Privacy Policy

This Privacy Policy applies to the websites, applications, and hosted services operated by Axial Labs, Inc. under the Meridi brand. It covers information we collect directly from users, automatically through use of the service, and from connected integrations or customer-provided content.

Information you provide

• Account details such as name, email, company, role, and avatar
• Workspace content such as clients, stakeholders, milestones, documents, notes, and status updates
• Meeting inputs such as invitations, recordings, transcripts, summaries, and follow-up requests
• Prompts, instructions, edits, approvals, and other interactions with Meridi AI
• Support requests, feedback, and billing or subscription selections

Information collected automatically

• Usage and navigation data such as pages visited, features used, and timestamps
• Device and browser data such as IP-derived region, browser type, operating system, and approximate diagnostics
• Error, performance, and reliability data used to secure and improve the platform
• Cookie and local-storage data needed for authentication, preferences, and in-product state

• Provide, secure, host, maintain, and improve the service
• Authenticate users, manage permissions, and support workspace administration
• Process payments, subscriptions, credits, invoices, and account changes
• Generate meeting summaries, AI recommendations, drafts, and structured outputs you request
• Operate diagnostics, monitoring, fraud prevention, abuse prevention, and incident response workflows
• Respond to support requests and communicate service notices or product updates
• Create aggregated or de-identified product insights that do not identify individual people

We do not sell personal information. We may share information with service providers and processors that help us operate the platform, including categories such as hosting, authentication, databases, payment processing, email delivery, monitoring, analytics, meeting automation, calendar, file and email connectors, AI model providers, and logo or enrichment services.

• Within your workspace according to role-based permissions and sharing actions you initiate
• With vendors that process data on our behalf under contractual and operational controls
• When required by law, legal process, or to protect rights, safety, and security
• In connection with a merger, financing, acquisition, or asset transfer

When you use Meridi AI or meeting intelligence features, we process the content you submit or authorize us to capture, including prompts, meeting context, transcripts, notes, and related workspace records. We use this information to generate outputs you request, maintain product safety, investigate abuse, and improve reliability.

AI outputs may be stored in your workspace so your team can review, reuse, edit, and act on them. Meeting data may also be processed by integrated providers involved in capture, transcription, scheduling, or delivery workflows.

If you connect Google Calendar, Google Calendar Scheduling, Google Drive, or Gmail, Meridi accesses Google user data only to provide the connector features you request. Each connector is optional and asks for its own consent.

• Google Calendar (calendar.events.readonly): read-only. Used to synchronize upcoming event context for meeting preparation and to schedule the Meridi notetaker for eligible meetings. Meridi does not change events through this connection.
• Google Calendar Scheduling (calendar.events.owned): optional, with separate consent. Meridi creates a single event on your primary calendar only after you review and apply it, and Google then sends invitations to every attendee you list. Meridi does not edit or delete Calendar events.
• Google Drive and Docs (drive.file): limited to files you select with Google Picker or files Meridi creates for you. Meridi updates a Google Doc only after you approve the change.
• Gmail (gmail.readonly, gmail.compose): used to find threads with contacts you have confirmed as stakeholders and to create drafts you explicitly approve. Meridi does not send messages, delete mail, change labels, or modify mailbox settings.
• Google account email (userinfo.email): every Google connector requests it. Meridi uses the connected account’s email address to identify and label the connection, and keeps it with the connection. Drive, Gmail, and Calendar Scheduling accept only an email Google reports as verified; Google Calendar keeps the email Google returns without that check.

• Refresh tokens Meridi stores for Google Drive, Gmail, and Google Calendar Scheduling remain server-side and encrypted at rest. For Google Calendar, Meridi passes the refresh token to Recall.ai, which holds it to synchronize your calendar, and keeps only Recall.ai’s calendar ID. A short-lived Drive access token may be returned only to an authenticated Meridi browser session to open Google Picker; tokens are not logged or included in AI prompts.
• Google content is processed only for the client workflow you invoke, remains subject to Meridi workspace permissions, and is treated as untrusted source evidence.
• We do not sell Google user data, use it for advertising, or use it to train generalized AI or machine-learning models.
• Google content may be sent to contracted infrastructure or AI processors only as needed to produce the user-requested Meridi result, under confidentiality and data-protection controls.
• Disconnecting Google Drive, Gmail, or Google Calendar Scheduling asks Google to revoke Meridi’s token, deletes Meridi’s stored credentials, and disables the connector’s chat tools. Google Calendar is synchronized through Recall.ai: disconnecting it asks Recall.ai to delete the synchronized calendar, and if that deletion fails, Recall.ai may keep calendar access until the calendar is removed. To end all access, remove Meridi from the third-party connections in your Google Account. You may also request deletion of retained connector mappings and audit records where legally permitted.

