Privacy Policy

This Privacy Policy explains what personal data MeridianRoles (“we”, “our”, “us”) collects, why, how we protect it, and how you can control it.

1. What We Collect

Account data: Email address, name, and password (stored as a hash via Supabase Auth).

Profile data: Standard CV, Extended CV, Biography Statement, and the structured data parsed from them. This is the core matching signal used by the Service.

Contact details for your documents: The email address, phone number and LinkedIn address on the CV you upload, or that you type in, and an optional note you write for your cover letters. We print only the details you confirm, exactly as you confirm them, and our own code adds them to each document. Anthropic reads your CV, contact details included, when you upload it. Your note is sent to Anthropic when we write a cover letter; your confirmed contact details are not.

Phone number for text alerts: If you switch on text alerts, the phone number you give, used only to send them. It is never printed on your documents.

Search configuration: Your industry, geography, the countries you choose to search, seniority, company preferences, and watchlist companies.

Commute location: If you set a home location, we store its city-level coordinates and a commute radius. These are used only to compute the distance between you and a role and to filter roles beyond your radius. They are never shared with employers, never included in any generated document, and never sent to the AI matching model.

Usage data: Match history, document generation events, feature interactions, and, where it is switched on, our own record of match digest opens and clicks (see Section 5).

Payment data: Stripe customer ID and subscription status. We do not store card numbers or billing addresses.

If you cancel: The reason you choose on Stripe’s cancellation page, and anything you write there.

Recommendations: If you found a job through MeridianRoles, we’d love to hear about your experience. If you choose to write a recommendation, we’ll keep the name you’d like us to use, your recommendation, and a link to your LinkedIn profile if you provide one.

2. How We Use Your Data

We use your data solely to provide the Service: to score job listings against your profile, generate tailored documents, and send you curated digests. We do not sell your data to any third party, including employers, recruiters, or data brokers.

We use Anthropic (the Claude API) to process your profile data for job matching and document generation, under terms that do not permit the use of customer data for model training.

Why we are allowed to use your data: If you are in the EEA, the UK or Switzerland, the law asks us to name our reason for each use. We use your account, profile, contact details, search settings, matches and documents to provide the Service you signed up for, because that is needed to deliver our contract with you. We keep the Service secure and count visits and feature use (Section 5, Analytics) because we have a legitimate interest in running and improving it. For the same reason we keep the reason you give if you cancel, and anything you write with it. For you, our record of match digest opens and clicks rests on your consent, which you give by switching it on and withdraw by switching it off. We’ll only share your recommendation on our website if you give us permission by checking the consent box when you submit it. You can change your mind at any time by emailing privacy@meridianroles.com. We keep payment records to meet our legal obligations.

3. Data Retention

We keep your data while your account is in use. An account nobody uses is removed 12 months after its plan ends or its last sign-in, whichever is later. An account that never finished setup or never chose a plan is removed 90 days after its last sign-in. We email you 30 days and 7 days before an account is removed, and signing in keeps it.

You can delete your account at any time in Settings, and deletion happens immediately: your account and everything in it are erased, including your profile and CV details, search settings, matches, applications, journal, and the CVs, cover letters and interview briefs we generated for you. Any active subscription is canceled. The one exception is a recommendation we have published, described below. You can also ask us to delete your account by emailing privacy@meridianroles.com, and we will do so within 30 days. Copies held in our backups are removed within 30 days of deletion.

Generated documents are stored for 12 months. Our record of match digest opens and clicks is kept no longer than your account and is deleted with it. We keep a count of deleted accounts by day, with nothing that identifies you. If you cancel, the reason you choose is kept with our payment records, and anything you write with it is deleted with your account. If we publish your recommendation, it stays on our website after you delete your account, until you ask us to remove it by emailing privacy@meridianroles.com. A recommendation we have not published is deleted with your account. Payment records, ours and Stripe’s, are kept for 7 years, as financial regulations require.

4. Your Rights (GDPR)

If you are in the EEA, UK, or Switzerland, you have the right to access, correct, export, restrict processing of, object to our use of, or delete your personal data, and to withdraw any consent you have given at any time. To exercise these rights, contact privacy@meridianroles.com. We will respond within one month.

You also have the right to complain to a data protection regulator: in the EU, the one in the country where you live or work; in the UK, the Information Commissioner’s Office; in Switzerland, the Federal Data Protection and Information Commissioner.

5. Cookies

We use strictly necessary cookies for authentication (Supabase session). We do not use advertising cookies, and no other company’s tracking is built into our emails.

Setup progress: While you are setting up your account, we keep your progress in your browser so you can leave and come back. It stays on your device. It is removed when you finish setup or sign out, and after 30 days it is no longer used and is deleted when you next return.

Match digest opens and clicks: From 2 November 2026, if this is switched on for your account, we keep our own record of when a match digest was opened and which of its links were used. The email carries a small image served from meridianroles.com, and its links pass through meridianroles.com. We store the date and time, the link and the role against your account, with a note of whether a mail service or a link checker seems to have fetched it rather than you. We do not store your IP address or browser, and no other company receives this record. Mail apps sometimes load images and check links by themselves, so we treat it as approximate. You can switch it off in Settings › Notifications or with the link at the foot of any match digest, and switching it off stops the record at once. For members in the United States we may switch it on unless you switch it off; for everyone else it is off unless you switch it on. Sign-in and reminder emails are never recorded.

Analytics: We use two analytics tools, Umami and Vercel Web Analytics, to count visits and see which features are used. Neither sets cookies. They record the pages you open and the features you use, with your browser, device type and approximate location (country, region and city), which they work out from your IP address without storing it. Page addresses are cleaned before they are sent, so neither tool receives your name, your email address, an account or role ID, or the words you type into a search.

6. Third-Party Services

We share data with the following processors only to the extent required to provide the Service: Supabase (database and storage), Anthropic (Claude, AI processing), Stripe (payments), Resend (email delivery; its own open and click tracking is switched off), Twilio (SMS delivery), Vercel (website hosting and analytics), Umami (website analytics), Cloudflare (the check that a sign-in or sign-up comes from a person). Each of these is bound by a Data Processing Agreement. Railway (running our scheduled scouting) and Expo (notifications to the phone app) process data under their own terms of service, and both are certified under the EU-US Data Privacy Framework.

Notifications to the phone app reach your device through Apple or Google. To find roles, we send search terms and places built from your search settings to job advert services (Adzuna and Fantastic Jobs) and to employers’ own career sites. These searches never include your name, email address or CV.

Where your data is processed: MeridianRoles is run from the United States. Your data is stored in the United States and processed there by us and by the services above, some of which may also process it in other countries. If you are in the EEA, the UK or Switzerland, we protect your data when it goes to the United States with the safeguards in each service’s data processing terms, such as the EU Standard Contractual Clauses and the UK addendum to them, or the EU-US Data Privacy Framework where a service is certified under it. You can ask us for a copy of these safeguards at privacy@meridianroles.com.

7. Security

Data is encrypted at rest (AES-256) and in transit (TLS 1.3). Row-level security is enforced at the database layer. See our Security page for full details.

8. Changes

We will notify active subscribers by email of material changes to this Policy at least 14 days before they take effect.

9. Contact

Data controller: Geifon LLC, 1760 North Jog Road, West Palm Beach, FL 33411, United States, which operates MeridianRoles. Privacy questions: contact form or privacy@meridianroles.com.