سياسة الخصوصية

1. Scope and B2B Nature

MERAKAN Lite is intended for business and organizational use. This Privacy Policy applies to information processed in connection with MERAKAN Lite, the MERAKAN website, the Service Application, and related MERAKAN business communications.

It also applies to users whom an account Owner invites to an account. The Owner provides their email addresses and roles to MERAKAN, and their actions within the account may be recorded in the account activity log.

Where MERAKAN processes Customer Data solely on behalf of a Customer, MERAKAN acts as a processor, service provider, contractor, or equivalent role to the extent applicable; the DPA governs that processing.

2. Information We Collect

Depending on how the Service is used, MERAKAN may collect or process the following categories of information:

• Account and identity information, including first and last name, date of birth for age-eligibility purposes, business email address, business phone number, declared business country, time zone, interface-language preference, account status, and user role;
• Business and contact information;
• Customer Data, including invoice and receipt images, extracted and corrected fields, notes, attachment images, manually entered customer information, expenses, and related business records;
• Usage and technical information, including timestamps, feature usage, unit consumption, request metadata, browser/device information, IP address, user-agent information, application events, diagnostic information, and security events;
• Acceptance and legal records, including document versions, acceptance timestamps, account/user identifiers, and cryptographic fingerprints of accepted text;
• Limited billing and subscription metadata received from Paddle;
• Support and business communications; and
• Security, fraud-prevention and abuse-prevention information, the country and network-location signals used at sign-up for availability and sanctions compliance, and the results of any sanctions screening of names, account and transaction information, reasonably necessary to operate and protect the Service.

3. Account and Identity Information

Account information may include the account creator’s first and last name, business email address, date of birth, business phone number with international calling code, business or organization information, declared business country, time zone, interface-language preference, account status, account identifier, user role, and authentication-related information necessary to create and administer the account. Where it can be determined, the country of the network connection used at sign-up is recorded with the account.

Date of birth is used for the account-creator eligibility rule in the Terms. MERAKAN does not use date of birth for advertising or profiling. Password credentials are handled by Google Identity Platform and are not stored by MERAKAN in plaintext.

For invited users, MERAKAN processes the invited email address, assigned role, account association, and activity records necessary to provide team access.

4. Customer Data and Customer Content

“Customer Data” has the meaning stated in the Terms and includes information the Customer or its users upload, enter, or confirm in the Service, including invoice and receipt images; extracted and corrected fields; customer names and phone numbers entered manually on sales invoices; notes; attachment images; expenses; the business name; and derived reports or export files.

As between MERAKAN and the Customer, the Customer retains its rights in Customer Data. The Customer determines what information is lawful and appropriate to submit and is responsible for third-party information contained in its documents.

5. Usage and Technical Information

MERAKAN may collect information about requests and processing activity, feature usage, unit consumption, dates and timestamps, browser and device characteristics, IP address, user-agent information, application events, security events, diagnostic information, and other technical information reasonably necessary to operate, maintain, secure, and troubleshoot the Service.

The usage ledger is intended to record the information necessary to administer usage entitlements, such as timestamp and an extraction reference, rather than the financial contents of the invoice. Request metadata may appear in platform operational or security logs.

6. Acceptance and Legal Records

MERAKAN maintains records demonstrating acceptance of contractual documents. Records may include the applicable version, acceptance timestamp, account and user identifiers, interface language, and a cryptographic fingerprint of the accepted Terms text.

Each later acceptance may be recorded as a separate entry rather than overwriting earlier records. Acceptance records are retained for the life of the account and for up to 24 months after deletion, subject to applicable law and legitimate dispute, security, or compliance needs.

7. Billing and Transaction Information

Paid website transactions are handled through the applicable Paddle entity acting as authorized reseller and Merchant of Record. Paddle collects payment details and other checkout information under its own Buyer Terms and Privacy Notice.

