Last updated July 31, 2026
This Privacy Policy explains how Surf Online ("we", "us", or "our") collects, uses, stores, and processes personal data when you visit Citrum marketing pages (citrum.cc) or sign in to a hosted panel on citrum.app.
Citrum is a hosted dashboard product of Surf Online. Surf Online operates under the trade names Meridian and Meridian.surf, and is registered with the Dutch Chamber of Commerce (KvK) under number 42127201. Data controller: Surf Online (KvK 42127201).
When you interact with Citrum, we may collect the following information:
identify scope). This includes your unique Discord user ID, username, and avatar image.guilds scope). This includes the list of Discord servers you are a member of, which is used solely to identify and display the panels you have permissions to manage.For your Citrum authenticated session and platform-level infrastructure logs,Surf Online acts as the data controller.
For the specific content, variables, command metrics, and user interactions shown or processed within a bot panel, the bot owner is the data controller, and Surf Online acts as a data processor hosting that data on the bot owner's behalf. Bot owners are responsible for providing appropriate privacy notices and securing lawful bases under GDPR or other applicable data protection laws.
We process your personal data for the following purposes:
We do not sell Citrum visitor or session data.
We use the following subprocessors to host, deliver, and secure Citrum. Each processes only the technical categories of data necessary for their respective service:
| Subprocessor | Purpose | Location | Data processed |
|---|---|---|---|
| Convex | Backend, database, file storage, and real-time API | United States | Account data, bot configurations, variable definitions and stored values, transcripts, platform logs |
| Vercel | Frontend hosting and edge delivery | Global | HTTP request metadata, session cookies |
| Discord | Authentication and bot API | United States | OAuth profile fields, bot runtime data |
| Cloudflare | CDN, edge, and runner traffic | Global | HTTP metadata, cached assets |
We retain your session data only as long as necessary to keep you authenticated. Session cookies and access tokens are short-lived. Discord OAuth profile data is cached temporarily and refreshed upon re-authentication.
Technical logs (containing IP addresses and browser metadata) are retained for a maximum of 30 days for security diagnostics and abuse prevention, after which they are deleted or anonymized, unless a legal hold or active investigation requires longer storage.
Depending on your location, you may have rights under the GDPR or other regional regulations to request access to, correction of, or deletion of your personal data, or to restrict or object to processing. To exercise these rights, please contact legal@meridian.surf. For developers with a Meridian account, please refer to the main Meridian Privacy Policy for further options.
We employ technical and organizational safeguards designed to protect personal data. If you discover a potential vulnerability or security issue affecting Citrum (such as session leakage or unauthorized panel access), please report it to us immediately at security@meridian.surf. Do not exploit the vulnerability or share it publicly.
We may update this Privacy Policy from time to time to align with changes in our data practices or legal requirements. The latest update date will be updated in our policies center. Continued use of the Service after an update indicates your acknowledgement of the revised policy.
Surf Online operates under the trade names Meridian and Meridian.surf, and is registered with the Dutch Chamber of Commerce (KvK) under number 42127201.
For privacy-related inquiries, please email legal@meridian.surf.
