Privacy Policy

Meridians is operated by Autism Central LLC, a limited liability company formed in the State of Wyoming, United States.

For the purposes of the EU General Data Protection Regulation and the UK GDPR, Autism Central LLC is the data controllerfor all personal data described in this policy. It decides why your data is processed and how. Where this policy says “we” or “us,” it means Autism Central LLC.

Autism Central LLC
1309 Coffeen Ave Ste 1200
Sheridan, WY 82801
United States
hello@meridians.now

Representative in the EU and the UK. Autism Central LLC has no establishment in the European Economic Area or the United Kingdom, and no representative under Article 27 of the GDPR or the UK GDPR is currently appointed. Until one is, contact us directly at hello@meridians.now about anything in this policy, and you keep every right described in section 8 regardless — including your right to complain to your own supervisory authority.

We collect the following information when you use Meridians:

• Email address — provided during account registration for authentication via magic link.
• Birth data — date of birth, time of birth, and city of birth, required to generate your astrocartography reading. If you use the partner feature, the same data for the person you enter.
• Payment information — processed securely by Stripe. We do not store your credit card details on our servers.
• Subscription and billing records — the identifiers Stripe assigns to you as a customer and to your subscription, which plan you are on, its status, the current billing period, and whether it is set to cancel. For each order: what was bought, the amount, and when.
• Consent records — for purchases that required it, the exact wording you agreed to at checkout and the time you agreed to it, kept as evidence that the consent was taken.
• Readings — the readings generated for you, and which cities they are for.
• Usage data — collected via Google Analytics, including pages visited, time on site, and general interaction patterns.

Under the GDPR every purpose needs a lawful basis. Ours are:

• To generate your readings — performance of our contract with you, Article 6(1)(b). Without your birth data there is no reading to give you.
• To take payment and run your subscription — performance of our contract with you, Article 6(1)(b).
• To authenticate you and keep you signed in — performance of our contract with you, Article 6(1)(b).
• To send you account, order and reading emails — performance of our contract with you, Article 6(1)(b). These are service messages, not marketing.
• To keep billing and order records — compliance with a legal obligation, Article 6(1)(c), and our legitimate interest in being able to defend a claim, Article 6(1)(f).
• To keep consent records — our legitimate interest in being able to show that a consent was given, Article 6(1)(f), and compliance with the record-keeping expected under consumer law, Article 6(1)(c).
• To improve the Service using analytics — your consent, Article 6(1)(a). We ask before any analytics cookie is set, and you can withdraw at any time. See the next paragraph and section 7.

How we ask. The first time you visit, you are asked whether to allow analytics cookies. Nothing analytics-related is loaded or set until you answer: accepting and rejecting are offered as equally prominent choices, nothing is pre-ticked, and closing or ignoring the banner is treated as a refusal. If you reject, Google Analytics is never loaded and no analytics cookie is set. The site works exactly the same either way.

Changing your mind. You can withdraw consent at any time, and it is as easy to withdraw as it was to give: reopen the cookie settings from the link in the site footer and choose to reject. Withdrawing stops any further analytics collection. It does not undo processing that already happened while your consent was in place, which remains lawful.

Follow-up email. The Service contains code that can send a follow-up message about a reading you have received, with an unsubscribe link. That code is not currently scheduled to run, and nothing else calls it, so no follow-up email is being sent to anyone at present. If it is switched on, this section will say so and will state the basis it relies on before the first message goes out.

Your data is stored in Supabase, a cloud database platform. Data is encrypted at rest and in transit. We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, or destruction.

We share data with the following third-party services, each for a specific purpose. Each acts as a processor on our instructions, except where noted:

• Stripe — payment processing and subscription billing. Stripe receives your payment details directly and is PCI-DSS compliant. Stripe determines some of its own processing as a controller.
• Supabase — database hosting and authentication. Stores your account, birth data, readings, orders and subscription record.
• Vercel — application hosting. Serves the web application.
• Google Analytics — usage analytics. Collects anonymized usage data.
• Anthropic — AI reading generation. Your birth data is sent to Anthropic’s API to generate your written astrocartography readings.
• Resend — email delivery. Your email address and the contents of the message are passed to Resend so that account, order and reading emails can be sent to you.

Where your data is stored and handled. The database that holds your account, your birth data, your readings, your orders and your subscription record runs in Ireland (Supabase, West EU region). The application code that reads and writes it — every API route on this site — also runs in Ireland (Vercel, dub1). So your personal data is both stored and processed inside the European Economic Area, and a request you make does not have to cross the Atlantic to be served.