MERAKAN does not receive or store full payment-card numbers, card security codes, or online-banking credentials. MERAKAN may receive and store limited transaction metadata needed to administer access, such as Paddle customer and subscription identifiers, transaction or event identifiers, subscription status, billing-period dates, billing country, add-on purchase information, and related status information.

Paddle may retain transaction invoices, receipts, payment-method details, tax information, and other transaction records under its own legal obligations and policies. For personal data shared between MERAKAN and Paddle for the reseller relationship, the parties may act as independent controllers or in another role required by applicable law and the parties’ Paddle agreements.

8. How We Use Information

MERAKAN may use information to provide and operate the Service; create and administer accounts; authenticate users; process Customer Content; provide AI-assisted extraction; administer subscription access and usage entitlements; provide support; prevent fraud and abuse; protect Service security; investigate incidents; maintain contractual and legal records; comply with law; enforce contractual rights; and maintain and improve the Service.

For “maintain and improve the Service,” MERAKAN uses operational statistics that do not identify a Customer or individual and contain no Customer Content, such as volumes, error rates, durations, and success rates. MERAKAN does not use Customer Data to train or improve AI models.

9. AI Processing

Invoice and receipt images are stored in Google Cloud Storage when uploaded and are transmitted to Vertex AI only when AI-assisted extraction is requested. AI-assisted processing may produce incomplete, inaccurate, or incorrect results, and the Customer must review important output before relying on it.

The Service displays extracted data with the applicable document for human review before the save action. Unsaved extraction results do not become confirmed invoice records or enter reports. Totals and reports are computed programmatically from saved values.

AI extraction uses a Google Vertex AI global endpoint. Google documents that, unless caching is disabled at the project level, Gemini models may cache inputs in memory and, for supported models, in encrypted durable storage, isolated to the project and deleted no later than 24 hours after being written. Such provider-side short-lived caching is governed by Google’s cloud terms and does not authorize model training. Under the Google Cloud Platform Terms of Service, Google may also log prompts to detect potential abuse and violations of its Acceptable Use Policy and Prohibited Use Policy.

10. No AI Model Training

MERAKAN does not use Customer Data to train, fine-tune, or improve any artificial-intelligence model and does not grant Google or another AI provider permission to do so.

MERAKAN may use aggregated operational statistics that do not identify a Customer or individual and contain no invoice content to operate, secure, measure, and improve the Service. MERAKAN does not use Customer Data to improve its extraction instructions.

11. Third-Party Providers and Transaction Parties

MERAKAN uses selected third parties to operate the Service. Their roles are described in the Subprocessors & Service Providers Policy.

• Subprocessors or service providers that may process Customer Data on MERAKAN’s behalf include Google Cloud Platform for infrastructure, hosting, storage, queueing, security, and logging; Google Vertex AI for AI-assisted extraction; Firebase / Google Identity Platform for authentication and application delivery; and Google Workspace for correspondence sent to MERAKAN company mailboxes.
• Paddle acts as an independent transaction party, authorized reseller, and Merchant of Record for paid website transactions. Paddle receives billing and checkout information but is not used to process invoice images or extracted invoice data.

MERAKAN may update providers in accordance with the DPA and Subprocessors & Service Providers Policy.

12. Hosting and Storage Location

Customer Data is currently stored primarily on Google Cloud infrastructure in the us-central1 region (Iowa, United States), including the database and file storage used by MERAKAN Lite.

The stated storage location does not mean that every processing activity occurs exclusively in Iowa. AI-assisted extraction uses a global Vertex AI endpoint; authentication, network protection, and operational logging may involve distributed Google infrastructure.

Google documents that Gemini models may cache inputs in memory and, for supported models, in encrypted durable storage for no longer than 24 hours unless caching is disabled. MERAKAN does not treat that provider-side short-lived cache as a separate MERAKAN Customer Data store.

