Privacy Policy.

Information you provide. When you create a Merida account or use the Service, we collect: name, email, phone, business name, business website and description, business address, EIN or other tax identifiers, beneficial-owner names, dates of birth, partial Social Security numbers, government-issued IDs (where required by our payment-processing partner), bank account information, and the contents of any messages or documents you upload.

Transactional information. When customers pay through your account, we receive the payment amount, currency, product or invoice description, customer email and name, billing address, IP address, and the last four digits of the card used. We never store full card numbers. Those are tokenized by our payment-processing partner.

Usage and device information. When you use the Service we automatically collect IP address, browser type, operating system, referrer URL, pages visited, and timestamps. We use cookies and similar technologies for authentication, preferences, fraud prevention, and basic analytics.

Information from third parties. We receive verification, sanctions-screening, and enriched-business data from our payment-processing partner and from background-check or KYC providers we engage from time to time.

• To provide, maintain, and improve the Service
• To verify your identity and your business under anti-money-laundering, know-your-customer, and sanctions laws
• To process payments, payouts, refunds, disputes, and tax
• To detect, prevent, and investigate fraud or abuse
• To respond to support requests and communicate with you
• To send service updates and security notices
• To comply with legal obligations, court orders, and regulatory requests
• With your consent, to send you product updates and marketing communications (you can opt out at any time)

We share information in the following circumstances:

• Stripe (payment processing). We share business profile, identity, ownership, bank-account, and KYC information with Stripe, Inc. so that Stripe can verify your identity, comply with anti-money-laundering laws, and process payments and payouts on your behalf. Stripe's handling of your information is governed by Stripe's Privacy Policy.
• Service providers. Cloud hosting, email-delivery, analytics, customer-support, and similar vendors that need access to perform services on our behalf, subject to confidentiality and data-processing obligations.
• Tax authorities. Where Merida acts as the merchant of record, we share invoice and tax data with the relevant tax authorities to satisfy filing obligations.
• Legal and safety. When required by law, court order, or to protect the rights, property, or safety of Merida, our users, or others.
• Corporate transactions. In connection with a merger, acquisition, financing, or asset sale, in which case this Policy will continue to apply or you will be notified of any change.

We do not sell personal information, and we do not share personal information with third parties for their independent marketing purposes.

We use first-party cookies for authentication and session management, and a small number of analytics cookies to understand how the Service is used. You can control cookies through your browser settings. Disabling authentication cookies will prevent you from signing in.

We retain personal information for as long as your account is active and for a reasonable period thereafter to comply with legal, tax, accounting, and audit obligations. Transactional and KYC records are typically retained for at least seven years after the related transaction or account closure, as required by anti-money-laundering and tax-record retention laws. You can request deletion of personal information that we are not legally required to retain.

Subject to applicable law, you may have the right to (a) access the personal information we hold about you, (b) correct or update it, (c) request deletion (subject to retention obligations), (d) object to or restrict certain processing, (e) data portability, and (f) withdraw consent for marketing. Submit requests by emailing [email protected]. We will respond within the time required by applicable law. Residents of California, the EEA, the UK, and similar jurisdictions may have additional rights, including the right to lodge a complaint with a data-protection supervisory authority.

Merida is operated by Haloweave from Bengaluru, India. Because we serve merchants and customers worldwide, your information may be transferred to, stored in, and processed in other countries where we or our service providers (such as payment processors and cloud infrastructure providers) operate. Where required, we rely on Standard Contractual Clauses or other recognised transfer mechanisms to protect your information in those transfers.

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us so we can delete it.

We use industry-standard administrative, technical, and physical safeguards designed to protect personal information against unauthorised access, disclosure, alteration, and destruction. No system is perfectly secure, and we cannot guarantee absolute security. Please notify us right away if you suspect unauthorised access to your account.

We may update this Policy from time to time. Material changes will be notified through the dashboard or by email. The "Last updated" date at the top of this page reflects when the most recent changes took effect.

Questions about this Policy or about our handling of your personal information can be sent to [email protected] or by post to Haloweave, 72, Oil Mill Rd, Ramaswamipalya, Kammanahalli, Bengaluru, Karnataka 560084, India.