Privacy Policy

1. Who we are

Meridian operates the Service from the United Arab Emirates and is the controller of the personal data described in the Controller data section below. For any privacy question or request, contact privacy@meridianpms.app.

2. Definitions

Personal data means any information relating to an identified or identifiable natural person. Processing means any operation performed on personal data. Controller means the party that determines the purposes and means of processing. Processor means the party that processes personal data on the controller's behalf. These terms carry the meaning given in UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL).

3. The data we process

Account data: your name, email address, phone number, role, password (stored only as a salted hash), and two-factor settings.

Workspace data you enter or upload: properties, units, leases, tenants, owners, invoices, payments, cheques, maintenance requests, messages, and documents.

Technical and usage data collected automatically: IP address, browser and device characteristics, pages and actions, and security and audit logs such as sign-ins, record changes, and document access.

We do not intentionally collect special categories of data. Please do not upload data you have no lawful basis to process.

4. Controller data (our own)

For your account, billing, support, and website analytics at the aggregate level, Meridian is the controller. For the data inside your workspace about your tenants, owners, and staff, you are the controller and Meridian is your processor; see the Data Protection statement.

5. How and why we use data

To create and administer your account; to provide, maintain, secure, and improve the Service; to process rent and invoices through our licensed payment partner; to send the notifications, receipts, and service messages you request or that are necessary to operate the Service; to provide support; to keep immutable audit trails of important actions; to detect and prevent fraud and abuse; and to comply with legal, tax, and regulatory obligations.

6. Legal bases

We rely on: performance of our contract with you; compliance with legal obligations under UAE law including the PDPL; our legitimate interests in operating, securing, and improving the Service where these are not overridden by your rights; and your consent where the law requires it, which you may withdraw at any time without affecting prior processing.

7. Cookies

We use strictly necessary cookies to sign you in and secure your session, and we store a few preferences on your device. We do not use advertising or cross-site tracking cookies. See our Cookie Policy for details.

8. Sharing and disclosure

We share personal data only with the processors that help us run the Service: a licensed UAE payment service provider that processes rent as merchant of record, Cloudflare R2 for encrypted document storage, and our email and SMS delivery providers. Each is bound by contract to protect the data and act only on our instructions.

We may disclose data where required by applicable law, a court order, or a competent UAE authority, and in connection with a merger, acquisition, or sale of assets, in which case we will require the recipient to honour this policy. We never sell personal data and do not use it for third-party advertising.

9. International transfers

Where a provider stores or processes personal data outside the UAE, we transfer it only under the conditions and safeguards permitted by the PDPL and its executive regulations, such as an adequate level of protection or appropriate contractual safeguards.

10. Retention

We keep workspace data for as long as your account is active. After closure we retain personal data only as long as necessary for the purposes it was collected and to meet legal obligations, for example tax and accounting records for the period required by UAE law, and records needed to resolve disputes or enforce our agreements. When no longer needed, data is deleted or anonymized.

11. Security

Each workspace's data is isolated at the database level with row-level security, access is controlled by role, passwords are hashed, data is encrypted in transit, and important actions are logged. No method of transmission or storage is completely secure, but we maintain measures appropriate to the risk.

12. Your rights

Subject to the PDPL you may request access to your personal data, correction of inaccurate data, erasure, restriction or cessation of processing, portability of data you provided, and you may object to processing based on legitimate interests and withdraw consent. To exercise these rights email privacy@meridianpms.app; we may verify your identity and will respond within the period required by law. You also have the right to complain to the UAE Data Office.

13. Children

The Service is intended for businesses and adults. It is not directed at children, and we do not knowingly collect the personal data of anyone under 18. If you believe a child's data has been provided to us, contact us and we will delete it.

14. Automated decisions

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing without human involvement.

15. Third-party links

The Service may link to third-party sites or services, such as a payment provider's hosted page. Their privacy practices are governed by their own policies, which we encourage you to review.

16. Changes and contact

We may update this policy as the Service or the law changes; we will post the new version here and update the date above, and where changes are material we will take reasonable steps to notify you. Questions or requests: privacy@meridianpms.app.