13. Security

MERAKAN maintains administrative, technical, and organizational measures designed to protect information against unauthorized access, alteration, disclosure, destruction, or misuse. Measures are described in more detail in the DPA and may include TLS encryption in transit, encryption at rest through the configured cloud services, authentication and access controls, role-based permissions, tenant separation, short-lived access mechanisms, request-rate controls, operational logging, audit records, backups, recovery controls, and restricted administrative access.

Security measures reduce risk but do not guarantee absolute security or zero risk. Customers remain responsible for endpoint security, credentials, authorized users, and handling of exported or downloaded information.

14. Cookies and Similar Technologies

MERAKAN Lite may use technically necessary browser storage, sessions, authentication mechanisms, security technologies, and similar mechanisms required to operate the website and Service.

MERAKAN Lite does not currently use advertising pixels, advertising identifiers, cross-site behavioral tracking, session-recording tools, or third-party advertising SDKs as part of ordinary Service operation. Interface preferences and sign-in state may be stored in the browser.

15. No Sale or Behavioral Advertising

MERAKAN does not sell Customer Data for monetary consideration and does not use Customer Data submitted for invoice or receipt processing for cross-context behavioral advertising.

Where a U.S. state privacy law uses the terms “sell” or “share” differently, MERAKAN applies the applicable statutory definitions and the DPA terms relevant to MERAKAN’s processor or service-provider role.

16. Data Sharing and Disclosure

MERAKAN may disclose or make information available to:

• Subprocessors and service providers performing authorized functions for MERAKAN;
• Paddle and related payment-network participants as necessary for website transactions;
• Professional advisers where reasonably necessary and subject to appropriate duties;
• Government authorities, courts, or other parties where legally required or permitted;
• Parties involved in legal proceedings, dispute resolution, security incidents, or fraud investigations; and
• Parties involved in a merger, acquisition, financing, reorganization, or sale of assets, subject to applicable contractual and legal protections.

MERAKAN does not sell Customer Data for monetary consideration and does not use Customer Data for cross-context behavioral advertising.

17. Government and Legal Disclosures

MERAKAN may disclose information where reasonably necessary to comply with applicable law or a binding legal process; respond to a valid court order, subpoena, or lawful governmental request; establish, exercise, or defend legal rights; investigate fraud, abuse, or security incidents; or protect MERAKAN, Customers, users, or third parties.

MERAKAN reviews legal requests through a human process. Where legally permitted and reasonably practicable, MERAKAN may notify the relevant Customer before disclosure and may seek to limit disclosure to information reasonably necessary for the lawful request.

18. Business Transfers

If MERAKAN is involved in a merger, acquisition, financing, reorganization, transfer of substantially all assets, or similar corporate transaction, information may be transferred as part of that transaction, subject to applicable confidentiality, contractual, and legal requirements.

19. International Processing

MERAKAN LLC is organized in the United States and uses authorized providers whose infrastructure may process information in the United States and other jurisdictions necessary to provide and secure the Service.

Cross-border processing is subject to applicable contracts and mandatory law. A contractual Wyoming governing-law clause does not override privacy or data-protection requirements that apply mandatorily to a specific processing activity.

20. Geographic Availability

MERAKAN Lite is not currently offered as a business service to customers established in the European Union, European Economic Area, United Kingdom, or Switzerland. The current list of countries offered by the Service is presented at sign-up and may change prospectively.

This availability policy does not mean that privacy or data-protection laws outside Wyoming or the United States can never apply. Mandatory laws may apply according to the Customer’s location, the location of affected individuals, the nature of the processing, or other jurisdictional rules.

21. Retention Principles

MERAKAN retains information only for periods reasonably necessary for the purposes described in this Policy, the Terms, contractual obligations, security and fraud prevention, legal compliance, dispute resolution, and legitimate business needs.

Specific operational periods are described in Section 22. Mandatory legal holds, security investigations, dispute preservation, or technical backup cycles may require limited retention beyond an ordinary period.

22. Current Retention Schedule

The current retention framework is set out below. Periods may be extended where reasonably necessary to comply with law, preserve evidence, resolve disputes, investigate security incidents, prevent fraud or abuse, or enforce contractual rights.

