Privacy Policy

Meridian (meridian.surf) is a trade name of Surf Online, a company registered in the Netherlands (KvK 42127201). In this Privacy Policy, Meridian refers to "we", "us", and "our", which also acts as the data controller for personal data processed through Meridian. This policy explains how and when we collect, use, store, and share that data when you use our services.

We collect information needed to run Meridian, including:

• Basic account data: this contains your display name, username, profile picture, and similar information.
• Data from 3rd party providers: when you link a third-party provider to your account, we receive profile information that the provider shares with us on our request. This includes information such as your user id, username, avatar, and more.
• Bot configurations: flows (commands, events, and functions), bot and account settings, logs metadata, and other content you create with Meridian.
• Payment data: billing contact and subscription metadata processed by our payment provider. We do not store full card numbers or any other sensitive payment information in full.
• Platform analytics: in-house operational metrics such as bot online counts, commands created, commands run, and button clicks. This data is used to improve the performance and usability of the platform and is never shared outside of the company, not even with our Analytics provider.
• Support and email: messages you send us and emails we send to you. This includes information such as your name, email address, and the content of the messages you send to us. This data is used to provide you with support and to communicate with you about your account and the services we offer.

Who is responsible for personal data depends on what you use Meridian for. This section summarizes roles; our DPA covers processor terms for bot end-user data.

3.1 Meridian platform data

For your Meridian account and platform operation, Surf Online is the data controller.

3.2 Data your bots collect

For personal data your bots collect from Discord users (messages, member identifiers, stored variables, transcripts, and similar), you are the controller and Surf Online acts as a processor hosting that data on your instructions. You must provide any notices and obtain any consents required by law for your bots.

3.3 OAuth applications

Third-party applications you authorize through Meridian OAuth are independent controllers. We are not responsible for their processing. See our Developer terms.

4.1 Purposes

We use personal data to:

• Provide, host, and secure the Service.
• Run your bots and store configurations.
• Process payments, subscriptions, wallet balance, and gift cards.
• Send transactional and support messages (account, billing, security, service notices).
• Monitor platform health and aggregate usage trends.
• Detect abuse, fraud, security incidents, and enforce our Terms / Acceptable Use Policy.
• Comply with law and enforce our policies.

4.2 Legal bases (GDPR Article 6)

Where the GDPR applies, we process personal data on the bases below. More than one basis may apply to the same activity. If you are a consumer in the EEA, UK, or a jurisdiction with similar rules, you may have rights under the GDPR (or similar applicable law) to object to or restrict certain processing, or to request access to, rectification, or erasure of your personal data.

4.3 Legitimate interests

Where we rely on Art. 6(1)(f), our interests are operating a secure, reliable Discord-bot hosting platform, preventing abuse and fraud, and improving core reliability. We balance these against your rights and expectations; you may object under section 11 where the GDPR allows.

4.4 Consent

Where we rely on consent (non-essential analytics and affiliate attribution), refusing or withdrawing consent does not affect access to core Meridian features that do not depend on that processing. We do not sell personal data and we do not use it for advertising purposes. We are not interested in your personal data for any other purpose either.

We share data only when needed to operate Meridian:

• Subprocessors listed in section 6 who host or process data for us.
• Discord and other platforms your bots connect to, under their policies.
• Legal requests when required by law or to protect rights and safety.
• Business transfers in a merger, acquisition, or asset sale, with notice where required.

We use the following subprocessors to deliver Meridian. Each processes only the data needed for its role:

Subprocessor	Purpose	Location	Data processed
Convex	Backend, database, file storage, and real-time API	United States	Account data, bot configurations, variable definitions and stored values, transcripts, platform logs
Vercel	Frontend hosting and edge delivery	Global	HTTP request metadata, session cookies
Discord	Authentication and bot API	United States	OAuth profile fields, bot runtime data
Railway	Bot runtime hosting for all bots on the platform	United States	Bot tokens, runtime state, Discord gateway traffic, execution logs
Stripe	Payment processing and subscriptions	United States	Billing contact, payment method metadata (not full card numbers)
Cloudflare	CDN, edge, and runner traffic	Global	HTTP metadata, cached assets
Resend	Transactional email	United States	Email address, message content for service emails
PostHog	Analytics	European Union	Usage events, page views, and user id when signed in

We may update this list as our infrastructure changes. Material changes will be communicated according to our Terms of Service.

We are established in the European Union. Some subprocessors process personal data in the United States or other countries outside the EEA/UK (see section 6), as listed. We may transfer personal data to the United States for the purposes of providing the Service to you.

7.1 Safeguards

Where personal data is transferred from the EEA or UK to a country without an adequacy decision, we use appropriate safeguards, including:

1. EU Standard Contractual Clauses (SCCs) under Commission Decision 2021/914, using modules that match the transfer role (typically Module 2 for our vendor contracts and Module 3 where we are processor). UK transfers use the UK IDTA where required.
2. EU–US Data Privacy Framework (and UK Extension where applicable) when a vendor is certified and the framework applies to that flow.
3. Supplementary measures as appropriate, including encryption in transit and at rest, access controls, and contractual security commitments.

7.2 Copies and updates

Relevant SCC sets and transfer details for subprocessors are available on request (see section 15). Our Data Processing Agreement addresses transfers of data we process as a processor for your bots. If a vendor's transfer tool changes, we will update our records and this policy or the subprocessor notice as needed. We may also update this policy to reflect changes in our subprocessors or the laws that apply to them.

We keep personal data only as long as needed for the purposes in section 4, unless law requires a longer period.

8.1 Active accounts

We keep account data while your account is active. When you request deletion from Account → Danger zone, we delete personal data and bot configurations within 7 days after the grace period, unless a longer period is required by law.