Where it nonetheless goes. That is not the whole picture. Autism Central LLC is established in the United States, and four of the services in section 5 are US companies that receive or process your data there — Stripe for payments, Google for analytics, Anthropic for generating your readings, and Resend for email. None of that changed when the hosting moved to Ireland. So some of your personal data — including the birth data sent to generate a reading, and your email address — does still leave the EEA and the UK, and US data protection law is not equivalent to the GDPR.

The safeguard we rely on. For every processor named in section 5 we rely on that provider’s published data processing agreement, each of which incorporates the European Commission’s Standard Contractual Clauses, together with the UK Information Commissioner’s International Data Transfer Addendum for transfers from the United Kingdom. Specifically: Stripe (SCCs Modules 1 and 2, UK Addendum), Supabase (SCCs, UK Addendum), Vercel (SCCs Module 2, UK Addendum), Anthropic (SCCs Modules 2 and 3, UK Addendum), Resend (SCCs, UK Addendum) and Google (SCCs). Each of those agreements is entered into as part of our contract with the provider. You can ask us for the detail that applies to any one of them.

Static pages are delivered from Vercel’s global edge network, which is what makes the site load quickly wherever you are. Those edge locations serve already-built pages and files; they are not where your personal data is read or written. Anything that touches your data runs in the Ireland region named above.

We use the following cookies:

• Session cookies — essential for authentication and maintaining your logged-in state. These are strictly necessary to provide the Service you asked for.
• Google Analytics cookies — used to collect anonymized usage data to help us improve the Service. These are not strictly necessary, so they are set only if you accept them when asked, and never before. Reject, and they are not set at all. You can change your answer at any time from the cookie settings link in the footer.

Wherever you live, you may ask us to delete your account and everything attached to it by emailing hello@meridians.now. We process deletion requests within 30 days. Your account settings also contain a Delete account action you can use yourself.

If you are in the European Economic Area or the United Kingdom, you have the following rights over your personal data:

• Access — a copy of the personal data we hold about you, Article 15.
• Rectification — correction of data that is wrong or incomplete, Article 16.
• Erasure — deletion of your personal data, Article 17.
• Restriction — a pause on processing while a dispute about it is resolved, Article 18.
• Portability — the data you gave us, in a machine-readable form, Article 20.
• Objection — to processing we base on legitimate interests, Article 21.
• Withdrawal of consent — where we rely on your consent, you can withdraw it at any time, Article 7(3). Withdrawing is as easy as giving it was, and it does not make the processing we carried out before you withdrew unlawful.
• Complaint to a supervisory authority — you can lodge a complaint with the data protection authority in the country where you live or work, or where you think the problem happened, Article 77. In the UK that is the Information Commissioner’s Office. You do not have to come to us first, though we would rather you did.

To exercise any of these rights, contact us at hello@meridians.now. We reply within one month of receiving your request, as Article 12(3) requires; if a request is complex we may extend that by up to two further months and will tell you why within the first month. We do not charge for this.

We keep different data for different lengths of time:

• Account and birth data, and your readings — for as long as your account is active. If you delete your account or ask us to, we remove your personal data within 30 days.
• Subscription records — the plan, its status and its billing periods are kept for as long as you have an account, because they determine what the Service gives you. Stripe keeps its own copy under its own policy.
• Billing and tax records — what was bought, the amount, and when. We keep these for 7 years from the date of the transaction, because tax and accounting law requires it. They are kept even if you delete your account: erasing them is not something we are permitted to do, and Article 17(3)(b) of the GDPR recognises that. What is retained is the transaction record itself, not your birth data or your readings, which are deleted with the rest of your account. Stripe keeps its own record of your payments under its own policy.
• Consent records — the wording you agreed to at checkout and the time you agreed to it. We keep these for 7 years, alongside the billing record of the same purchase, and they are kept even if you delete your account. Article 7(1) of the GDPR requires us to be able to demonstrate what you agreed to, and a record that disappears the moment an account is closed cannot do that — for you or for us. What survives is the wording and its timestamp attached to the transaction, not your account, your birth data or your readings.
• Usage data — held by Google Analytics on our property for this site. Event data is kept for 2 months and user data for 14 months, after which Google deletes it. The user-data period resets when the same person visits again, so an active visitor’s record is retained for 14 months from their most recent visit rather than their first. Aggregated reporting that identifies nobody may be kept for longer.

Meridians is not intended for users under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13, we will take steps to delete that information promptly.

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. Your continued use of the Service after changes are posted constitutes acceptance of the revised policy.

If you have questions about this Privacy Policy, or want to exercise any right described in section 8, contact us at hello@meridians.now.

Autism Central LLC
1309 Coffeen Ave Ste 1200
Sheridan, WY 82801
United States