Privacy Policy

1. Scope

This policy covers three separate contexts, which handle data very differently:

• The website — merido.dev, including the blog, docs, and tools.
• The self-hosted software — merido running on your own machine or servers.
• The hosted service — the optional cloud deployment we operate.

2. The self-hosted software (local-first)

When you run merido yourself, it operates as a local-first gateway. By default it stores its data — API keys you add, provider credentials, usage records, and audit logs — in an embedded database on your own system, encrypted at rest with a key under your control.

• We receive nothing. Your prompts, completions, tokens, keys, and usage never leave your infrastructure to reach us.
• You are the data controller. You decide what is stored, for how long, and who can access it.
• Upstream providers still apply. Requests you route through merido are sent to the LLM providers you configure, under those providers' own privacy policies.

The self-hosted software does not phone home or send telemetry to us by default. If a future version offers optional, opt-in diagnostics, it will be clearly disclosed and off unless you enable it.

3. The website

3.1 What we collect

• Basic server logs — such as IP address, browser type, referring page, and timestamps, generated automatically when you visit, used for security and to keep the site running.
• Information you submit — for example, if you email us or contact us through a form, we receive what you send.
• Limited analytics — aggregate, privacy-respecting usage metrics to understand which pages are useful. We avoid tools that build cross-site advertising profiles.

3.2 Cookies

The marketing site aims to use only essential cookies (or none). Any non-essential cookies, if introduced, will be subject to your consent where required by law.

4. The hosted (cloud) service

If you create an account on the hosted service, we process the data needed to provide it.

4.1 What we store

• Account data — your email, a hashed password (we never store passwords in plaintext), and basic profile/organization details.
• Configuration — the gateway settings, routing rules, and the upstream provider API keys you add, stored encrypted at rest.
• Usage & billing metadata — token counts, model and provider used, cost estimates, timestamps, and audit-log entries, so you can see your usage and we can operate and secure the service.

4.2 Request content

To route a request, the hosted service necessarily processes its content in transit. We do not use your prompts or completions to train models. We minimize retention of request/response bodies and retain only what is needed for the features you use (for example, usage accounting or features you explicitly enable such as caching).

4.3 How we use it

• To provide, maintain, secure, and improve the hosted service.
• To show you usage, costs, and savings in your dashboard.
• To communicate with you about your account and service changes.
• To comply with legal obligations and enforce our Terms.

5. How we share data

We do not sell your personal data. We share data only:

• With upstream LLM providers — to route the requests you send, using the keys you supply.
• With service providers — infrastructure, hosting, and similar vendors who process data on our behalf under appropriate confidentiality and security terms.
• For legal reasons — when required by law or to protect the rights, safety, or security of merido, our users, or the public.
• In a business transfer — if the project or service is acquired or reorganized, subject to this policy.

6. Data retention

For the hosted service, we keep account and configuration data while your account is active and delete or anonymize it within a reasonable period after you close your account, except where we must retain it to meet legal obligations. For the self-hosted software, retention is entirely up to you. Website logs are kept only as long as needed for security and operations.

7. Security

We use reasonable technical and organizational measures to protect data, including encryption of sensitive values (such as provider keys) at rest and encryption in transit. No system is perfectly secure, and you are responsible for securing any merido instance you self-host.

8. Your rights

Depending on where you live, you may have rights to access, correct, delete, export, or restrict the processing of your personal data, and to object to certain processing. For data held in the hosted service, you can exercise these rights by contacting us at [email protected]. For self-hosted instances, you control the data directly. We will respond to verified requests as required by applicable law.

9. International transfers

The hosted service and its providers may process data in countries other than yours. Where required, we use appropriate safeguards for such transfers.

10. Children

merido is not directed to children and is not intended for use by anyone under the age of 16 (or the minimum age required in your jurisdiction). We do not knowingly collect personal data from children.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will revise the "Last updated" date above and, for material changes to the hosted service, take reasonable steps to notify account holders.

12. Contact

Questions or privacy requests? Email us at [email protected].