8.2 Termination and legal hold

If we terminate your account for abuse or legal reasons, we may retain relevant data for investigations, dispute resolution, or legal hold.

8.3 Short-lived data

Short-lived data (for example interactive message variables) expires automatically on a shorter schedule.

We use technical and organizational measures to protect data. No method of transmission or storage is completely secure.

9.1 Reporting sensitive issues

Sensitive issues (authentication, sessions, billing, account takeover, or exposure of private user or bot data) should be reported through our help center while signed in or through security@meridian.surf. Do not post exploit steps, tokens, or customer data in public channels or on social media.

9.2 General bugs and community feedback

General UI bugs and feature requests may be shared in our Discord server.

9.3 Prohibited testing

Do not run bulk scans, credential stuffing, or denial-of-service tests against production. If you accidentally access data you should not have, stop and report it through security@meridian.surf.

9.4 Security contact and bounties

Send security reports using the contact details in section 15. Qualifying reports may receive a bounty or account credit at our discretion.

Surf Online uses cookies and similar technologies on Meridian (meridian.surf) to operate the Service, keep you signed in, remember preferences, and, only with your consent, measure product usage and attribute referrals.

10.1 What we use

Cookies are small text files stored on your device by your browser. We also use local storage and session storage for similar purposes.

10.2 Strictly necessary cookies

We use strictly necessary cookies and similar storage to keep you signed in, renew your session securely, and support real-time dashboard features. These are required for Meridian to work and do not require consent. Blocking them may prevent you from signing in or using the dashboard. We may also use strictly necessary cookies to operate the Service and for security purposes.

10.3 Functional preferences

We may store preferences such as theme, builder settings, and UI state locally to improve your experience.

10.4 Marketing and attribution

When you arrive through a referral link, we may use a signed attribution cookie with a limited retention period. It is not strictly necessary. We set or read it for attribution only after you consent via our cookie banner or preference center. You can withdraw consent at any time under Account → Privacy & security or the banner preferences.

10.5 Product analytics

Where enabled, we use product analytics to improve user experience. Events are sent through a same-origin proxy on our website and never reach advertising networks. We do not use analytics for advertising, and we do not sell analytics data.

We do not collect product analytics until you opt in. If you allow it, we may collect page views and navigation, product events we define (for example builder and dashboard usage), and errors to diagnose and resolve bugs. We do not run whole-page click autocapture. When you are signed in, events may be linked to Meridian account details we already hold (such as display name, user ID).

• During first account setup, we ask you to allow or decline product analytics before you finish onboarding. If you decline, we store that choice in your browser and do not collect analytics.
• If you have not chosen yet, we show a site notice where you can allow analytics or decline. By default, analytics are turned off. Your choice is stored in your browser (including a functional cookie that allows us to apply this across subdomains).
• You can turn product analytics on or off anytime under Account → Privacy & security.
• We do not use analytics for advertising, and we do not sell analytics data.

10.6 Global Privacy Control and Do Not Track

If your browser sends Global Privacy Control (GPC) or Do Not Track (DNT) signals to our website, we may show different wording in the analytics notice. Those signals do not by themselves enable product analytics. Use the notice, onboarding step, or Account → Privacy & security to allow or decline analytics. We may still use strictly necessary cookies to operate the Service.

10.7 Your choices

Most browsers let you block or delete cookies. Essential cookies are required for core features. For analytics and affiliate attribution, use our cookie banner or Account → Privacy & security. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

11.1 Your rights

Depending on where you live (including the EEA, UK, and California), you may have rights to access, correct, delete, restrict, or port your personal data, and to object to or withdraw consent for certain processing.

11.2 Self-service tools

You can:

• Download a data export from Account → Privacy (data takeout).
• Request account deletion from Account → Danger zone.
• Contact us through section 15 or official support channels for other requests.

11.3 Consent and complaints

You can grant or withdraw consent for product analytics and affiliate attribution from the site cookie banner or under Account → Privacy & security. Where we rely on consent, withdrawing it does not affect prior lawful processing. You may also lodge a complaint with your local supervisory authority.

13.1 Meridian account age

Meridian developer accounts are intended for users who are at least 13 years old, or older if the age of digital consent or contractual capacity in your country is higher. Main dashboard sign-in relies on supported identity providers (for example Discord), which apply their own minimum ages.

13.2 Digital consent in the EEA and UK

In many EEA countries and the UK, the age of digital consent is 16 (some member states set it between 13 and 16). If you are below the age of digital consent where you live, we process your account data only where a valid legal basis applies, such as verifiable consent from a parent or guardian or participation through a qualifying institution (including Meridian Education where your school has invited you).

13.3 Data from children under 13

We do not knowingly collect personal data from anyone under 13 in connection with a Meridian account. If you believe a child under this age provided us account data, contact us promptly and we will delete it as soon as possible.

13.4 Discord end-users

Servers and bots you operate may include younger Discord users. You (as controller of bot end-user data; see section 3) are responsible for any notices, consents, or age-appropriate design required for your bots. Meridian does not verify the ages of Discord members who interact with your bots and we are not responsible for your compliance with COPPA or other applicable laws.

13.5 COPPA (United States)

We do not knowingly collect personal information from children under 13 as defined under the U.S. Children's Online Privacy Protection Act (COPPA). This 13+ floor applies to Meridian accounts globally; the 16+ digital consent rule in section 13.2 is an additional requirement where applicable, not a lower global minimum.

For questions about this Privacy Policy and privacy or data-protection matters, email privacy@surfonline.eu. For product help, email support@meridian.surf. For security reports, email security@meridian.surf.