1. Introduction
MeriApply ("we", "us", "our") is committed to protecting your privacy. This policy explains how we collect, use, store and protect your personal data in accordance with UK GDPR and the Data Protection Act 2018.
2. Data we collect
We collect:
- Account information (email, name)
- Documents you upload to your vault (CV, transcripts, certificates, reference letters)
- Application data and preferences
- Payment and billing information (processed by Stripe — we do not store full card details)
- Usage data to improve our services (e.g. pages visited, features used)
- Correspondence when you contact support
3. How we use your data
Your data is used to provide the MeriApply platform: matching opportunities, generating application drafts, submitting applications on your behalf where you have authorised this, processing payments, and delivering service and (where you have opted in) marketing notifications. We do not use your documents to train AI models.
4. Legal basis for processing
We process your personal data under the following UK GDPR legal bases:
- Contract — account creation, generating drafts, submitting applications, and billing, where processing is necessary to provide the service you have signed up for.
- Consent — marketing emails and non-essential cookies, which you can withdraw at any time (see Sections 7 and 8).
- Legitimate interests — service improvement, fraud prevention, and platform security, balanced against your rights and freedoms.
- Legal obligation — where we must retain or disclose data to comply with the law (e.g. tax records).
5. Data retention
We keep personal data only as long as necessary for the purposes described in this policy:
- Account and vault data — retained while your account is active, and deleted (or anonymised) within 30 days of you closing your account, except where we are required to keep records for longer (see below).
- Billing records — kept for 6 years to meet UK tax and accounting obligations.
- Support correspondence — kept for up to 24 months after your last interaction.
- Usage and log data — kept for up to 12 months for security and service-improvement purposes, then deleted or aggregated.
You can request deletion of your account and vault data at any time (see Section 10); some data may be retained in encrypted backups for a limited period before being purged.
6. Third parties and international transfers
We share personal data only with service providers who process it on our behalf, under contract, and only for the purposes described in this policy. We do not sell your personal data.
Our current sub-processors include:
- Supabase — database, authentication and file storage for your account and vault.
- Anthropic and OpenAI — AI providers used to generate strategy briefs and draft sections from your vault data.
- Stripe — payment processing for subscriptions.
- Resend — transactional and marketing email delivery.
- Sentry — error monitoring to help us fix bugs.
- Google — optional sign-in via Google OAuth, if you choose to use it.
Some of these providers may process data outside the UK/EEA (including in the United States). Where this happens, we rely on appropriate safeguards recognised under UK GDPR, such as Standard Contractual Clauses or the provider's adequacy certification. Contact us for details of the safeguards used for a specific provider.
7. Marketing communications
If you subscribe to our newsletter or opt in to marketing updates, we will only send you marketing emails with your consent. Every marketing email includes a one-click unsubscribe link, and you can withdraw consent at any time without affecting service (transactional) emails such as account, billing, or application-status notifications, which we send as part of providing the service.
9. Automated decision-making
MeriApply uses automated processing to calculate a fit score for opportunities and to generate draft application content from your vault. These outputs are recommendations and drafts only — no fully automated decision with legal or similarly significant effect is made about you without the opportunity for human review. You always review, edit and approve your own drafts before submission, and any automatic submission is one you have explicitly authorised during onboarding.
10. Your rights
You have the right to access, rectify, erase, restrict processing, data portability and object, and the right to withdraw consent at any time where we rely on consent. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. To exercise any of these rights, contact us at [email protected].
11. Data security
We encrypt documents and personal data in transit and at rest, and restrict access to personal data to those who need it to provide the service. No system is completely secure, and we encourage you to use a strong, unique password on your account.
12. Children's privacy
MeriApply is intended for users aged 16 and over. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us at [email protected] and we will delete it.
13. Changes to this policy
We may update this policy from time to time. We will update the "last updated" date above, and where changes are material we will notify you by email or an in-app notice.
14. Contact
MeriApply is operated by Understify Ltd (Company Number: 16938284, registered in England and Wales). Durham County, United Kingdom.
Data Protection Officer: [email protected]. General enquiries: [email protected]. ICO registration number: ZC155188.