Privacy Policy

3. Google Calendar Access and Use

Connecting Google requests permission to identify your account, list your calendars, check availability, and view and manage calendar events. Meridian uses these permissions to provide the following features:

• List the calendars you can access so you can choose calendars for conflict checks and a destination for new bookings.
• Read free/busy intervals to calculate bookable times and avoid scheduling conflicts. Public booking pages show available slots rather than private calendar event titles.
• Read event titles and times to display connected events in your authenticated calendar.
• Create booking events, include meeting details and attendees, and create or attach Google Meet links when requested.
• Update or remove related calendar events when you use meeting, rescheduling, cancellation, or temporary calendar-hold features. Calendar invitations and updates may be sent to the attendees of those events.

Calendar selections and OAuth credentials are stored in our server-side database. Free/busy results may be cached briefly in server memory (currently up to 60 seconds). Booking records retain the details needed to manage meetings, including related provider event identifiers and video links. We do not routinely copy your entire external calendar into the Meridian database.

Meridian's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We limit use of Google user data to providing or improving the user-facing scheduling features you use. We do not sell Google user data, use it for advertising, or use or transfer it to develop, train, or improve generalized or non-personalized artificial intelligence or machine-learning models. Human access to Google user data is limited to circumstances permitted by that policy, such as your consent to view specific data, security investigations, legal requirements, or permitted aggregated and anonymised internal operations.

3a. Microsoft Calendar Access and Use

Connecting Microsoft 365 or Outlook.com gives Meridian permission to identify your account, list calendars, read event titles and times, check availability, and create, update, or remove booking events and temporary calendar holds. Public booking pages show available times rather than your private event titles. Microsoft Teams links can be created or attached when supported by your connected account and calendar. Calendar invitations and updates may be sent to the attendees of those events.

We store calendar selections, OAuth access and refresh tokens, granted permissions, and expiry information in our server-side database so scheduling can continue when you are signed out. Free/busy results may be cached briefly; booking records retain related event identifiers and meeting links. We do not routinely copy your entire Outlook calendar into Meridian. Calendar access does not grant Meridian permission to read your email inbox or send email as you.

We use Microsoft data to provide your scheduling features. We do not sell it, use it for advertising, or use or transfer it to train generalized AI models. The sharing, retention, security, and account controls described below also apply to Microsoft data. Your organisation may require administrator approval before you can connect.

4. Sharing and Service Providers

We share information only as needed to provide the features you use, follow your instructions, protect the service, or meet legal obligations. We do not sell personal information or use Google user data for advertising. Recipients include:

• Hosts, invitees, and team members — receive the profile, booking, invitation, or response information needed for the scheduling activity and their authorised role. Your public profile and information you choose to publish on booking pages are visible to their visitors.
• Google and Microsoft — provide sign-in, calendar access, meeting creation, and attendee invitations for connected accounts.
• SendGrid (Twilio)— receives recipients' email addresses and message content, including relevant meeting details, to deliver confirmations, reminders, invitations, and account emails.
• Railway — hosts Meridian and its PostgreSQL database, including account information, connection credentials, and scheduling records.
• Analytics and diagnostics providers — PostHog and Sentry may process usage or diagnostic information for the corresponding features when enabled. Optional browser analytics require consent; session replay and automatic element capture are disabled.
• Integrations you connect — authorised MCP clients, AI assistants, API clients, and webhook destinations receive the scheduling information returned by the tools or events you permit them to use.

Providers may process information outside South Africa. Information shared with your chosen calendar provider or connected client is also subject to that provider's privacy practices. Google API data transfers remain subject to Google's Limited Use requirements, including where security or legal disclosure is necessary.

5. AI Assistants and MCP Integrations

Meridian does not need an external AI model to operate its scheduling service. If you connect an AI assistant or other MCP client, that client can request scheduling information and perform permitted actions on your behalf. Tool responses can include personal meeting and booking information, which the client may then process in its own systems. Meridian does not send your Google or Microsoft OAuth access or refresh tokens in tool responses.

Connect only clients you trust and whose data handling complies with Google's Limited Use requirements. Google user data must not be used to train or improve generalized or non-personalized AI models. Review the client's privacy and data-use settings before authorising it. You can revoke connected MCP clients and API keys in Settings under MCP / API, and remove webhook destinations in Settings under Webhooks.

6. Retention and Deletion

We retain account, connection, and scheduling records while your account is active and they are needed to provide the service. You can delete your account from Settings under Account. A completed account deletion removes your profile, server-stored OAuth credentials, sessions, owned bookings, and associated scheduling configuration from the active database. Contact us if you need help submitting a deletion request.

Limited security audit and email-delivery records may remain after account deletion for security, incident investigation, delivery troubleshooting, and legal obligations. These records may include email addresses, IP addresses, action timestamps, and delivery metadata. Backup copies, where maintained, are removed through the applicable backup retention cycle rather than immediately. Contact us about retention or erasure of these remaining records; we assess requests against those operational and legal needs.

Deleting your Meridian account does not automatically delete calendar events already stored by Google or Microsoft, messages received by invitees, or copies held by hosts and integrations you authorised. Manage those copies with the relevant recipient or provider. Records belonging to another host may remain as part of that host's bookings.

7. Your Choices and Rights

• Access, correction, and export — view and edit your profile and settings, and download your Meridian data from Settings under Account. Exports omit authentication secrets.
• Calendar controls — choose calendars for conflict checking and booking creation, or remove them in Settings under Connections. Removing calendars there retains the linked sign-in account and its OAuth credentials; refreshing or reconnecting can add calendars again.
• Revoke Google access— remove Meridian's access through your Google Account connections. This stops further authorised Google API access, but does not delete records already held by Meridian. Reconnecting requires your authorisation again.
• Revoke Microsoft access— manage Meridian's permissions in your personal Microsoft account or your organisation's My Apps portal. Contact your administrator for permissions granted by your organisation. Revocation does not delete records already held by Meridian.
• Integration controls — revoke MCP clients and API keys and remove webhooks from Settings.
• Cookies— essential session cookies support sign-in. Optional browser analytics follow your cookie choice, which you can revisit by clearing Meridian's stored site data in your browser.
• Deletion and other requests — delete your account in Settings or contact i60 to request access, correction, or erasure of information you cannot manage yourself, including information submitted as an invitee.