Deleted information may remain in backups until the applicable backup lifecycle expires. Provider-side short-lived processing, including any Vertex AI cache described in Section 9, is governed by the applicable provider terms and configuration.

23. Account Deletion

An Owner may request deletion from within the application or through the public account-deletion page at app.merakan.com/delete-account. The request is subject to a seven-day withdrawal period. After that period ends, active Customer Content and account data are deleted within 30 days, subject to the limited retention categories in Section 22 and mandatory law.

Deletion does not necessarily remove information immediately from backups, acceptance records, trial-abuse markers, or other limited compliance records. A website subscription may be cancelled as part of the deletion workflow where technically supported; the Customer should confirm the billing status shown by Paddle if a separate cancellation action is required.

24. Customer Responsibilities

Customers are responsible for determining what personal information is included in Customer Data; obtaining required rights, notices, permissions, consents, and authorizations; maintaining appropriate internal access controls; ensuring submitted information is lawful; ensuring users are authorized; and complying with privacy and data-protection requirements applicable to their own use of the Service.

Where MERAKAN acts only as processor or service provider, the Customer remains primarily responsible for determining the legal basis and purpose of processing and for responding to affected individuals, subject to MERAKAN’s assistance obligations in the DPA.

25. Data Minimization

Customers should submit only information reasonably necessary for the intended invoice, receipt, recordkeeping, or related Service purpose and should avoid submitting sensitive information that is not necessary.

26. Sensitive and Restricted Information

MERAKAN Lite is not designed as a repository for highly sensitive personal information, authentication secrets, complete payment-card credentials, government identification databases, biometric databases, or medical records unrelated to the Service’s intended functionality.

Point-of-sale receipts may contain masked card digits. Full payment-card numbers, CVV codes, PINs, passwords, online-banking credentials, and other authentication secrets must not be submitted unless the Service expressly permits the data and the Customer has a lawful basis and authorization.

27. Security Incidents

If MERAKAN becomes aware of a security incident affecting Customer Data that requires notice under applicable law or contractual obligations, MERAKAN will provide the required notice without undue delay and within any shorter period required by applicable law, subject to legitimate security, legal, and investigative considerations.

Notice may be delayed or limited where legally permitted or reasonably necessary to avoid compromising an investigation, security measure, or legal obligation. Additional information may be provided as the investigation develops.

28. Privacy and Data Requests

Depending on applicable law and MERAKAN’s role, eligible individuals may have rights of access, correction, deletion, restriction, objection, portability, opt-out, appeal, or other privacy rights. MERAKAN will handle qualifying requests as required by applicable law.

Where MERAKAN processes Customer Data solely on behalf of a Customer, a request concerning invoice, receipt, or other Customer Data should generally be directed to the business that uploaded or controls the information. MERAKAN will reasonably assist the Customer as required by the DPA and applicable law.

Requests concerning information MERAKAN controls directly may be submitted to support@merakan.com. MERAKAN may request information reasonably necessary to verify a request and protect the account.

29. U.S. State Privacy Rights

Certain U.S. state privacy laws may provide rights to eligible residents and may impose obligations on businesses, controllers, processors, service providers, or contractors. The availability and scope of those rights depend on the applicable statute, thresholds, exemptions, and MERAKAN’s role for the relevant information.

Where MERAKAN processes personal information on behalf of a Customer that is subject to the California Consumer Privacy Act (CCPA), MERAKAN intends to act as a service provider or contractor to the extent provided in the DPA and applicable law. The DPA contains specific restrictions on sale/sharing, purpose limitation, combining information, subcontracting, assistance, and compliance monitoring.

Qualifying requests concerning information MERAKAN controls directly may be submitted to support@merakan.com. Requests concerning Customer Data processed solely for a business Customer may need to be directed first to that Customer.

30. Marketing Communications

MERAKAN may send transactional, security, billing, contractual, and administrative communications necessary to operate the account or Service.

