How Meridian collects, uses and protects personal data — for adviser/firm accounts, and for client data entered by advisers using the platform.
Meridian ("Meridian," "we," "us") is a cashflow forecasting software platform for financial advisers and advisory firms, operated by Meridian Cashflow Technologies Ltd, incorporated in the United Arab Emirates ("Company").
This Privacy Policy explains how we collect, use, and protect personal data when you use Meridian, whether as a firm administrator, an adviser user, or a client whose forecast is prepared by an adviser using Meridian.
This distinction matters and governs everything below.
If you are a client whose adviser has entered your details into Meridian, your relationship for data protection purposes is with your adviser/firm, not with us directly. Direct any data subject request to them in the first instance; we assist them in fulfilling it.
Account data (we are controller):
Client forecast data (firm is controller, we are processor):
We do not knowingly collect special category / sensitive data (health, biometric, religious, etc.) beyond what an adviser might input as free-text notes at their own discretion. Advisers are responsible for not entering sensitive data unless necessary for the forecast.
| Purpose | Legal basis |
|---|---|
| Provide and operate the forecasting software | Performance of contract (subscription agreement) |
| Account security, fraud prevention | Legitimate interest |
| Billing and subscription management | Performance of contract |
| Product improvement, bug fixing, aggregated usage analytics | Legitimate interest |
| Marketing communications to advisers (product updates) | Consent / legitimate interest, opt-out always available |
| Client forecast data | Processed solely on the instructions of the controlling firm, per DPA |
We do not sell personal data. We do not use client forecast data to train third-party AI models or for any purpose beyond delivering the service to the firm that entered it.
Where data is transferred outside the UAE (for example, to our EU-based hosting infrastructure), we rely on contractual data-processing terms with our hosting providers that impose security and confidentiality obligations consistent with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL). Full detail is in our Sub-processor List.
Depending on applicable law (UAE PDPL, UK GDPR for UK-connected data subjects), individuals may have the right to: access their data, request correction, request deletion, restrict or object to processing, and request portability.
See our Security page for full detail. In summary: encryption in transit and at rest, per-firm database-level access isolation (Supabase Row-Level Security), access-controlled authentication, and no local storage of financial data outside the platform.
See our published Sub-processor List, which we keep current and will notify firms of material changes to.
See our Cookie Policy.
Meridian is a professional B2B tool. It is not directed at, and we do not knowingly collect data from, individuals under 18 acting in a personal capacity (client data entered by advisers about minors, e.g., school-fee planning, is handled as ordinary client data under the firm's instruction).
We will notify registered firm administrators by email of material changes and update the "last updated" date above.
Data protection queries: support@meridiancashflow.com
Registered address: Dubai, United Arab Emirates.