Meridi’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

If you connect Outlook Calendar, OneDrive, or Outlook mail, Meridi accesses Microsoft user data only to provide the connector features you request, using delegated permissions you approve. Each connector is optional and asks for its own consent, separate from signing in.

• Outlook Calendar (Calendars.Read): read-only. Synchronized through our meeting provider, Recall.ai, to prepare meeting context and schedule the Meridi notetaker. Nothing is written to your calendar.
• OneDrive (Files.Read): read-only. Meridi searches your connected OneDrive for a specific file name or phrase and never lists the whole drive. The search covers the whole drive, not only files related to your project, so results can show the names and details of unrelated files. Meridi opens a file’s contents only after a search for your project returned it, cites what it used, and never writes to OneDrive. For formats Meridi cannot read as text, it uses only the file’s metadata.
• Outlook mail (Mail.Read): read-only. Meridi searches only messages matched to contacts you have confirmed as project stakeholders, and opens a message only after that search. Meridi never sends, drafts, deletes, or changes mail.
• Microsoft account profile (User.Read, with offline_access and, for OneDrive and Outlook mail, openid and profile): every Microsoft connector requests it. For OneDrive and Outlook mail, Meridi uses your Microsoft account ID and email address or user principal name to verify and label the connected account, and keeps both with the connection. For Outlook Calendar, Meridi keeps only the calendar’s email address, when Microsoft returns one. It does not use other profile data.
• Refresh tokens Meridi stores for OneDrive and Outlook mail remain server-side and encrypted at rest; tokens are not logged or included in AI prompts. For Outlook Calendar, Meridi passes the refresh token to Recall.ai, which holds it to synchronize your calendar, and keeps only Recall.ai’s calendar ID.
• Microsoft content is processed only for the workflow you invoke, remains subject to Meridi workspace permissions, and is treated as untrusted source evidence. It may be sent to contracted infrastructure or AI processors only as needed to produce the result you requested.
• We do not sell Microsoft user data, use it for advertising, or use it to train generalized AI or machine-learning models.
• Disconnecting a Microsoft connector removes Meridi’s stored credentials and stops Meridi’s own access. For Outlook Calendar, Meridi also asks Recall.ai to delete the synchronized calendar; if that deletion fails, Recall.ai may keep calendar access until the calendar is removed. To end all access, remove Meridi’s permissions in your Microsoft account settings.

We use administrative, technical, and organizational measures designed to protect information, including encrypted transport, access restrictions, role-based permissions, environment controls, and monitoring for service reliability and security events. No system can be guaranteed perfectly secure, so you should also use strong credentials and appropriate internal governance for the data you place in the platform.

We use cookies, browser storage, and similar technologies to keep users signed in, remember settings, preserve interface state, analyze product usage, and monitor performance. Disabling certain cookies or storage features may prevent parts of the service from working correctly.

We retain information for as long as reasonably necessary to provide the service, maintain customer workspaces, honor legal or contractual requirements, resolve disputes, enforce agreements, and preserve security or backup integrity. Different categories of information may be retained for different periods based on purpose and risk.

Depending on where you live, you may have rights to access, correct, export, delete, or restrict certain personal information. Workspace administrators may also be able to update or delete information inside the product directly.

• Access or update your profile and workspace information
• Request exports or deletion where applicable
• Opt out of non-essential marketing communications
• Ask questions about service providers, subprocessors, or data handling

Requests can be sent to admin@meridi.ai.

Information may be processed in countries other than the one where you live. Where required, we use reasonable safeguards to support lawful transfers of personal information.

The service is intended for business use and is not directed to children under 16. We do not knowingly collect personal information from children under 16 through the service.

We may update this Privacy Policy from time to time. When changes are material, we will post the revised version in the service or provide other reasonable notice and update the effective date above.

If you have questions about this policy, personal information handling, or security-related requests, contact admin@meridi.ai.

Axial Labs, Inc. Meridi Privacy Contact