Subprocessors & Service Providers Policy

1. Scope

This Policy covers principal third parties that process or may process Customer Data in connection with MERAKAN Lite, as well as material independent transaction parties that receive limited account or billing data.

It does not necessarily list professional advisers, government authorities, internet carriers, payment-network participants, code-hosting systems that do not receive Customer Data, or MERAKAN’s own banking and treasury providers that do not receive Customer Data as part of providing the Service.

2. Current Principal Subprocessors

The table describes the principal current functions. Google may use distributed infrastructure as described in its service terms; a stated primary storage region does not imply that all transient or global processing occurs exclusively in that region.

3. Google Cloud Platform

Google Cloud provides the application runtime, task queue, database, object storage, network protection, logging, backup, and recovery infrastructure. MERAKAN currently stores the primary database and file data in us-central1 (Iowa, United States).

Data is protected in transit using TLS and at rest using Google Cloud encryption. MERAKAN applies account-scoped authorization, public-access prevention for storage, and other controls described in the DPA.

4. Google Vertex AI

When a user requests extraction, MERAKAN sends the applicable document image and a fixed extraction instruction to Google Vertex AI. Uploading a file alone does not initiate AI extraction.

MERAKAN does not grant Google permission or instruction to use Customer Data to train or fine-tune AI/ML models. Google’s published Vertex AI data-governance documentation states that Customer Data is not used for training or fine-tuning managed models without prior permission or instruction.

Google also documents that, unless caching is disabled at the project level, Gemini models may cache inputs in memory and, for supported models, in encrypted durable storage, isolated to the project and deleted no later than 24 hours after being written. This cache is provider-side, short-lived processing and is not a separate persistent MERAKAN Customer Data store.

5. Firebase and Identity Platform

Google Identity Platform handles user authentication. MERAKAN does not store users’ plaintext passwords. Firebase Hosting delivers application and website files and is not used as a repository for invoice content.

MERAKAN Lite does not currently use Firebase Analytics, advertising SDKs, or cross-site behavioral tracking as part of ordinary Service operation.

6. Google Workspace

MERAKAN uses Google Workspace company mailboxes for business, support, billing, privacy, security, and DMCA correspondence. If a Customer voluntarily sends Customer Data or attachments by email, those communications may be stored in Google Workspace under MERAKAN’s account.

7. Paddle — Independent Transaction Party

When paid website subscriptions are enabled, Paddle acts as authorized reseller and Merchant of Record for the transaction. Paddle is not used to process invoice images, extracted invoice fields, notes, or attachments and is not treated by MERAKAN as a Customer Data subprocessor for that function.

Paddle may receive the account owner’s email address, billing country, billing address, account reference, and other checkout information and independently processes payment credentials, transaction taxes, invoices, receipts, refunds, fraud-prevention information, and transaction records under Paddle’s own terms and privacy notice.

Personal data shared between MERAKAN and Paddle for the reseller relationship may be processed on a controller-to-controller basis or in another role required by applicable law and the parties’ Paddle agreements.

The Paddle entity that contracts with the buyer depends on the buyer’s location: Paddle.com Inc. for buyers in the United States, Paddle.com (Canada) Ltd for buyers in Canada, and Paddle.com Market Limited (United Kingdom) for other buyers (Paddle Buyer Terms).

8. Providers Not Listed as Customer Data Subprocessors

GitHub hosts program source code and technical documentation and is not intentionally used to process Customer Data. Google Cloud Build and Artifact Registry are used for software build/deployment artifacts and are not intentionally used to process Customer Data.

Corporate banking and treasury providers used solely to receive MERAKAN’s own settlement proceeds are not Customer Data subprocessors merely because MERAKAN maintains a company account with them. Such providers are not included here unless MERAKAN begins disclosing Customer Data to them for Service delivery.

9. Subprocessor Selection and Contractual Controls

MERAKAN selects providers based on functionality, security, reliability, privacy, legal requirements, contractual protections, and compatibility with the Service.

Where applicable, MERAKAN requires subprocessors to process Customer Data only for authorized purposes, maintain appropriate confidentiality and security protections, comply with applicable processing restrictions, and address security or privacy obligations according to the relevant provider agreement.

10. Access Limitation and Data Minimization

A provider is intended to receive only information reasonably necessary for its assigned function. Not every provider receives every category of Customer Data. MERAKAN does not provide Customer Data to subprocessors as a general-purpose commercial data product.

11. AI Processing Restrictions

MERAKAN does not use Customer Data to train, fine-tune, or improve any AI model and does not authorize an AI provider to do so. Aggregated operational statistics that do not identify a Customer or individual and contain no invoice content may be used to operate and measure the Service.

12. No Behavioral Advertising

MERAKAN does not use Customer Data for cross-context behavioral advertising and does not authorize subprocessors to use Customer Data for unrelated behavioral advertising as part of MERAKAN’s authorized processing.

13. Changes to Principal Subprocessors

MERAKAN may add, replace, or remove principal subprocessors where reasonably necessary to operate, secure, maintain, or improve the Service.

Where reasonably practicable and contractually applicable, MERAKAN will provide at least 30 days’ advance notice before a material addition or replacement of a principal subprocessor that will process Customer Data. Notice may be provided by email to account Owners and by a dated update to the published Subprocessors page.

14. Customer Objections

Where the DPA or applicable law provides an objection mechanism, a Customer may submit a reasonable written objection during the applicable notice period, identifying the specific provider and the material data-protection concern.

MERAKAN will consider reasonable objections in good faith. Because MERAKAN Lite uses shared infrastructure, MERAKAN may not be able to move a single Customer to a different equivalent provider. If a material objection cannot reasonably be resolved, available remedies may include termination of the affected Service and export of Customer Data in accordance with the Terms and DPA.

15. Emergency Changes

MERAKAN may engage or replace a provider without the full advance-notice period where reasonably necessary because of a security incident, urgent operational failure, provider discontinuation, legal requirement, material interruption, or another circumstance where advance notice is not reasonably practicable. Where appropriate, MERAKAN will provide notice after the change.

16. Geographic Processing

Primary Customer Data storage is currently in Iowa, United States (us-central1). AI extraction uses a global Vertex AI endpoint and is not limited to one region. Authentication, network protection, logging, email, and other provider functions may use distributed infrastructure.

MERAKAN does not represent that all processing occurs exclusively in one jurisdiction. International processing is subject to the DPA, provider agreements, and applicable law.

17. Security Incidents

If MERAKAN becomes aware of a security incident involving Customer Data processed by a subprocessor and notification is required by the DPA or applicable law, MERAKAN will provide notice in accordance with the DPA and may supplement available information as the investigation develops.

18. Relationship to the DPA

For Customer Data processing, mandatory applicable law controls, then any expressly negotiated written data-processing agreement, then the DPA. This Policy provides transparency regarding principal providers and does not reduce protections expressly granted by the DPA.

19. Updates to This Policy

MERAKAN may update this Policy to reflect provider changes, technical changes, data-processing changes, or legal and contractual requirements. Each published version will identify its effective date.

20. Company Information

MERAKAN LLC

Registered Office: 30 N Gould St Ste R, Sheridan, WY 82801, United States

Website: www.merakan.com | Service Application: app.merakan.com

General Inquiries: info@merakan.com | Support: support@merakan.com | Billing: billing@merakan.com

Security Reports: support@merakan.com | Privacy & Data Requests: support@merakan.com

DMCA Notices: store@merakan.com

DMCA Designated Agent: Ahmad Almusalam | Phone: +1 307-381-8088 | Registration No.: DMCA-1081799

© 2026 MERAKAN LLC. All rights reserved.