Privacy Policy

We do not ask for, and ask you not to submit, sensitive personal information such as government identifiers, financial account details, health information or information about other people. We do not use precise geolocation; a network address may indicate an approximate location, which we do not derive or store.

• To provide the Service and your account: signing you in, sending codes, storing and showing what you save, and answering your questions. Where the GDPR or UK GDPR applies, this is necessary to perform our contract with you.
• To keep the Service secure and within its limits: preventing password guessing, fraud and abuse, enforcing the Terms, and counting the analyst’s allowances. This is in our legitimate interests and those of our users.
• To understand how the Service is used and improve it, from aggregate page-view statistics that do not identify you. This is in our legitimate interests.
• To communicate with you about your account, security and changes to the Service or these documents. This is necessary for our contract or in our legitimate interests.
• To comply with law and to establish, exercise or defend legal claims, including keeping records of the terms you accepted.

We do not use personal information for profiling, advertising or automated decisions that produce legal or similarly significant effects on you, and we do not use it to train language models.

When you use the analyst, your question, the conversation and relevant material from Meridian’s sources are sent to language models hosted for us on Microsoft Azure. Microsoft processes this data as our service provider under its enterprise terms, which do not permit it to use the data to train its models; Microsoft may retain it for a limited period for abuse monitoring as its terms describe. Answers are stored in your workspace so you can return to them. Do not include other people’s personal information or confidential material in questions.

• Google. Meridian has no Google client of its own: Google sign-in passes through the authentication service Surf Platforms operates for its Surf app, hosted by Supabase. Signing in this way creates a sign-in record in that service holding your Google account identifier, email address, name and picture. It is used only to complete the sign-in, the session it opens there is ended immediately, it does not create a Surf profile visible to anyone, and Meridian keeps no Google token. You may ask us at legal@surfplatforms.com to delete that record at any time.
• Surf. If you sign in with a Surf account, Surf shares your Surf account identifier, name, email address and picture with Meridian after you approve it. Meridian keeps no Surf token and cannot act in Surf for you. Surf’s own privacy policy covers your Surf account.

All cookies are first-party, essential to the Service, HTTP-only and, on the live site, secure. We set no advertising, tracking or other optional cookies, and Vercel Web Analytics sets none, so there is nothing to consent to or opt out of. Page views are counted by a small script served from this site, which sends the page’s path (never its query string), the referring site and the browser’s description to Vercel. Your browser’s local storage also keeps interface preferences and cached map data on your device only; you can clear it in your browser at any time. We treat a Global Privacy Control signal as a request to opt out of sale and sharing, which we do not do in any case.

When the map loads, your browser fetches map tiles, imagery and elevation data directly from their providers, currently OpenFreeMap, NASA’s Global Imagery Browse Services, EOX IT Services and Amazon Web Services Open Data, and opening a source link takes you to its publisher. Those providers receive your network address and the area or page requested, under their own policies.

We disclose personal information only as follows:

• Service providers that process it on our behalf and under our instructions, listed below.
• Legal reasons: where we believe in good faith it is required by law or valid legal process, to protect the rights, property or safety of any person, or to investigate fraud, security incidents or violations of our Terms. We review requests for user data and require valid legal process except in an emergency involving a risk of death or serious physical injury.
• Business transfers: as part of a merger, acquisition, financing, reorganisation or sale of assets, subject to this policy.
• With your direction or consent.

We do not sell personal information, share it for cross-context behavioural advertising, or disclose it to third parties for their own direct marketing.

Meridian is operated from the United States and personal information is stored and processed there. If you are outside the United States, your information is transferred to the United States, whose laws may differ from those where you live. Where the law requires, we rely on appropriate safeguards for these transfers, such as the Standard Contractual Clauses our providers offer.

• You can delete your account at any time from the account page. Deletion takes effect immediately and removes your account, sessions, sign-in methods and everything saved under it.
• Deleted information remains in database backups, kept on encrypted cloud disks, until those are replaced in rotation, normally within a few days, and is not restored from them except to recover from a failure, in which case deletions are applied again.
• We keep acceptance records and information we are required to keep by law, or need to establish, exercise or defend legal claims, for the periods stated above.

Wherever you live, you may ask us to give you access to or a copy of your personal information, to correct it, or to delete it. Write to legal@surfplatforms.com from the email address on your account. Depending on where you live, you may also have the rights below.

• California. Under the CCPA, as amended by the CPRA, you have the right to know what personal information we collect, use and disclose, to access, correct and delete it, to opt out of its sale or sharing (we do neither), to limit the use of sensitive personal information (we use account credentials only to provide the Service), and not to be discriminated against for exercising these rights. In the past twelve months we have collected identifiers (such as name, email and network address), internet or electronic activity (such as session and security records) and the content of your workspace, for the purposes in section 2, from the sources in section 1, and disclosed them for business purposes only to the providers in section 6. We do not disclose personal information to third parties for their direct marketing purposes.
• Other U.S. states. Residents of states with comprehensive privacy laws, such as Colorado, Connecticut, Virginia and others, have similar rights. If we decline a request, you may appeal by replying to our decision; if your appeal is denied, you may contact your state attorney general.
• EEA, UK and Switzerland. You have the right to access, rectify, erase, restrict and port your personal information, to object to processing based on legitimate interests, to withdraw any consent, and to lodge a complaint with your local data protection authority.

We will verify your request by confirming it comes from the email address on the account, and respond within the time the law requires, generally within 30 days and no later than 45. You may use an authorised agent, who must provide your signed permission; we may still ask you to confirm your identity directly. We will not discriminate against you for exercising any right.

Meridian’s sources name public figures, officials, organisations and companies, and include registrations of state, military and commercial aircraft and vessels. We process this material to provide research and reporting on matters of public interest, which is in our legitimate interests and those of our users, and in many jurisdictions within the special treatment the law gives to journalism, research and freedom of expression. Aircraft whose owners have asked for their flights to be withheld from public display, through the U.S. Federal Aviation Administration’s privacy programmes, are excluded, and Meridian does not set out to profile private individuals. We exclude, and remove on request, information identifying victims of sexual abuse and minors.

If you are named or identifiable in material Meridian shows and believe it is inaccurate, out of date, unlawful or should not be shown, write to legal@surfplatforms.com as described in the corrections policy. You may also exercise the rights in section 9. We weigh each request against the public interest in the material and will tell you what we decided.

Passwords are hashed with scrypt and checked against known breaches; codes are hashed and expire in 10 minutes; sign-in attempts are rate limited; traffic is encrypted in transit; and our servers and database are not reachable from the internet except through an authenticated gateway. No system is completely secure. If we learn of a breach affecting your personal information, we will notify you and any regulator as the law requires, without undue delay.

The Service is for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete the account and the information. If you believe a minor has created an account, write to legal@surfplatforms.com.

We will update this policy when our practices change. The date and version at the top show the version in force. If a change is material, we will tell you by email or in the Service before it takes effect and, where required, ask for your agreement.

Surf Platforms Inc., San Jose, California, United States. Privacy requests and questions: legal@surfplatforms.com. This policy should be read with the Terms of Service.