Optional marketing email is sent only through a separate opt-in or another lawful basis. Marketing messages will provide an available unsubscribe mechanism and will be handled in accordance with applicable commercial-email requirements, including the U.S. CAN-SPAM Act where applicable. Opting out of marketing does not stop necessary transactional or legal communications.

31. Third-Party Websites and Services

The Service may contain links to or integrations with third-party websites or services. Those third parties operate under their own terms and privacy notices, and MERAKAN is not responsible for privacy practices outside MERAKAN’s control.

32. Children

MERAKAN Lite is a B2B service for adults acting for businesses or organizations and is not directed to persons under 18. MERAKAN does not knowingly design the Service to solicit personal information directly from children.

Customer documents may incidentally contain information about individuals under 18. In that circumstance, the Customer remains responsible for ensuring that submission and processing are lawful and appropriate.

33. Data Export

Where technically available, MERAKAN provides mechanisms for Customers to export applicable Customer Data. Current invoice data can be exported in Excel format, including during the applicable read-only period after a trial or subscription ends. Individual document images can be opened full-size from their document pages and saved through the browser; bulk image export is not currently available.

Export features do not replace the Customer’s responsibility to maintain originals and legally required records.

34. Legal and Compliance Records

MERAKAN may retain information reasonably necessary to document contractual acceptance, subscription administration, security events, abuse-prevention decisions, legal compliance, Customer communications, disputes, incident response, and enforcement of legal or contractual rights, subject to the retention schedule and applicable law.

35. Changes to This Privacy Policy

MERAKAN may update this Privacy Policy to reflect changes in the Service, applicable law, security practices, providers, data-processing practices, or business operations. Each published version identifies its effective date.

Where a material change alters the use or disclosure of previously collected information and applicable law requires additional notice or consent, MERAKAN will provide that notice or obtain consent. Where the contractual framework requires renewed acceptance, the account Owner may be required to re-accept before continued use, without preventing available data export or an account-deletion request.

36. Accuracy of Privacy Commitments

MERAKAN intends this Policy to describe actual MERAKAN Lite privacy practices as of the Effective Date. Privacy and security statements are commitments to the extent stated, but they are not guarantees of absolute security, uninterrupted availability, or zero risk.

If a technical, operational, legal, or business practice materially changes, MERAKAN will update the relevant documentation and technical controls as appropriate.

37. Relationship to Other Documents

This Privacy Policy forms part of the contractual and operational framework for MERAKAN Lite and should be read together with the Terms & Conditions, Acceptable Use Policy, Billing & Refund Policy, Data Processing Addendum, Subprocessors & Service Providers Policy, Service Availability & Support Policy, and DMCA & Copyright Policy, as applicable.

38. Controller, Business, Processor, and Service-Provider Roles

Depending on context, MERAKAN may act as an independent business/controller for information used to administer its own customer relationship, account security, legal compliance, contractual records, and business operations, and as a processor/service provider for Customer Data processed solely on a Customer’s documented instructions.

The DPA governs processor/service-provider processing where applicable. Paddle separately processes payment and transaction personal data for its reseller and Merchant-of-Record functions under Paddle’s applicable terms and privacy notice.

39. Contact Information

Privacy and data requests: support@merakan.com

General support: support@merakan.com

Security reports: support@merakan.com

Billing inquiries: billing@merakan.com

DMCA notices: store@merakan.com

40. Company Information

MERAKAN LLC

Registered Office: 30 N Gould St Ste R, Sheridan, WY 82801, United States

Website: www.merakan.com | Service Application: app.merakan.com

General Inquiries: info@merakan.com | Support: support@merakan.com | Billing: billing@merakan.com

Security Reports: support@merakan.com | Privacy & Data Requests: support@merakan.com

DMCA Notices: store@merakan.com

DMCA Designated Agent: Ahmad Almusalam | Phone: +1 307-381-8088 | Registration No.: DMCA-1081799

© 2026 MERAKAN LLC. All rights reserved.