audit purposes
• Payment records: Retained for 7 years as required by tax and accounting regulations
• Communications: Retained for 3 years after last contact

Section 7 — Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS 1.2 or higher
• Encryption of sensitive data at rest
• Use of AWS Secrets Manager for credential storage (no plaintext credentials in code)
• Access controls limiting data access to authorized personnel on a need-to-know basis
• Regular security reviews and monitoring

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security.

Section 8 — Cookies and Tracking Technologies

We use essential cookies and similar technologies to operate the Services. These include:

• Session cookies: Necessary for authentication and maintaining your session
• Security cookies: Used to detect and prevent fraudulent activity
• Preference cookies: Remember your settings and preferences

We do not use advertising cookies or third-party tracking pixels. You may configure your browser to refuse cookies, but this may affect the functionality of the Services.

Section 9 — Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information:

9.1 Rights for All Users

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate personal information
• Deletion: Request deletion of your personal information (subject to legal retention requirements)
• Portability: Request your data in a portable, machine-readable format
• Opt-out: Unsubscribe from non-transactional marketing communications at any time

9.2 California Residents — Your Rights Under CCPA/CPRA

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides you with specific rights regarding your personal information. VeraTenet LLC does not sell or share personal information as defined under California law.

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, our business purpose for collecting it, and any third parties with whom we share it.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions (e.g., completing a transaction, legal compliance).
• Right to Correct: You may request correction of inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale or Sharing: You may opt out of the "sale" or "sharing" of your personal information. We do not sell or share personal information as defined under CCPA/CPRA.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights. We will not deny you services, charge different prices, or provide a different level of service because you exercised these rights.
• Right to Limit Use of Sensitive Personal Information: We do not collect sensitive personal information as defined by CPRA (e.g., Social Security numbers, precise geolocation, financial account numbers).

To exercise any of these rights, contact us at [email protected] with subject line "California Privacy Request." We will respond within 45 days as required by CCPA. We may need to verify your identity before fulfilling your request.

9.3 EEA, UK, and Swiss Residents (GDPR / UK GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have additional rights under the GDPR or UK GDPR, including the right to object to processing based on legitimate interests, the right to restrict processing, and the right to lodge a complaint with your local data protection authority. To exercise these rights, contact us at [email protected].

Section 10 — International Data Transfers

Our Services are operated from the United States. If you access the Services from outside the United States, your information may be transferred to, stored, and processed in the United States where our servers are located and our central database is operated. Data protection laws in the United States may differ from those in your country.

For transfers from the EEA, UK, or Switzerland, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission and the UK Information Commissioner's Office, where applicable.

Section 11 — Children's Privacy

The Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have inadvertently collected personal information from a child under 18, we will take prompt steps to delete such information. If you believe we have collected information from a child under 18, please contact us immediately at [email protected].

Section 12 — Changes to This Policy and Contact

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page with an updated effective date and, where appropriate, by sending you an email notification. Your continued use of the Services after any changes constitutes your acceptance of the updated Policy.