Privacy Policy

1. Who we are

Meridian Intel is a product of Mazal Arc, a technology company building at the intersection of business, tech, and community.

Meridian Intel is a zero-hallucination Retrieval-Augmented Generation (RAG) platform that allows users to upload documents and query them using natural language. The platform operates across fourteen domain fields including pharmaceutical compliance, legal, finance, research, and general enterprise use.

Contact: support@meridianintel.app

2. What we collect

Account information

• Email address (used for workspace access verification via one-time code or Google SSO)
• Name (provided via Google SSO or entered manually, used for profile display)
• Google account identifier (if signing in via Google SSO — we receive your name and email from Google's Identity Services; we do not access your Google Drive, contacts, or other Google data)
• Tier selection and billing information (processed by Stripe — we never see your card number)

Usage data

• Queries submitted to the platform
• Feedback ratings (thumbs up/down on responses)
• Document upload history (filename, field type, chunk count, timestamp)
• Query history (question text, faithfulness scores, timestamps)
• Session identifiers

Technical data

• IP address (used for security and rate limiting only)
• Browser type and version
• Device type (desktop, tablet, mobile)
• Platform preferences (dark/light mode, font size, accent color) stored in your browser's local storage

What we do NOT collect

• Social security numbers or government IDs
• Payment card details (handled entirely by Stripe)
• Biometric data
• Location data beyond IP-level country detection
• Any data from children under 13

3. How we handle your documents

When you upload a document to Meridian Intel, the following happens:

1. The document is received by our OCaml gateway and forwarded to our FastAPI processing worker
2. Text is extracted from the PDF using pdfplumber
3. The text is split into chunks using our recursive chunking algorithm (chunk size determined by your tier)
4. PII scrubbing is applied before any data reaches an AI model (see Section 4)
5. Chunks are embedded into vector representations and stored in ChromaDB under your user collection
6. The original PDF file is not stored permanently — only the processed text chunks and their embeddings

Enclave tier isolation

Enclave (Enterprise) tier users receive per-user ChromaDB collection isolation. Your document chunks are stored in a collection accessible only to your user ID and are never co-mingled with other users' data.

Free and mid tiers

Ephemeral, Segment, Lattice, and Vector tier users share a ChromaDB collection namespace. Individual documents are tagged with your user ID and are not accessible to other users, but they are stored in a shared infrastructure environment.

4. PII scrubbing

Meridian Intel applies automatic PII scrubbing before any document content reaches an AI language model. This is a core architectural feature, not an optional add-on.

Pharmaceutical field defaults are calibrated to preserve lot numbers, batch numbers, catalog IDs, and article numbers which would otherwise be incorrectly flagged by broad phone or numeric patterns.

PII scrubbing runs on query text, retrieved document chunks, and generated responses before any data is stored in query history.

5. How we use your data

We never use your data to:

• Train AI models (neither ours nor third parties)
• Serve advertising
• Sell to data brokers
• Profile you for marketing purposes
• Share with law enforcement except where legally required

6. Who we share data with

We share data only with the following categories of third parties, and only to the extent necessary to operate the platform:

We do not use advertising networks, analytics resellers, or social media tracking pixels.

7. Data retention

8. Security

Meridian Intel is built with security as a core architectural concern, not an afterthought:

• Transport encryption: All data in transit is encrypted via TLS 1.3. We verify our hosting provider (Railway) and CDN (Cloudflare) enforce HTTPS on all connections — including internal service-to-service communication.
• Encryption at rest: Data stored on our servers (document chunks, query history, metadata) is protected by infrastructure-level encryption at rest provided by Railway. In addition, Meridian Intel applies AES-256-GCM application-level encryption — document chunk text is encrypted before it is written to storage and decrypted only during query processing. This means your document content is protected even from infrastructure-level access.
• API gateway: All requests pass through our OCaml gateway which enforces JWT authentication, rate limiting, and request validation before reaching the ML worker
• Workspace access: Workspace access requires identity verification via Google SSO (OAuth 2.0) or a one-time email code sent via AWS SES (primary) or Resend (backup). Session tokens are HMAC-signed JWTs stored in browser memory only — never in localStorage or cookies. Sessions auto-lock after 15 minutes of inactivity to protect sensitive document data.
• Owner verification: Administrative access requires a server-side verified JWT — the access code is never stored in frontend code
• PII scrubbing: Applied at the infrastructure level before data reaches any AI model
• Zero-hallucination guarantee: The LLM call is blocked entirely if retrieval returns no relevant chunks — preventing generation of false information
• Enclave isolation: Enterprise users receive per-user vector store isolation with zero cross-document contamination, verified across real multi-document test scenarios
• No external analytics: No Google Analytics, Meta Pixel, or third-party tracking scripts are loaded on the platform
• local_only mode: Enclave-tier users can enable a zero-cloud inference guarantee — document content never leaves our infrastructure under any condition when this mode is active

In the event of a data breach that affects your personal data, we will notify you within 72 hours of becoming aware of it.

9. Your rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate personal data
• Deletion: Request deletion of your account and all associated data
• Portability: Request your data in a machine-readable format
• Objection: Object to processing based on legitimate interest
• Restriction: Request restriction of processing while a dispute is resolved
• Withdrawal: Withdraw consent at any time where processing is consent-based

To exercise any of these rights, email us at support@meridianintel.app. We will respond within 30 days.

You also have the right to lodge a complaint with your local data protection authority if you believe we have not handled your data appropriately.

10. Cookies and local storage

Meridian Intel uses minimal browser storage:

We do not use advertising cookies, tracking cookies, or third-party analytics cookies. No cookie consent banner is required for essential platform functionality cookies under ePrivacy Directive exemptions.

11. AI models and third parties

Local inference (Mistral-7B)

By default, query processing uses a locally hosted Mistral-7B model running on Meridian Intel's infrastructure. Your document content and queries do not leave our servers during local inference.

Cloud inference (Gemini 2.5 Flash Lite & OpenAI gpt-4o-mini)

When local inference is unavailable or rate-limited, our AUTO Shield feature routes requests to Google's Gemini 2.5 Flash Lite API, then OpenAI gpt-4o-mini as a tertiary fallback. Users can also manually select any engine (Mistral, Gemini, or GPT) from the workspace menu, which disables the AUTO cascade and routes directly to the chosen engine. Only scrubbed text (after PII removal) is sent to any cloud provider. We do not send raw document content, account information, or identifiable user data to Google or OpenAI. Users who require a complete zero-cloud guarantee may enable local_only engine mode, which disables all cloud fallback entirely.

Google's use of data submitted via API is governed by the Google AI API Terms of Service. Google does not use API data to train its models by default.

No model training on your data

Neither Mazal Arc nor any third-party AI provider uses your uploaded documents or queries to train, fine-tune, or improve AI models. This applies to both local and cloud inference paths.

12. Children's privacy

Meridian Intel is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us immediately at support@meridianintel.app and we will delete it promptly.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Send an email notification to registered users
• Display a notice in the platform workspace

Continued use of the platform after changes take effect constitutes acceptance of the updated policy. If you do not agree with the changes, you may delete your account by contacting us.

14. Contact us