This Privacy Policy explains how the entity operating Meridian CTC (“Meridian,” “we,” “us”) collects, uses, discloses, and protects information in connection with the Meridian CTC service (the “Service”). It should be read together with our Terms of Service.
1. Our two roles
Account and website data. For information about the loan officer or organization that holds an account, we act as the controller of that data and process it as described here.
Borrower and loan-file data (NPI). The loan files, documents, and borrower nonpublic personal information you submit are provided by and belong to you (or your organization). For that data, Meridian acts as your service provider and processor, handling it on your behalf and under your instructions solely to provide the Service. You are responsible for having the authority and consents to submit that data.
2. Information we collect
- Account information — name, email, password credentials, company, license/NMLS identifiers, and settings you provide.
- Billing information — plan, subscription status, and billing identifiers. Card details are handled by our payment processor; we do not store full card numbers.
- Loan-file content you submit — conditional approvals, conditions, uploaded documents, borrower contact details, and related data, which may include nonpublic personal information.
- Usage and log data — actions taken in the Service, an append-only activity/audit log, device and approximate location signals such as IP address, and diagnostic information.
3. How we use information
- to provide, operate, secure, and support the Service;
- to process loan-file content as needed to deliver the Service’s features (parsing, drafting, matching, tracking, and communications you approve);
- to process payments and manage subscriptions;
- to maintain an audit trail of actions taken on a loan file, for security, accountability, and your recordkeeping;
- to detect, prevent, and respond to fraud, abuse, security incidents, and legal obligations; and
- to improve the reliability and quality of the Service.
We do not sell personal information, and we do not use borrower nonpublic personal information for advertising or for any purpose other than providing the Service to you.
4. AI processing
To deliver AI-assisted features, relevant loan-file content is sent to our AI model provider solely to generate the requested output and return it to the Service. We work to limit this to the minimum content needed for the task. We do not permit borrower content to be used to train third-party public models where such controls are available to us. [Confirm the zero-data-retention tier and data-processing terms with the AI provider before onboarding real borrower data.]
5. Subprocessors
We use trusted service providers to run the Service. Current categories include cloud hosting and database (infrastructure), an AI model provider, email delivery, and payment processing. Each is engaged under terms requiring appropriate confidentiality and security. A current list is available on request.
6. How we share information
We share information only: with the subprocessors above to operate the Service; with the recipients you direct (for example, a communication you approve and send to a borrower or third party); as required by law or to respond to lawful requests; to protect the rights, safety, and security of Meridian, our users, or others; and in connection with a merger, acquisition, or sale of assets, subject to this Policy.
7. Security
We maintain administrative, technical, and organizational safeguards designed to protect information, including access controls, tenant isolation, encryption in transit, and an append-only audit log. No system is perfectly secure; we cannot guarantee absolute security. You are responsible for protecting your account credentials and for the devices you use to access the Service.
8. Data retention and deletion
We retain account information for as long as your account is active and as needed for legitimate business and legal purposes. Loan-file content is retained while you use the Service; you may delete a loan file within the Service, which removes its documents and associated records (a minimal deletion receipt is retained for audit purposes). On account termination, we will handle Customer Content in accordance with our data-retention practices and applicable law. Because you are the record-keeper of legal record for your loans, you are responsible for retaining any originals you are required to keep.
9. Your choices and rights
You may access and update your account information in the Service. Because much of the loan-file data we hold is processed on your behalf, requests from borrowers or others regarding that data are generally directed to and handled by you as the controller; we will assist you as your service provider as required by law. Depending on your location, you may have rights under laws such as the California Consumer Privacy Act; we honor applicable rights and act as a service provider with respect to data processed on your behalf.
10. Children
The Service is a business tool for licensed professionals and is not directed to children, and we do not knowingly collect information from children.
11. Changes to this Policy
We may update this Policy from time to time. When we make material changes, we will update the version and effective date above and, where appropriate, notify you. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.
12. Contact
Questions or privacy requests: hello@mail.meridianctc.com.