How Meridian handles store information

Information Meridian processes

Meridian processes merchant and shop data needed to authenticate the app, connect to Shopify, provide AI customization workflows, create bundles, and measure the performance of Meridian bundle experiments.

When a merchant uses AI features, including Chat, onboarding, AI Page Setup, and automated bundle planning, Meridian may process prompts, conversation history, reference images, storefront screenshots, customization previews, product and store context, block and theme settings, and related operational logs.

• Shop and installation metadata such as shop domain, access scopes, and app session state.
• Product and collection data needed to create bundles and other supported storefront blocks, including descriptions, images, prices, availability, and, where used by planning features, cost and sales-performance information.
• App configuration data such as block settings, theme settings, and storefront embed state.
• AI chat inputs such as prompts, thread history, clarification answers, reference image context, and generated customization previews for blocks like bundles, buy buttons, announcement bars, sticky cart, and payment icons.
• Storefront configuration and implementation context needed to preview, apply, or undo supported AI edits within the merchant's Shopify environment.
• Limited order analytics for Meridian bundles: order identifier, order date, currency, order and discount totals, product and variant identifiers, quantities, and Meridian's own bundle attribution properties. Meridian uses these records to calculate bundle revenue, refunds, profit checks, and A/B-test outcomes.
• Pseudonymous storefront experiment signals: an anonymous visitor or session identifier, experiment and variant assignment, interaction type, timestamp, and the relevant bundle/page identifier. These signals are sent only when Shopify's storefront privacy API permits analytics processing.
• Meridian does not intentionally collect or store customer names, email addresses, phone numbers, postal addresses, full customer profiles, or raw Shopify order/web-pixel payloads for these analytics workflows.
• AI usage counts, credit counts, billing status, and plan state used to govern access to app features.
• Support and troubleshooting context that merchants intentionally provide through support requests sent to getmeridian.app@gmail.com.

How Meridian uses information

Meridian uses processed information to authenticate merchants, run AI chat customization flows, generate and apply supported storefront edits, measure AI feature usage, calculate bundle and experiment performance, monitor service health, and respond to support requests.

Meridian uses the minimum data reasonably required for those workflows and does not request protected customer identity fields such as name, email, phone, or address for bundle analytics. Order data supports merchant-facing bundle analytics and experiment decisions, and derived sales and performance summaries may be included in AI planning context. Provider use of AI request content is described below.

Sharing and service providers

Meridian shares relevant data with infrastructure and service providers that help operate the app, such as hosting, database, queueing, analytics, AI, and Shopify platform services. AI requests may pass through OpenRouter to model providers, including Meta. Other providers may be used for different features or fallback requests. AI providers may also use request content for their own purposes as described below; they do not necessarily act only as processors on Meridian's instructions.

Where screenshots or files are created through Shopify-managed storage, those merchant-owned assets remain subject to the merchant's Shopify environment and controls.

AI content sharing and model training

Meridian currently uses AI services whose terms permit providers to retain and use submitted content and generated responses to train, develop, evaluate, and improve their AI models, products, and services. This use goes beyond generating an answer for your store and may benefit other users of the provider's services.

Content sent to an AI provider can include your prompt and conversation history, uploaded images, storefront screenshots, relevant product and store information, theme or block code and settings, tool results, and generated responses. Context may be assembled automatically by onboarding, planning, customization, or automated features; it is not limited to the text you type. Removing account identifiers does not guarantee that this content is anonymous.

Do not submit personal information, customer information, credentials, sensitive information, or confidential material to AI features that use training-enabled services. This restriction also applies to attachments and store content that may be included automatically. Use only material you have the rights and authority to share for the disclosed provider uses. Merchant permission does not override provider restrictions or the rights of other people.

If you require confidential processing or do not want content used for provider training, contact getmeridian.app@gmail.com before using AI features. Meridian does not currently promise an in-app training opt-out or a non-training route for every AI workflow. Publishing this policy or installing the app is not, by itself, a separate consent to training use where such consent is required.

Retention

Meridian applies automated retention periods to data stored in its application database. Guide sessions expire within 7 days, completed/failed capture jobs expire after 30 days, and inactive chat/customization records expire after 90 days.

Raw storefront session and interaction records expire after 90 days. Raw order facts expire after 400 days, which supports the merchant's 365-day dashboard view. Active A/B tests receive a temporary retention hold so they cannot lose evidence before a decision is made.

Completed analytics ingest jobs expire after 7 days; permanently failed jobs expire after 30 days. Aggregate daily dashboard metrics are retained while the merchant remains installed because they do not contain visitor or session identifiers.

These periods apply to Meridian-held records. AI providers apply their own retention and deletion terms to content they receive, including content used for training, security, and policy review. Deleting a chat, uninstalling Meridian, or requesting deletion of Meridian-held records does not automatically delete provider-held copies or reverse training already performed. Meridian does not guarantee a fixed provider retention period or removal of content from trained models.

International processing and privacy rights

Hosting and AI providers may process information outside your country, including in the United States. Where personal data is involved, applicable data-protection laws may require a lawful basis, appropriate processing agreements, and safeguards for international transfers. This policy does not replace those requirements or authorize sending personal information to a service that prohibits it.

Depending on applicable law, you may have rights to access, correct, delete, restrict, or obtain a copy of personal data, object to processing, withdraw consent where processing relies on consent, and complain to a competent data-protection authority. Contact getmeridian.app@gmail.com to make a request or obtain current recipient and transfer information. Withdrawal does not affect the lawfulness of prior processing and does not guarantee reversal of completed model training.

Security

Meridian is intended to encrypt data in transit using HTTPS/TLS and to rely on encrypted-at-rest controls provided by its production hosting and storage providers. Access to protected operational data should be limited to authorized personnel with a business need to know.

Meridian also uses access controls, scoped Shopify permissions, and operational logging to reduce unnecessary exposure of store and merchant data.