Privacy policy

1. Introduction

This Privacy Policy explains who we are, why and how we collect and process personal data, the rights you have as a user when you provide personal information to us, and how you can contact us if you need to exercise your rights or have other questions.

We reserve the right to change or update this Privacy Policy at any time. In the event of significant changes, we will inform you by updating the date at the top of this page or by other appropriate means.

2. General information

We are Meridu ("We" or the "Company"). Our contact details are provided at the end of this Privacy Policy. We are the controller of your personal data and process it under the terms described herein.

This Privacy Policy clarifies how Meridu uses your personal data and why it is collected. Before browsing or using services provided on meridu.com, please read this document carefully.

We are committed to ensuring the security and confidentiality of your personal data.

3. Personal data we collect

The data we collect about you is primarily the data you have provided to us, such as your name, email address, phone number, and address. We may collect, or process on behalf of our customers (the businesses that use Meridu), the following categories of personal data when you use or interact with our products and services:

• Account and contact data: name, email address, phone number, and address that you provide when you register, sign in, book a service, or contact us.
• Booking data: the services you book, appointment times, and any notes or details you submit as part of a booking.
• Device and usage data: when you browse meridu.com, we automatically collect information about your device, such as browser type, IP address, time zone, and cookie data, as well as information about your browsing activity, such as pages visited or services viewed. We refer to this as device information.
• Google user data: if you choose to connect your Google Calendar, we access Google user data through Google API Services as described in the dedicated "Google user data and Google API Services" section below.

4. How we use your data

Your data security is extremely important to us. We only process the personal data necessary to provide you with the services you requested.

We will use your data to provide you with the services you requested, such as creating and managing your account, processing your bookings, sending you booking confirmations, reminders, and other service-related email or SMS notifications, responding to your requests, and improving and securing our services.

Automatically collected data is used for website analytics and statistics to understand how users interact with our site. We do not use identifiable data for statistical purposes.

We will not sell your data to third parties. We may share it only with the partners and service providers who help us provide our services (for example, email and SMS delivery providers, payment processing, and hosting), and only to the extent necessary for them to perform those services on our behalf.

You can browse our site without submitting personal information that identifies you. However, if you wish to register, contact us, or use certain website features, you may be asked to provide personal data. If you choose not to provide it, some features may be unavailable.

5. What data we do not process

We do not knowingly request or collect personal data from children under the age of 13 or offer our services to them. If we learn that a child under 13 has provided us with personal data without parental or guardian consent, we will take appropriate steps to delete that information.

Meridu recommends that parents and guardians supervise children’s online activities. If you believe we may have accidentally received personal information from a minor without the required consent, please inform us.

6. Cookies

Our website and certain third parties may automatically collect data using cookies, web logs, web beacons, and other tracking technologies. This information helps us better understand user behavior, analyze traffic, improve site functionality, and provide more personalized offers.

For more detailed information, please see our Cookie Policy.

7. Google user data and Google API Services

Meridu lets you connect your Google Calendar so that your external calendar events can block your bookable time slots, appear in the admin calendar, and optionally receive Meridu bookings written back to Google. This integration uses Google API Services and is entirely optional — you only grant access if you explicitly connect your Google account.

What Google user data we collect: when you connect Google Calendar, we request the calendar.readonly and calendar.events scopes. We access and store the calendar information needed for the integration, such as your list of calendars and your calendar events (including event times, titles, and busy/free status). When write-back is enabled, we create, update, and delete events on your behalf that correspond to your Meridu bookings.

How we use Google user data: we use it solely to provide the calendar features you requested — synchronizing your availability, displaying events in your admin calendar according to your chosen visibility level, and writing Meridu bookings back to your Google Calendar. We do not use Google user data for advertising, and we do not use it to train any generalized or non-personalized artificial intelligence or machine learning models.

How we share Google user data: we do not transfer or disclose Google user data to third parties except as necessary to provide and improve the integration, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with your prior notice. Meridu’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How we protect Google user data: Google access and refresh tokens are encrypted at rest, access is limited to authorized personnel and systems, and calendar data is processed only for the purposes described above.

Retention and deletion of Google user data: you can disconnect Google Calendar at any time from your account settings. When you disconnect, or when your account is deleted, we revoke the stored tokens and delete the associated Google user data (connection details, synced events, and write-back mappings) from our systems. You may also revoke Meridu’s access directly from your Google Account security settings.

8. Data protection

Security procedures are in place to protect the confidentiality of your data. We use appropriate organizational and technical security measures, including encryption of sensitive data such as access tokens, to protect your personal information. Only authorized personnel have access to your data.

We regularly assess and update our security procedures to reduce the risk of data breaches. However, despite our efforts, no security system is absolutely guaranteed.

9. How we share, transfer, and disclose your data

We do not sell your personal data, and we do not transfer or disclose your information to third parties for purposes other than the ones described in this Privacy Policy.

We may share your data with partners and service providers who help us deliver our services (such as hosting, email and SMS delivery, and payment processing), and only to the extent necessary for them to perform those services on our behalf.

We reserve the right to disclose your personal data when required by law, where it is necessary to protect our or others’ rights and safety, investigate possible violations, or respond to legitimate government requests.

10. Data retention and deletion

We store your personal information for a period of time that is consistent with our business purposes. We will retain your personal information for the length of time needed to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

When the data retention period expires for a given type of data, or when the data is no longer needed, we will delete or destroy it.

You may request that your data be deleted at any time by contacting us at [email protected]. We will respond to your request in accordance with applicable data protection laws. You can also delete certain data yourself — for example, by disconnecting integrations or asking us to close your account.

11. Your rights

Under applicable data protection laws, including GDPR, you have the following rights:

• Access: request confirmation of whether we process your personal data and receive a copy of it.
• Rectification: request that inaccurate or incomplete data be corrected.
• Erasure: request deletion of your personal data if it is no longer necessary, is processed unlawfully, or where deletion is required by law.
• Restriction of processing: in certain circumstances, request the restriction of the processing of your personal data.
• Objection: object at any time to the processing of your personal data where the legal basis for processing is our legitimate interests.
• Data portability: if personal data is processed by automated means, you have the right to receive it in a structured, commonly used, and machine-readable format and transfer it to another controller where technically feasible.
• Withdrawal of consent: if your data is processed based on consent, you have the right to withdraw it at any time without affecting the lawfulness of processing prior to withdrawal.
• Lodge a complaint: if you believe your data is processed unlawfully, you have the right to submit a complaint to a supervisory authority.

12. Contact us

If you have questions about this Privacy Policy or would like to make a request regarding your personal data, please contact us:

Email: [email protected]