Privacy and Data Protection Policy

1. Operator and scope

The operator of the public pre-production platform is Meridian Payments. The Service runs as a sandbox and does not process real payments. The direct privacy contact and address for legally significant electronic correspondence is privacy@meridian-pay.io.

The registered details and postal address of the production data controller will be stated in the merchant agreement and provided before live payments are enabled.

2. Data we process

• merchant representative data: name, work email, phone, company, role, and application details;
• account and security data: password hash, email verification, sessions, devices, IP address, and sign-in events;
• payer data: name, phone, email, IP address, user agent, and provider metadata only where required for a transaction;
• payment data: amount, currency, method, status, order and transaction identifiers, refunds, and settlement events;
• technical data: request logs, webhook events, diagnostics, and necessary cookies.

3. Data we do not collect

Meridian Payments does not accept or store full card numbers, CVV/CVC, PINs, or other secret payment credentials. In production, these must be handled only by certified payment providers.

4. Purposes and legal bases

• register, review, and secure companies and accounts;
• create, confirm, and account for payments, refunds, settlements, and payouts;
• prevent fraud, investigate incidents, and meet legal obligations;
• deliver service messages, notifications, and support;
• operate, audit, measure, and improve the Service;
• perform a contract, take pre-contract steps, comply with law, and rely on consent as applicable.

5. Payer data isolation

Payer data is stored separately in encrypted form. It is excluded from client DTOs, payment lists and details, search, CSV exports, and merchant webhooks. Merchants cannot access it through the dashboard or Merchant API.

Only an authorized platform administrator may reveal it through a dedicated protected action. Every reveal creates an immutable audit event.

6. Recipients and processors

We may use hosting, database, email delivery, monitoring, anti-fraud, and payment infrastructure providers only to the extent required to operate the Service. Access is limited by purpose, contract, and least privilege. Disclosures to public authorities occur only where a valid legal basis exists.

7. Retention and deletion

At the end of the applicable period, data is deleted or irreversibly anonymized. A mandatory legal period or open dispute may extend retention only for the relevant category.

• applications and contact requests: 12 months after the last contact;
• access sessions: 15 minutes; refresh sessions: 30 days;
• security data and audit logs: 3 years after account closure;
• sandbox payer PII: 180 days after the operation unless a dispute or law requires longer;
• payment and ledger records: 5 years after the operation;
• backups: up to 35 days after the primary record is deleted.

8. Security

• AES-256-GCM encryption for sensitive data with key versioning;
• secure cookies, short-lived access sessions, and refresh-session rotation;
• multi-factor authentication for administrators;
• server-side tenant isolation;
• audit trails for PII access, administrative actions, and financial changes;
• backups, monitoring, and incident-response procedures.

9. Your rights

• request information about processing;
• correct inaccurate data;
• request deletion or restriction where the law allows;
• withdraw consent without affecting prior lawful processing;
• object to certain processing and contact the competent supervisory authority.

10. Requests and updates

Send privacy requests directly to privacy@meridian-pay.io. We may verify the requester’s identity before acting.

New versions are published on this page with an updated date and version number. Material changes are additionally communicated through the dashboard or email where required.