Privacy Policy
Last updated: October 20, 2026
Meridelo is a planning app at meridelo.com. This policy explains what personal data we process, why, who receives it and what your rights are.
1. Who is responsible
The data controller is Matteo Tedesco, Via Forner 3, 31010 Monfumo (TV), Italy. For any privacy question or request, write to privacy@meridelo.com.
2. What we collect
- Account: your name, email address, its verification status and your profile picture from Google, when you sign in with Google.
- What you create: tasks and their title, description, notes, deadlines, estimates, importance and recurrence; subtasks; pause reasons; captured thoughts; focus sessions and task history; projects and environments such as Work and Home.
- Settings: working hours, daily capacity, time zone, language and theme.
- Teams and organizations: your membership and role, tasks assigned to you or by you, and a record of who set an organization priority and when.
- Google Calendar: only if you connect it. See section 4.
- Payments: on paid plans, Stripe handles payment. We receive a customer identifier and your subscription status, never your full card details.
- Push notifications: if you enable them, the browser subscription needed to deliver them.
- Usage and technical data: events about how you use Meridelo, such as which features you open, linked to your account; and error reports, which do not include your name or email. We use no third-party analytics.
3. Why we use it
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing Meridelo: plans, focus, teams | Contract, Art. 6(1)(b) |
| AI features you ask for | Contract, Art. 6(1)(b) |
| Security, abuse prevention, fixing errors | Legitimate interest, Art. 6(1)(f) |
| Understanding how Meridelo is used, to improve it | Legitimate interest, Art. 6(1)(f) |
| Billing and tax records | Legal obligation, Art. 6(1)(c) |
We do not sell your data and we do not use it for advertising.
4. Google Calendar data
Connecting Google Calendar is optional. Meridelo asks for read-only access (calendar.events.readonly) and cannot create, change or delete events.
- What we read: start time, end time and title of today's events in your primary calendar. Only time inside your working hours counts; all-day, declined and "free" events are ignored.
- What we use it for: to subtract meeting time from your daily capacity, so your plan fits the hours you really have. The planning engine receives only a number of minutes.
- How long we keep it: for the events counted, we keep title, start, end and minutes for up to 7 days, and delete everything immediately when you disconnect. Calendar access tokens are stored encrypted.
- What we never do: we never send calendar data to AI providers, never use it for advertising and never let people read it, except with your permission or where the law requires.
Meridelo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You can disconnect at any time in Settings, or revoke access from your Google Account.
5. AI features
Meridelo never uses AI to decide your priorities or your plan: those come from fixed rules. AI is used only when you ask for it, for example to draft a task from pasted text or a screenshot, to suggest a next step, to help when you are stuck, or in the task chat.
When you use these features, we send OpenAI the content the feature needs: the task's title, description, subtasks, pause notes and captured thoughts, images you attach, text or screenshots you paste and, for some requests, the titles of up to ten other tasks. Calendar data is never sent.
OpenAI does not use data sent through its API to train its models and keeps it for up to 30 days to detect abuse. Do not include in a task information you do not want processed this way.
6. Who receives your data
| Provider | Role | Where data is processed |
|---|---|---|
| Vercel | Hosting and server processing | Germany (Frankfurt) |
| Neon | Database | United Kingdom (London) |
| Upstash | Rate limiting | Germany (Frankfurt) |
| Sentry | Error monitoring | European Union |
| GitHub | Encrypted backups | United States |
| OpenAI | AI features | United States |
| Stripe | Payments | Ireland (Stripe Payments Europe), with transfers to the United States |
| Sign-in and Calendar | Ireland (Google Ireland Limited), on servers worldwide |
Each provider processes data only on our instructions and only to deliver its part of the service.
If you join a team, its owners and managers see what they need to coordinate work, such as tasks assigned within the team and your work status. They never see your notes, task descriptions or calendar.
7. Transfers outside the EU
Some providers are based in, or process data in, the United States. These transfers rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses. Our database is in the United Kingdom, which the European Commission recognizes as providing adequate protection.
8. How long we keep data
- Account and content: while your account is active, and deleted within 30 days after you ask us to delete it.
- Backups: encrypted and kept for 30 days.
- Calendar data: up to 7 days, as described in section 4.
- Usage events and server logs: up to 1 day in our hosting provider's logs.
- Error reports: 30 days.
- Billing records: for the period required by Italian law.
9. Your rights
You can ask to access, correct or delete your data, to restrict or object to its processing, and to receive it in a portable format. Export is also available in Settings. To delete your account, write to privacy@meridelo.com from the address you sign in with. You can disconnect Google Calendar at any time.
Write to privacy@meridelo.com: we answer within one month. You can also lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali.
10. Cookies and local storage
Meridelo uses two cookies: one keeps you signed in, the other remembers your language for up to a year. Local storage keeps preferences such as theme and the active environment. We use no advertising or third-party analytics cookies.
11. Age
Meridelo is not intended for anyone under 16.
12. Security
Data travels encrypted (HTTPS). Calendar tokens are encrypted at rest, access to systems is restricted, and backups are encrypted.
13. Changes
If we change this policy in a meaningful way, we will tell you in the app before the change applies. The date at the top shows the latest version.